Multiple Unique LDAP configuration Issue

[Negib A. Sherif]

Hello,


I have Shibboleth 2.4 setup and working with LDAPs authentication.  I have 2 LDAPs  one is in remote and the other one is Local, OpenLDAP, hosted in the same server were IDP is installed.  UID is unique in each LDAPs(No UID duplication). My configuration in:


1) login.config file has:

 edu.vt.middleware.ldap.jaas.LdapLoginModule required
      ldapUrl="ldap://LocalLDAP.lib.wayne.edu:636"
      baseDn="dc=LocalLDAP,dc=lib,dc=wayne,dc=edu"
      bindDn="bindDninfo"
      bindCredential="password"
      ssl="false"
      userFilter="uid={0}";

  edu.vt.middleware.ldap.jaas.LdapLoginModule required
      ldapUrl="ldap://RemoteLDAP.wayne.edu:636/ou=People,dc=wayne,dc=edu?uid?one?"
      baseDn="dc=RemoteLDAP,dc=wayne,dc=edu"
      bindDn="bindDninfo"
      bindCredential="password"
      ssl="false"
      userFilter="uid={0}";


2) attribute-resolver.xml file has:

 <!-- Local Open Source LDAP Connector -->
     <resolver:DataConnector id="myLocalLDAP" xsi:type="dc:LDAPDirectory"
        xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        ldapURL="ldap://LocalLDAP.lib.wayne.edu:389"
        baseDN="dc=LocalLDAP,dc=lib,dc=wayne,dc=edu"
        principal="principalinfo"
        principalCredential="password"
        connectionStrategy="ACTIVE_PASSIVE"
        lowercaseAttributeNames="true">
        <dc:FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>uid</dc:ReturnAttributes>
        <ConnectionPool minPoolSize="3"/>
    </resolver:DataConnector>

 <!-- Remmote LDAP Connector -->
     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        ldapURL="ldap://RemoteLDAP.wayne.edu:389/ou=People,dc=wayne,dc=edu?uid?one?"
        principal="principalinfo"
        principalCredential="password"
        lowercaseAttributeNames="true">
        <dc:FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>uid</dc:ReturnAttributes>
        <ConnectionPool minPoolSize="3"/>
    </resolver:DataConnector>

3)  attribute-filter.xml has:
     <afp:AttributeFilterPolicy id="uid">
         <afp:PolicyRequirementRule xsi:type="basic:ANY" />
         <afp:AttributeRule attributeID="uid">
             <afp:PermitValueRule xsi:type="basic:ANY"/>
          </afp:AttributeRule>
       </afp:AttributeFilterPolicy>

4) attribute-resolver.xml has:

          <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid" sourceAttributeID="uid">

          <resolver:Dependency ref="myLDAP" />
          <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" />
          <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1"           friendlyName="uid" />
    </resolver:AttributeDefinition>

Independently, Remote or Local LDAP works fine after commenting out, one at a time, the configuration in login.config and attribute-resolver.xml files. However, when I enable both Remote and Local LDAP configrations as shown above, I can authenticate to LocalLDAP if UID exist in LocalLDAP. When I try with UID that exist in RemoteLDAP but not in LocalLDAP, I get the usual login failed error message. For RemoteLDAP UID, the search stops at LocalLDAP and then genrates login failed error message. There is no error in idp-process.log file when tomcat6 starts. Both LocalLDAP and RemoteLDAP binds fine, loads data connectors and attribute definitions. see the snippet below from idp-process.log file.

0:48:06.554 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:511] - Loading 2 data connectors
10:48:06.554 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:521] - Loading 2 attribute definitions


What I want is to check UID first in LocalLDAP. If UID is in LocalLDAP, the way how it works now is fine(able to access SP). However, If UID does not exist in LocalLDAP, search should go to RemoteLDAP to check UID
and allow access to SP if UID exist. Otherwise, UID doesn't exist in Local or Remote LDAP, then it should display login fail error.

What am I missing on the above Shibboleth LDAPs configurations? Can someone help?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160108/472d0ee5/attachment-0001.html>