Multiple Unique LDAP configuration Issue

[Negib A. Sherif]

Thanks Peter.

I changed JAAS configuration flags from Required to Sufficient in login.config for both ldapLoginModules, removed 
baseDn="dc=RemoteLDAP,dc=wayne,dc=edu" line from RemoteLDAP config section in login.config and now works perfectly.
UID can authenticate LocalLDAP or RemoteLDAP based on its membership.  

I have Shib v 3.2 is setup too for testing. 


________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: Friday, January 8, 2016 11:51 AM
To: users at shibboleth.net
Subject: Re: Multiple Unique LDAP configuration Issue

* Negib A. Sherif <aa8288 at wayne.edu> [2016-01-08 17:24]:
> I have Shibboleth 2.4 setup and working with LDAPs authentication.

If you're only starting out you should start with a current (i.e., 3x)
IDP release, of course.

> 1) login.config file has:
>
>  edu.vt.middleware.ldap.jaas.LdapLoginModule required
>       ldapUrl="ldap://LocalLDAP.lib.wayne.edu:636"
>       baseDn="dc=LocalLDAP,dc=lib,dc=wayne,dc=edu"
>       bindDn="bindDninfo"
>       bindCredential="password"
>       ssl="true"
>       userFilter="uid={0}";
>
>   edu.vt.middleware.ldap.jaas.LdapLoginModule required
>       ldapUrl="ldap://RemoteLDAP.wayne.edu:636/ou=People,dc=wayne,dc=edu?uid?one?"
>       baseDn="dc=RemoteLDAP,dc=wayne,dc=edu"
>       bindDn="bindDninfo"
>       bindCredential="password"
>       ssl="true"
>       userFilter="uid={0}";

> Independently, Remote or Local LDAP works fine after commenting out,
> one at a time, the configuration in login.config and
> attribute-resolver.xml files. However, when I enable both Remote and
> Local LDAP configrations as shown above, I can authenticate to
> LocalLDAP if UID exist in LocalLDAP. When I try with UID that exist
> in RemoteLDAP but not in LocalLDAP, I get the usual login failed
> error message. For RemoteLDAP UID, the search stops at LocalLDAP and
> then genrates login failed error message.

You'll need to change the JAAS configuration flags (you have both as
"required". above) then:
  "The overall authentication succeeds only if all Required and
  Requisite LoginModules succeed."
http://docs.oracle.com/javase/8/docs/api/javax/security/auth/login/Configuration.html

> There is no error in idp-process.log file when tomcat6 starts.

Debugging JAAS issues can be difficult.

> Both LocalLDAP and RemoteLDAP binds fine, loads data connectors and
> attribute definitions. see the snippet below from idp-process.log
> file.

Data connectors (and filters) have nothing to do with this.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net