Password login flow & Kerberos

[FUGAGNOLI Bertrand]

Hi Tom, thanks for that!

I now succeed to get username which I authenticated... but I'm not fluent with attribute-resolver.xml configuration!

Problem: if I can authenticate with Password login flown with Kerberos and set uid attribute to my login username, I didn't succeed to get other principalName LDAP attributes on my AD...

So I configure my IDP to authenticate with Password login flown with LDAP adAuthenticator.

=> I succeed to authenticate
	(INFO [org.ldaptive.auth.Authenticator:259] - Authentication succeeded for dn:...)

=> I succeed a test with ldapsearch to verify if I can bind my AD directly with username at EXAMPLE.ORG

I read on https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration that "By default, attributes will be searched for using the same connection the user authenticated on."

Problem: I fail to configure ldap.properties with 

- idp.attribute.resolver.LDAP.bindDN
and
- idp.attribute.resolver.LDAP.bindDNCredential

to get other LDAP attributes...

Thanks for help,

Bertrand Fugagnoli
 [@@ OPEN @@]

-----Message d'origine-----
De : users [mailto:users-bounces at shibboleth.net] De la part de Tom Zeller
Envoyé : lundi 18 juillet 2016 20:13
À : Shib Users
Objet : Re: Password login flow & Kerberos


> My problems is :
>  
> -       I don’t succeed to configure attribute-resolver.xml to resolve my Kerberos authentication username as UID…

If you have not already, take a look at the example on the wiki :

 https://wiki.shibboleth.net/confluence/display/IDP30/PrincipalNameAttributeDefinition
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

Hi all,

I succeed in configure Password login flown with Kerberos with:

-	authn/password-authn-config.xml
-	authn/krb5-authn-config.xml

	Authentication is provided with Kerberos accounts which not the SERVICE/principal corresponding to keytab , like john.doe / password !

After that, I tried to configure :

-	c14n/subject-c14n.xml
(I uncomment <bean id="c14n/attribute" parent="shibboleth.PostLoginSubjectCanonicalizationFlow" />…)
-	c14n/simple-subject-c14n-config.xml
(I uncomment and configure with my domain <bean parent="shibboleth.Pair" p:first="^(.+)@EXAMPLE\.ORG$" p:second="$1" />>…)

	In order to send the usename which I authenticate (john.doe) as a UID attribute to SPs...

My attribute-filter.xml file contains :

<AttributeRule attributeID="principalName">
            <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

My problems is :

-	I don’t succeed to configure attribute-resolver.xml to resolve my Kerberos authentication username as UID…

Any help will be appreciated!
Thanks a lot.

Bertrand Fugagnoli
[@@OPEN@@]