IDPv3.1.2 LDAP connector: using two distinct LDAP servers?

[Raymond Gardner]

Well, that ExamplefortwoActiveDirectorieswithtwoDNResolversforeach is a very involved configuration.  I have not noticed that before.

Mine is kind of similar, but different.  The one big difference for me is, I'm not using two Active Directory LDAP instances.
I'm using one Active Directory LDAP instance and one OpenLDAP instance.  So, I have one using 'adAuthenticator' and one using 'bindSearchAuthenticator'.
Maybe I have something misconfigured.

The behavior I observe is:

-          login1 - exists in LDAP1, which is OpenLDAP instance

-          login2 - exists in LDAP2, which is Active Directory instance

Authentication for login1 fails:

o   Successful authentication against LDAP1

o   Failed authentication against LDAP2

Authentication for login2 succeeds:

o   Successful authentication against LDAP1 - I don't understand this; this should not be successful as this user does not exist in this LDAP instance; I'm positive

o   Successful authentication against LDAP2

Let me offer some snippets from my conf/authn/ldap-authn-config.xml file.  Any assistance will be greatly appreciated:

    <alias name="%{idp.authn.custom.LDAP.authenticator:aggregateAuthenticator}" alias="shibboleth.authn.custom.LDAP.authenticator" />
    <!-I set the '...-ref' property to this new alias for the bean definition of 'ValidateUsernamePasswordAgainstLDAP'  -->
...
    <!-- OpenLDAP Connection Configuration -->
    <bean id="openLDAPConnectionConfig" class="org.ldaptive.ConnectionConfig" abstract="true" p:ldapUrl="%{idp.authn.open.LDAP.ldapURL}"
        p:useStartTLS="%{idp.authn.LDAP.useStartTLS:true}"
        p:useSSL="%{idp.authn.LDAP.useSSL:false}"
        p:connectTimeout="%{idp.authn.LDAP.connectTimeout:3000}"
        p:sslConfig-ref="sslConfig" />

    <!-- Active Directory Connection Configuration -->
    <bean id="adConnectionConfig" class="org.ldaptive.ConnectionConfig" abstract="true" p:ldapUrl="%{idp.authn.ad.LDAP.ldapURL}"
        p:useStartTLS="%{idp.authn.LDAP.useStartTLS:true}"
        p:useSSL="%{idp.authn.LDAP.useSSL:false}"
        p:connectTimeout="%{idp.authn.LDAP.connectTimeout:3000}"
        p:sslConfig-ref="sslConfig" />
...
    <!-- OpenLDAP Authentication handler -->
    <bean id="openLDAPAuthHandler" class="org.ldaptive.auth.PooledBindAuthenticationHandler" p:connectionFactory-ref="openLDAPBindPooledConnectionFactory" />
    <bean id="openLDAPBindPooledConnectionFactory" class="org.ldaptive.pool.PooledConnectionFactory" p:connectionPool-ref="openLDAPBindConnectionPool" />
    <bean id="openLDAPBindConnectionPool" class="org.ldaptive.pool.BlockingConnectionPool" parent="connectionPool"
        p:connectionFactory-ref="openLDAPBindConnectionFactory" p:name="open-bind-pool" />
    <bean id="openLDAPBindConnectionFactory" class="org.ldaptive.DefaultConnectionFactory" p:connectionConfig-ref="openLDAPBindConnectionConfig" />
    <bean id="openLDAPBindConnectionConfig" parent="openLDAPConnectionConfig" />

    <!-- AD Authentication handler -->
    <bean id="adAuthHandler" class="org.ldaptive.auth.PooledBindAuthenticationHandler" p:connectionFactory-ref="adBindPooledConnectionFactory" />
    <bean id="adBindPooledConnectionFactory" class="org.ldaptive.pool.PooledConnectionFactory" p:connectionPool-ref="adBindConnectionPool" />
    <bean id="adBindConnectionPool" class="org.ldaptive.pool.BlockingConnectionPool" parent="connectionPool"
        p:connectionFactory-ref="adBindConnectionFactory" p:name="ad-bind-pool" />
    <bean id="adBindConnectionFactory" class="org.ldaptive.DefaultConnectionFactory" p:connectionConfig-ref="adBindConnectionConfig" />
    <bean id="adBindConnectionConfig" parent="adConnectionConfig" />

    <!-AD Format DN resolution -->
    <bean id="formatDnResolver" class="org.ldaptive.auth.FormatDnResolver" p:format="%{idp.authn.LDAP.dnFormat:undefined}" />
...
    <!-- Bind Search Configuration -->
    <bean name="bindSearchAuthenticator" class="org.ldaptive.auth.Authenticator" p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}">
        <constructor-arg index="0" ref="bindSearchDnResolver" />
        <constructor-arg index="1" ref="openLDAPAuthHandler" />
    </bean>
    <bean id="bindSearchDnResolver" class="org.ldaptive.auth.PooledSearchDnResolver"
        p:baseDn="#{'%{idp.authn.open.LDAP.baseDN:undefined}'.trim()}"
        p:subtreeSearch="%{idp.authn.open.LDAP.subtreeSearch:false}"
        p:userFilter="#{'%{idp.authn.open.LDAP.userFilter:undefined}'.trim()}"
        p:connectionFactory-ref="bindSearchPooledConnectionFactory" />
    <bean id="bindSearchPooledConnectionFactory" class="org.ldaptive.pool.PooledConnectionFactory"
        p:connectionPool-ref="bindSearchConnectionPool" />
    <bean id="bindSearchConnectionPool" class="org.ldaptive.pool.BlockingConnectionPool" parent="connectionPool"
        p:connectionFactory-ref="bindSearchConnectionFactory" p:name="search-pool" />
    <bean id="bindSearchConnectionFactory" class="org.ldaptive.DefaultConnectionFactory" p:connectionConfig-ref="bindSearchConnectionConfig" />
    <bean id="bindSearchConnectionConfig" parent="openLDAPConnectionConfig" p:connectionInitializer-ref="bindConnectionInitializer" />
    <bean id="bindConnectionInitializer" class="org.ldaptive.BindConnectionInitializer"
            p:bindDn="#{'%{idp.authn.open.LDAP.bindDN:undefined}'.trim()}">
        <property name="bindCredential">
            <bean class="org.ldaptive.Credential">
                <constructor-arg value="%{idp.authn.open.LDAP.bindDNCredential:undefined}" />
            </bean>
        </property>
    </bean>
...
    <!-- Active Directory Configuration -->
    <bean id="adAuthenticator" class="org.ldaptive.auth.Authenticator" p:authenticationResponseHandlers-ref="authenticationResponseHandler"
        p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}">
        <constructor-arg index="0" ref="formatDnResolver" />
        <constructor-arg index="1" ref="adAuthHandler" />
    </bean>
    <bean id="authenticationResponseHandler" class="org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler" />

    <!-- Setup an aggregate authentication approach to support multiple directories -->
    <bean id="aggregateAuthenticator" class="org.ldaptive.auth.Authenticator"
          c:resolver-ref="aggregateDnResolver"
          c:handler-ref="aggregateAuthHandler" />

    <bean id="aggregateDnResolver" class="org.ldaptive.auth.AggregateDnResolver"
          c:resolvers-ref="dnResolvers"
          p:allowMultipleDns="true" />

    <bean id="aggregateAuthHandler" class="org.ldaptive.auth.AggregateDnResolver$AuthenticationHandler" p:authenticationHandlers-ref="authHandlers" />
    <util:map id="dnResolvers">
        <entry key="openLDAPDirectory" value-ref="bindSearchDnResolver" />
        <entry key="adDirectory" value-ref="formatDnResolver" />
    </util:map>
    <util:map id="authHandlers">
        <entry key="openLDAPDirectory" value-ref="openLDAPAuthHandler" />
        <entry key="adDirectory" value-ref="adAuthHandler" />
    </util:map>

Thanks
Raymond

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Brady, Jason W
Sent: Monday, June 27, 2016 11:00 AM
To: Shib Users
Subject: RE: IDPv3.1.2 LDAP connector: using two distinct LDAP servers?


On 6/24/16, 7:55 PM, "users on behalf of Raymond Gardner" <users-bounces at shibboleth.net on behalf of r.gardner at ntta.com<mailto:users-bounces at shibboleth.net%20on%20behalf%20of%20r.gardner at ntta.com>> wrote:

> My experience is that it requires successful authentication against both directories configured.

We are currently using this configuration and my experience is it doesn't require authentication against both directories. Well, based on the Active Directory example (https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ExamplefortwoActiveDirectorieswithtwoDNResolversforeach) and only in live starting this month.

In what test did you experience this? I was able to login in with accounts from either directory.

We have two Active Directory domains in the same forest, but use separate bind credentials and servers for each domain. Our setup makes sure to not have the same username in both domains. I noticed that this caused an issue in v2 when using JAAS.

However, do note that the generic Multiple Directories example and the Active Directory example are not exactly the same. I removed the extra resolvers in our config. With that change they seem to be equivalent (though the generic seems to have updated syntax?).

Jason Brady * Web Developer * San Bernardino Community College District *
1289 Bryn Mawr Ave, Suite B, Redlands, CA 92374 *
Tel 909-384-8691 * Mobile 951-295-9515 * Fax 909-796-6579 * jbrady at sbccd.cc.ca.us<mailto:jbrady at sbccd.cc.ca.us>

****************************************************************
This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. NTT America makes no warranty that this email is error or virus free. Thank you.
****************************************************************

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160630/0edab595/attachment-0001.html>