idp v3 authentication - The username you entered cannot be identified
ssn at ebi.ac.uk
ssn at ebi.ac.uk
Tue Mar 15 11:27:37 EDT 2016
Hi,
I have configured IdP v3 to use LDAP and have linked an SP to use that
IdP, when logging in with valid credentials the SP reports back *"The
username you entered cannot be identified."*and logs in idp-warn.log as
"Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'user1'
failed" - IdP seems to load LDAP correctly.
Any pointers? I've listed the idp-warn.log/idp.properties/ldap.properties.
2016-03-15 12:47:54,971 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.AttributeResolverService': Reloading service
configuration
2016-03-15 12:47:54,973 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml]
2016-03-15 12:47:54,985 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id:
eduPersonPrincipalName
2016-03-15 12:47:54,986 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:47:54,986 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: uid
2016-03-15 12:47:54,986 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:47:54,987 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: mail
2016-03-15 12:47:54,987 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:47:54,987 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: givenName
2016-03-15 12:47:54,987 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:47:54,988 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: surname
2016-03-15 12:47:54,988 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:47:54,988 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: commonName
2016-03-15 12:47:54,988 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:47:54,989 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for DataConnector plugin with id: myLDAP
2016-03-15 12:47:54,989 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.AttributeResolverService:
startup date [Tue Mar 15 12:47:54 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:47:55,126 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.AttributeResolverService': Completed reload and
swapped in latest configuration for service
'shibboleth.AttributeResolverService'
2016-03-15 12:47:55,127 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:957]
- Closing ApplicationContext:shibboleth.AttributeResolverService:
startup date [Tue Mar 15 11:49:23 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:47:55,144 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.AttributeResolverService': Reload complete
2016-03-15 12:47:55,148 - INFO [Shibboleth-Audit.Reload:241] -
20160315T124755Z||||http://shibboleth.net/ns/profiles/reload-service-configuration|||||||||
2016-03-15 12:48:18,214 - INFO
[net.shibboleth.ext.spring.context.DelimiterAwareApplicationContext:957]
- Closing WebApplicationContext for namespace 'idp-servlet': startup
date [Tue Mar 15 11:49:25 GMT 2016]; parent: Root WebApplicationContext
2016-03-15 12:48:18,248 - INFO
[net.shibboleth.ext.spring.context.DelimiterAwareApplicationContext:957]
- Closing Root WebApplicationContext: startup date [Tue Mar 15 11:49:20
GMT 2016]; root of context hierarchy
2016-03-15 12:48:18,251 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:207]
- Service 'shibboleth.AttributeFilterService': Starting shutdown
2016-03-15 12:48:18,251 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:216]
- Service 'shibboleth.AttributeFilterService': Completing shutdown
2016-03-15 12:48:18,252 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:957]
- Closing ApplicationContext:shibboleth.MetadataResolverService: startup
date [Tue Mar 15 11:49:24 GMT 2016]; parent: Root WebApplicationContext
2016-03-15 12:48:18,253 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:207]
- Service 'shibboleth.MetadataResolverService': Starting shutdown
2016-03-15 12:48:18,253 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:216]
- Service 'shibboleth.MetadataResolverService': Completing shutdown
2016-03-15 12:48:18,253 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:957]
- Closing ApplicationContext:shibboleth.AttributeResolverService:
startup date [Tue Mar 15 12:47:54 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:48:18,258 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:207]
- Service 'shibboleth.AttributeResolverService': Starting shutdown
2016-03-15 12:48:18,258 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:216]
- Service 'shibboleth.AttributeResolverService': Completing shutdown
2016-03-15 12:48:18,261 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:957]
- Closing ApplicationContext:shibboleth.NameIdentifierGenerationService:
startup date [Tue Mar 15 11:49:24 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:48:18,263 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:207]
- Service 'shibboleth.NameIdentifierGenerationService': Starting shutdown
2016-03-15 12:48:18,263 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:216]
- Service 'shibboleth.NameIdentifierGenerationService': Completing shutdown
2016-03-15 12:48:18,264 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:957]
- Closing ApplicationContext:shibboleth.RelyingPartyResolverService:
startup date [Tue Mar 15 11:49:24 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:48:18,265 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:207]
- Service 'shibboleth.RelyingPartyResolverService': Starting shutdown
2016-03-15 12:48:18,265 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:216]
- Service 'shibboleth.RelyingPartyResolverService': Completing shutdown
2016-03-15 12:48:18,265 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:957]
- Closing ApplicationContext:shibboleth.ReloadableAccessControlService:
startup date [Tue Mar 15 11:49:24 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:48:18,266 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:207]
- Service 'shibboleth.ReloadableAccessControlService': Starting shutdown
2016-03-15 12:48:18,271 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:216]
- Service 'shibboleth.ReloadableAccessControlService': Completing shutdown
2016-03-15 12:48:18,272 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:957]
- Closing ApplicationContext:shibboleth.ReloadableCASServiceRegistry:
startup date [Tue Mar 15 11:49:24 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:48:18,272 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:207]
- Service 'shibboleth.ReloadableCASServiceRegistry': Starting shutdown
2016-03-15 12:48:18,272 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:216]
- Service 'shibboleth.ReloadableCASServiceRegistry': Completing shutdown
2016-03-15 12:48:18,283 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:207]
- Service 'shibboleth.LoggingService': Starting shutdown
2016-03-15 12:48:18,283 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:216]
- Service 'shibboleth.LoggingService': Completing shutdown
2016-03-15 12:48:27,082 - INFO
[net.shibboleth.idp.log.LogbackLoggingService:240] - Shibboleth IdP
Version 3.2.1
2016-03-15 12:48:27,086 - INFO
[net.shibboleth.idp.log.LogbackLoggingService:241] - Java
version='1.8.0_73' vendor='Oracle Corporation'
2016-03-15 12:48:27,091 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.LoggingService': Reload time set to: 300000,
starting refresh thread
2016-03-15 12:48:27,115 - INFO
[org.opensaml.core.config.InitializationService:48] - Initializing
OpenSAML using the Java Services API
2016-03-15 12:48:27,626 - INFO
[org.opensaml.xmlsec.algorithm.AlgorithmRegistry:206] - Algorithm failed
runtime support check, will not be usable:
http://www.w3.org/2001/04/xmlenc#ripemd160
2016-03-15 12:48:27,630 - INFO
[org.opensaml.xmlsec.algorithm.AlgorithmRegistry:206] - Algorithm failed
runtime support check, will not be usable:
http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160
2016-03-15 12:48:27,639 - INFO
[org.opensaml.xmlsec.algorithm.AlgorithmRegistry:206] - Algorithm failed
runtime support check, will not be usable:
http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160
2016-03-15 12:48:27,965 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.AttributeFilterService': Performing initial load
2016-03-15 12:48:27,966 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.AttributeFilterService': Reloading service
configuration
2016-03-15 12:48:27,970 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/attribute-filter.xml]
2016-03-15 12:48:28,007 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.AttributeFilterService:
startup date [Tue Mar 15 12:48:28 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:48:28,035 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.AttributeFilterService': Completed reload and
swapped in latest configuration for service
'shibboleth.AttributeFilterService'
2016-03-15 12:48:28,036 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.AttributeFilterService': Reload complete
2016-03-15 12:48:28,043 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.AttributeFilterService': Reload time set to:
900000, starting refresh thread
2016-03-15 12:48:28,047 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.AttributeResolverService': Performing initial load
2016-03-15 12:48:28,047 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.AttributeResolverService': Reloading service
configuration
2016-03-15 12:48:28,053 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/attribute-resolver.xml]
2016-03-15 12:48:28,079 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id:
eduPersonPrincipalName
2016-03-15 12:48:28,080 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:48:28,086 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: uid
2016-03-15 12:48:28,087 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:48:28,088 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: mail
2016-03-15 12:48:28,088 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:48:28,088 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: givenName
2016-03-15 12:48:28,089 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:48:28,089 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: surname
2016-03-15 12:48:28,089 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:48:28,095 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for AttributeDefinition plugin with id: commonName
2016-03-15 12:48:28,095 - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-03-15 12:48:28,100 - INFO
[net.shibboleth.idp.attribute.resolver.spring.BaseResolverPluginParser:59]
- Parsing configuration for DataConnector plugin with id: myLDAP
2016-03-15 12:48:28,123 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.AttributeResolverService:
startup date [Tue Mar 15 12:48:28 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:48:28,616 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.AttributeResolverService': Completed reload and
swapped in latest configuration for service
'shibboleth.AttributeResolverService'
2016-03-15 12:48:28,616 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.AttributeResolverService': Reload complete
2016-03-15 12:48:28,616 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.AttributeResolverService': Reload time set to:
900000, starting refresh thread
2016-03-15 12:48:28,622 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.NameIdentifierGenerationService': Performing
initial load
2016-03-15 12:48:28,622 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.NameIdentifierGenerationService': Reloading
service configuration
2016-03-15 12:48:28,627 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/saml-nameid.xml]
2016-03-15 12:48:28,648 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/system/conf/saml-nameid-system.xml]
2016-03-15 12:48:28,658 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing
ApplicationContext:shibboleth.NameIdentifierGenerationService: startup
date [Tue Mar 15 12:48:28 GMT 2016]; parent: Root WebApplicationContext
2016-03-15 12:48:28,720 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.NameIdentifierGenerationService': Completed reload
and swapped in latest configuration for service
'shibboleth.NameIdentifierGenerationService'
2016-03-15 12:48:28,722 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.NameIdentifierGenerationService': Reload complete
2016-03-15 12:48:28,723 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.NameIdentifierGenerationService': Reload time set
to: 900000, starting refresh thread
2016-03-15 12:48:28,727 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.RelyingPartyResolverService': Performing initial load
2016-03-15 12:48:28,728 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.RelyingPartyResolverService': Reloading service
configuration
2016-03-15 12:48:28,736 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/relying-party.xml]
2016-03-15 12:48:28,751 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/credentials.xml]
2016-03-15 12:48:28,761 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/system/conf/relying-party-system.xml]
2016-03-15 12:48:28,779 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.RelyingPartyResolverService:
startup date [Tue Mar 15 12:48:28 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:48:28,947 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.MetadataResolverService': Performing initial load
2016-03-15 12:48:28,947 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.MetadataResolverService': Reloading service
configuration
2016-03-15 12:48:28,948 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/metadata-providers.xml]
2016-03-15 12:48:28,988 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/system/conf/metadata-providers-system.xml]
2016-03-15 12:48:28,997 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.MetadataResolverService:
startup date [Tue Mar 15 12:48:28 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:48:29,071 - INFO
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:465]
- New metadata successfully loaded for
'/opt/shibboleth-idp/metadata/sp-metadata.xml'
2016-03-15 12:48:29,084 - INFO
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:306]
- Next refresh cycle for metadata provider
'/opt/shibboleth-idp/metadata/sp-metadata.xml' will occur on
'2016-03-15T15:48:29.037Z' ('2016-03-15T15:48:29.037Z' local time)
2016-03-15 12:48:29,088 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.MetadataResolverService': Completed reload and
swapped in latest configuration for service
'shibboleth.MetadataResolverService'
2016-03-15 12:48:29,088 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.MetadataResolverService': Reload complete
2016-03-15 12:48:29,162 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.RelyingPartyResolverService': Completed reload and
swapped in latest configuration for service
'shibboleth.RelyingPartyResolverService'
2016-03-15 12:48:29,162 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.RelyingPartyResolverService': Reload complete
2016-03-15 12:48:29,162 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.RelyingPartyResolverService': Reload time set to:
900000, starting refresh thread
2016-03-15 12:48:29,165 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.ReloadableAccessControlService': Performing
initial load
2016-03-15 12:48:29,165 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.ReloadableAccessControlService': Reloading service
configuration
2016-03-15 12:48:29,167 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/access-control.xml]
2016-03-15 12:48:29,182 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/system/conf/access-control-system.xml]
2016-03-15 12:48:29,191 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing
ApplicationContext:shibboleth.ReloadableAccessControlService: startup
date [Tue Mar 15 12:48:29 GMT 2016]; parent: Root WebApplicationContext
2016-03-15 12:48:29,204 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.ReloadableAccessControlService': Completed reload
and swapped in latest configuration for service
'shibboleth.ReloadableAccessControlService'
2016-03-15 12:48:29,204 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.ReloadableAccessControlService': Reload complete
2016-03-15 12:48:29,204 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.ReloadableAccessControlService': Reload time set
to: 300000, starting refresh thread
2016-03-15 12:48:29,208 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:172]
- Service 'shibboleth.ReloadableCASServiceRegistry': Performing initial load
2016-03-15 12:48:29,208 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:258]
- Service 'shibboleth.ReloadableCASServiceRegistry': Reloading service
configuration
2016-03-15 12:48:29,210 - INFO
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317]
- Loading XML bean definitions from file
[/opt/shibboleth-idp/conf/cas-protocol.xml]
2016-03-15 12:48:29,217 - INFO
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:577]
- Refreshing ApplicationContext:shibboleth.ReloadableCASServiceRegistry:
startup date [Tue Mar 15 12:48:29 GMT 2016]; parent: Root
WebApplicationContext
2016-03-15 12:48:29,229 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:378] -
Service 'shibboleth.ReloadableCASServiceRegistry': Completed reload and
swapped in latest configuration for service
'shibboleth.ReloadableCASServiceRegistry'
2016-03-15 12:48:29,229 - INFO
[net.shibboleth.ext.spring.service.ReloadableSpringService:385] -
Service 'shibboleth.ReloadableCASServiceRegistry': Reload complete
2016-03-15 12:48:29,229 - INFO
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:199]
- Service 'shibboleth.ReloadableCASServiceRegistry': Reload time set to:
900000, starting refresh thread
2016-03-15 12:48:29,405 - INFO
[net.shibboleth.ext.spring.context.DelimiterAwareApplicationContext:577]
- Refreshing WebApplicationContext for namespace 'idp-servlet': startup
date [Tue Mar 15 12:48:29 GMT 2016]; parent: Root WebApplicationContext
2016-03-15 12:48:29,886 - INFO
[net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:193] -
RemoteUserAuthServlet will process REMOTE_USER, along with attributes []
and headers []
2016-03-15 12:48:34,785 - ERROR [org.apache.velocity:96] -
ResourceManager : unable to find resource 'status.vm' in any resource
loader.
*2016-03-15 12:50:11,928 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152]
- Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'user1'
failed**
**2016-03-15 12:50:18,282 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152]
- Profile Action ValidateUsernamePasswordAgainstLDAP: Login by
'domain\user1' failed*
idp.properties
# Load any additional property resources from a comma-delimited list
idp.additionalProperties= /conf/ldap.properties,
/conf/saml-nameid.properties, /conf/services.properties
# Set the entityID of the IdP
idp.entityID= https://shibv3-idp.ebi.ac.uk/idp/shibboleth
# Set the scope used in the attribute resolver for scoped attributes
idp.scope= ebi.ac.uk
# Settings for internal AES encryption key
idp.sealer.storeResource= %{idp.home}/credentials/sealer.jks
idp.sealer.versionResource= %{idp.home}/credentials/sealer.kver
idp.sealer.storePassword= xxxxxx
idp.sealer.keyPassword= xxxxxx
# Settings for public/private signing and encryption key(s)
# During decryption key rollover, point the ".2" properties at a second
# keypair, uncomment in credentials.xml, then publish it in your metadata.
idp.signing.key= %{idp.home}/credentials/idp-signing.key
idp.signing.cert= %{idp.home}/credentials/idp-signing.crt
idp.encryption.key= %{idp.home}/credentials/idp-encryption.key
idp.encryption.cert= %{idp.home}/credentials/idp-encryption.crt
# Name of access control policy for various admin flows
idp.status.accessPolicy= AccessByIPAddress
idp.resolvertest.accessPolicy= AccessByIPAddress
idp.reload.accessPolicy= AccessByIPAddress
# Comma-delimited languages to use if not match can be found with the
# browser-supported languages, defaults to an empty list.
idp.ui.fallbackLanguages= en,fr,de
---------
ldap.properties
# LDAP authentication configuration, see authn/ldap-authn-config.xml
# Note, this doesn't apply to the use of JAAS
## Authenticator strategy, either anonSearchAuthenticator,
bindSearchAuthenticator, directAuthenticator, adAuthenticator
idp.authn.LDAP.authenticator = bindSearchAuthenticator
## Connection properties ##
idp.authn.LDAP.ldapURL =
ldaps://xxxx1.ebi.ac.uk:636 \
ldaps://xxxx2.ebi.ac.uk:636
idp.authn.LDAP.useStartTLS = false
idp.authn.LDAP.useSSL = true
## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
idp.authn.LDAP.sslConfig = certificateTrust
## If using certificateTrust above, set to the trusted certificate's path
idp.authn.LDAP.trustCertificates =
%{idp.home}/credentials/ldap-server.crt
idp.authn.LDAP.trustCertificates =
/etc/pki/tls/certs/ca-bundle.crt
## If using keyStoreTrust above, set to the truststore path
idp.authn.LDAP.trustStore =
%{idp.home}/credentials/ldap-server.truststore
## Return attributes during authentication
## NOTE: there is a separate property used for attribute resolution
idp.authn.LDAP.returnAttributes =
passwordExpirationTime,loginGraceRemaining
## DN resolution properties ##
# Search DN resolution, used by anonSearchAuthenticator,
bindSearchAuthenticator
# for AD: CN=Users,DC=example,DC=org
idp.authn.LDAP.baseDN =
ou=people,dc=ebi,dc=ac,dc=uk
idp.authn.LDAP.subtreeSearch = true
idp.authn.LDAP.userFilter =
(&(uid={0})(eduPersonAffiliation=*))
# bind search configuration
# for AD: idp.authn.LDAP.bindDN=adminuser at domain.com
idp.authn.LDAP.bindDN =
uid=xxxxxxxxxx,ou=people,dc=ebi,dc=ac,dc=uk
idp.authn.LDAP.bindDNCredential = xxxxxxxxxxxx
# Format DN resolution, used by directAuthenticator, adAuthenticator
# for AD use idp.authn.LDAP.dnFormat=%s at domain.com
idp.authn.LDAP.dnFormat =
uid=%s,ou=people,dc=example,dc=org
# LDAP attribute configuration, see attribute-resolver.xml
# Note, this likely won't apply to the use of legacy V2 resolver
configurations
idp.attribute.resolver.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL}
idp.attribute.resolver.LDAP.baseDN =
%{idp.authn.LDAP.baseDN:undefined}
idp.attribute.resolver.LDAP.bindDN =
%{idp.authn.LDAP.bindDN:undefined}
idp.attribute.resolver.LDAP.bindDNCredential =
%{idp.authn.LDAP.bindDNCredential:undefined}
idp.attribute.resolver.LDAP.useStartTLS =
%{idp.authn.LDAP.useStartTLS:true}
idp.attribute.resolver.LDAP.trustCertificates =
%{idp.authn.LDAP.trustCertificates:undefined}
idp.attribute.resolver.LDAP.searchFilter =
(uid=$resolutionContext.principal)
idp.attribute.resolver.LDAP.returnAttributes = cn,sn,uid,mail
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160315/78b7c917/attachment-0001.html>
More information about the users
mailing list