Credentials not recognized with LDAP

[IAM David Bantz]

Since AD allows a lot flexibility in building the directory structure, your
config needs to reflect local configuration. It's probably easier to check
permutations using command-line ldap or an ldap browser like Apache
Directory Studio. As a pure guess, might you want the baseDN to be
OU=Users... rather than CN=Users...assuming your Shibboleth service account
is in Users and some other fork...

BTW, I hope you plan to turn on tls or ssl before production.

David Bantz

On Tue, Mar 29, 2016 at 10:34 AM, Quynh Bui <Quynh.Bui at perficient.com>
wrote:

> I am working with Shib 2.3.8. After setup is complete, when at final
> testing step (login screen) I get the Credentials not recognized error. I
> understand this issue had been reported previously, but there doesn't seem
> to be a definitive answer to resolve it. The LDAP string in login.config is:
>
>
>
>     edu.vt.middleware.ldap.jaas.LdapLoginModule required
>
>        ldapUrl="ldap://servername:389"
>
>           bindDn="cn=trnadmin"
>
>           bindCredential="xxxxxxx"
>
>           baseDn="CN=Users,DC=traindomain,DC=com"
>
>                   tls="false"
>
>                   ssl="false"
>
>           userFilter="samAccountName";
>
>
>
>     I've tried different input of attributes which make no difference in
> outcome. Is there an example of what attributes work for login.config with
> AD LDAP? Using similar attributes to above I was able to deploy the Shib
> web app to IdP weblogic domain so It seems odd that login authentication
> doesn't work.
>
>
>
>
>
> Regards,
>
>
>
> *Quynh Bui*
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160329/85d76944/attachment.html>