Credentials not recognized with LDAP

[Quynh Bui]

Thanks, Nate. I did change authentication to Username/password

<ph:LoginHandler xsi:type="ph:UsernamePassword"
                  jaasConfigurationLocation="file:///D:\shibboleth\Shib2Idp/conf/login.config">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod>
    </ph:LoginHandler

Are you able to authenticate using an AD LDAP string?

Quynh

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: Tuesday, March 29, 2016 2:54 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Credentials not recognized with LDAP

Quynh,

My hunch is that you never changed the authentication from the default REMOTE_USER to Username/Password, so that would explain why none of your configuration changes has been doing anything.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn

Hope this helps,
Nate.

On Mar 29, 2016, at 15:15, Quynh Bui <Quynh.Bui at perficient.com<mailto:Quynh.Bui at perficient.com>> wrote:

I’ve checked and the baseDN is correct as is: baseDn="CN=Users,DC=traindomain,DC=com"

When I turn on LDAP debugger I get the following:
15:42:54.059 - WARN [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.ComputedIDDataConnector:65] - This data connector is deprecated.  The StoredID data connector should be used in its place.
15:42:54.168 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
15:42:54.168 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype = simple
15:42:54.168 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn = trnadmin
15:42:54.168 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -   credential = <suppressed>
15:45:36.951 - INFO [Shibboleth-Access:74] - 20160329T204536Z|Training.traindomain.com<http://training.traindomain.com/>|traindomain.com<http://traindomain.com/>:8005|/profile/SAML2/POST/SSO|

edu.vt.middleware.ldap.jaas.LdapLoginModule required
   ldapUrl="ldap://10servername:389"
      bindDn="trnadmin"
      bindCredential="xxxxxx"
      baseDn="CN=Users,DC=traindomain,DC=com"
                 userfilter="sAMAccountName";

It doesn’t seem to recognize or use the baseDN.

Thanks,
Quynh

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160329/d162b0ac/attachment-0001.html>