IDPv3 Attribute Resolver help

[Tim Williams]

On 08/11/16 14:13, Cantor, Scott wrote:
> On 11/8/16 9:04 AM, Tim Williams wrote:
> 
>> This refuses to start telling me that the certificate file can't be
>> found, even though it shouldn't be used.
> 
> It doesn't matter whether it's used or not, you told it to load it. Stop
> telling it that. Take it out.

Ok, that's a bit confusing (I would have expected the certificate config
to be ignored if TLS was off), but fair enough if it works that way.

>> - Removing the <dc:StartTLSTrustCredential> tag on the grounds that it's
>> not needed. This gave an "Invalid Attribute resolver configuration." error.
> 
> That is not my understanding of how the schema is defined, it shouldn't
> require that element, so you have something else incorrect. Refer to the
> documentation and the error message it's giving you from the XML parser.

Digging into the error logs, I'm also seeing the following error which
might be relevant:

2016-11-08 16:07:47,632 - ERROR
[net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector:143]
- Data Connector 'myLDAP': Invalid connector configuration
net.shibboleth.idp.attribute.resolver.dc.ValidationException:
[org.ldaptive.LdapException at 284823151::resultCode=INVALID_CREDENTIALS,
matchedDn=null, responseControls=null, referralURLs=null, messageId=-1,
message=javax.naming.AuthenticationException: [LDAP: error code 49 -
80090308: LdapErr: DSID-0C0903D9, comment: AcceptSecurityContext error,
data 52e, v2580],
providerException=javax.naming.AuthenticationException: [LDAP: error
code 49 - 80090308: LdapErr: DSID-0C0903D9, comment:
AcceptSecurityContext error, data 52e, v2580]]
        at
net.shibboleth.idp.attribute.resolver.dc.ldap.impl.ConnectionFactoryValidator.validate(ConnectionFactoryValidator.java:97)
Caused by: org.ldaptive.LdapException:
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308:
LdapErr: DSID-0C0903D9, comment: AcceptSecurityContext error, data 52e,
v2580]
        at
org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)
Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 -
80090308: LdapErr: DSID-0C0903D9, comment: AcceptSecurityContext error,
data 52e, v2580]

Error code 49, data 52e seems to mean the following: "The credentials
(username and password) are invalid"

For reference, idp.authn.LDAP.bindDN and
idp.authn.LDAP.bindDNCredential. It looks like I had a mistake in the
username domain specified for the bindDN parameter. What's mystifying me
is that the basic user authentication was working with the incorrect
user domain here, so I had assumed that these parameters were correct.


> If you leave the properties set up to rely on a provided certificate >
for trust, and don't provide one, it fails. If you want ldap:// and
> there is no certificate, set the idp.authn.LDAP.sslConfig property to
> jvmTrust, I think, that should bypass the need to give it anything,
> at least for authentication.

I've set this in my config, I'm not sure what it achieved, but since I'm
now connecting I'm not going to mess with it.

The LDAP connector is not giving any visible error messages now, but I'm
still not seeing any of the parameters which I've configured being
passed through to the service provider, so I'm going to do some
diagnosis on this and post again once I've got a better idea of what's
going wrong.

Thanks again for all your help!

Tim W

-- 
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info
Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP
Registered in the United Kingdom, number: OC317070.