IDPv3 Attribute Resolver help

[Tim Williams]

On 08/11/16 18:42, Christopher Bongaarts wrote:
> Your search is not returning any matches.  Make sure the user you're
> binding as (bindDN) has sufficient privileges to find the user with
> uid=dave_instructor.

Surely that would generate an error telling me that I didn't have
permission to do what I was trying to do rather than give an empty
response saying "resultCode=SUCCESS"? Or is AD/Shibboleth not that clever?

I'm reliably informed by the AD admin that the bindDN user has
privileges for everything. I've now tried logging into the IDP as the
bind user, on the assumption that the bind user will be allowed to read
it's own data but this failed to retrieve the attributes. I also tried
changing the bind user to dave_instructor and then logging in to the IDP
as dave_instructor, again, the attributes weren't retrieved.

For reference, so I can be sure that the permissions are right, what
would be considered to be the typical permissions for a Shibboleth->AD
bind user? Are there any other typical AD settings which could block
attribute retrieval? A "How to set up AD for use with Shibboleth" guide
would be really handy right now if anybody knows of one.

Thanks again, Tim W

-- 
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info
Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP
Registered in the United Kingdom, number: OC317070.