IDPv3 Attribute Resolver help

[Dave Perry]

I just asked our AD admins for a 'service account' and told them what it was for. Whatever they did worked first time.
I could poke it with LDAP Browser and just remove the actual username/DN + encrypted password field...

Dave

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk *

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Tim Williams
Sent: 09 November 2016 11:22
To: Shib Users
Subject: Re: IDPv3 Attribute Resolver help

On 08/11/16 18:42, Christopher Bongaarts wrote:
> Your search is not returning any matches.  Make sure the user you're 
> binding as (bindDN) has sufficient privileges to find the user with 
> uid=dave_instructor.

Surely that would generate an error telling me that I didn't have permission to do what I was trying to do rather than give an empty response saying "resultCode=SUCCESS"? Or is AD/Shibboleth not that clever?

I'm reliably informed by the AD admin that the bindDN user has privileges for everything. I've now tried logging into the IDP as the bind user, on the assumption that the bind user will be allowed to read it's own data but this failed to retrieve the attributes. I also tried changing the bind user to dave_instructor and then logging in to the IDP as dave_instructor, again, the attributes weren't retrieved.

For reference, so I can be sure that the permissions are right, what would be considered to be the typical permissions for a Shibboleth->AD bind user? Are there any other typical AD settings which could block attribute retrieval? A "How to set up AD for use with Shibboleth" guide would be really handy right now if anybody knows of one.

Thanks again, Tim W

--
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP Registered in the United Kingdom, number: OC317070.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College Group owns the email infrastructure, including the contents.

Hull College Group is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT