IDPv3 Attribute Resolver help

[Michael A Grady]

> On Nov 9, 2016, at 5:21 AM, Tim Williams <tmw at autotrain.org> wrote:
> 
> On 08/11/16 18:42, Christopher Bongaarts wrote:
>> Your search is not returning any matches.  Make sure the user you're
>> binding as (bindDN) has sufficient privileges to find the user with
>> uid=dave_instructor.
> 
> Surely that would generate an error telling me that I didn't have
> permission to do what I was trying to do rather than give an empty
> response saying "resultCode=SUCCESS"? Or is AD/Shibboleth not that clever?
> 
> I'm reliably informed by the AD admin that the bindDN user has
> privileges for everything. I've now tried logging into the IDP as the
> bind user, on the assumption that the bind user will be allowed to read
> it's own data but this failed to retrieve the attributes. I also tried
> changing the bind user to dave_instructor and then logging in to the IDP
> as dave_instructor, again, the attributes weren't retrieved.
> 
> For reference, so I can be sure that the permissions are right, what
> would be considered to be the typical permissions for a Shibboleth->AD
> bind user? Are there any other typical AD settings which could block
> attribute retrieval? A "How to set up AD for use with Shibboleth" guide
> would be really handy right now if anybody knows of one.
> 
> Thanks again, Tim W
> 

You are configuring against Active Directory, correct? Are you sure that it is 'uid' you want to be searching against, or sAMAccountName? And if the latter, you need to be sure to change uid to sAMAccountName for both the Authn search (if using BindAuthn, doesn't matter for the "direct" Ad Authn) and the Resolver search.

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20161109/5fe58b67/attachment.sig>