Shibboleth with Active Directory rejects all user names

[Tim Williams]

Hi All,

I'm new to this list.

I'm currently attempting to set a Shibboleth test system which will
ultimately be used for development work. Right now, I'm just trying to
get the config right so that I can get the Shibboleth IDPv3 talking to
an Active Directory server to provide the underlying authentication. I'm
not attempting to connect to any existing federations, this will be a
100% independent system.

Shibboleth appears to be communicating with our AD server (which is also
a test system), but whatever I do when trying to login in I get the
message "The username you entered cannot be identified". I've tried
multiple variations of a known valid username but all are rejected.

I've got PHPLDAPAdmin set up on the same server as the IDP and this
reliably authenticates against the AD server, so there is no obvious
communication problem between the IDP host server and AD.

Is there some config problem which would cause this or have I just
misunderstood how the username should be formatted for shibboleth login?
I've tried both the normal AD style "domain\user" which works with
PHPLDAPAdmin and the email style user at domain as well as omitting the
username.

Right now the connection between Shibboleth and AD is using an anonymous
bind, which I gather is not recommended, but it's the only technique I
could get to work. I would prefer to use a bind credential, but despite
extensive websearches I've not found anything to tell me what the bind
credential relates to in the AD config. How would I set this up? If
anybody knows of a step by step guide which describes how to configure
both IDPv3 and AD servers to work together it would be much appreciated,
I've not been able to find one.

For reference, the Shibboleth IDP and PHPLDAPAdmin are both running an a
Linux box.

Thanks in anticipation!

Tim Williams

-- 
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info
Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP
Registered in the United Kingdom, number: OC317070.