Shibboleth with Active Directory rejects all user names

[Dave Perry]

In conf/ldap.properties, here is what we have (production and test IdPs use same details):
idp.authn.LDAP.bindDN                           = yourBindUser at yourdomain.local
idp.authn.LDAP.bindDNCredential                 = yourBindPassword
This assumes your attribute-resolver.xml file is using the variables stored in ldap.properties (I think that's the default).

We are using insecure LDAP, and have both production and test IdPs in the internal network so they can see AD without firewalls in the way (published via ForeFront TMG, alongside many other services of ours).


HTH,
Dave


_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk *
Sent via webmail/mobile - please excuse spelling mistakes or brief messages

________________________________________
From: users [users-bounces at shibboleth.net] on behalf of Tim Williams [tmw at autotrain.org]
Sent: 31 October 2016 12:22
To: users at shibboleth.net
Subject: Re: Shibboleth with Active Directory rejects all user names

On 31/10/16 12:17, Tim Williams wrote:

> Is there some config problem which would cause this or have I just
> misunderstood how the username should be formatted for shibboleth login?
> I've tried both the normal AD style "domain\user" which works with
> PHPLDAPAdmin and the email style user at domain as well as omitting the
> username.

Correction, that should be "omitting the domain".

Tim W

--
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info
Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP
Registered in the United Kingdom, number: OC317070.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College Group owns the email infrastructure, including the contents.

Hull College Group is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT