Shibboleth with Active Directory rejects all user names

Tim Williams tmw at autotrain.org
Mon Oct 31 10:11:28 EDT 2016 

On 31/10/16 13:28, Cantor, Scott wrote:

> 
> You had to have badly corrupted the Spring files for the password flow. It defaults to importing ldap-authn-config by way of password-authn-config and you can't have left that alone if you're getting that error.
> 
> -- Scott
> 

That's likely to be the case considering the extent to which I've
fiddled with this to try and work out what was going wrong. The
instructions here (near the bottom of the page):

https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration

gave the impression that these files needed to be edited to get AD to work.

I've now copied the default ldap-authn-config.xml and
password-authn-config.xml back into the config directory and this has
fixed the java exception. I don't think I've edited any other files
except for ldap.properties.

I'm now getting "The password you entered was incorrect." for all login
attempts, regardless of whether the username exists or not. I've
enclosed the idp-process.log entry for a login attempt with a valid user
in case it's of use helping to track this down.

Thank you again!

Tim W



2016-10-31 14:06:05,347 - DEBUG
[net.shibboleth.idp.authn.AbstractExtractionAction:137] - Profile Action
ExtractUsernamePasswordFromFormRequest: Trimming whitespace of input
string 'dave_instructor'
2016-10-31 14:06:05,350 - DEBUG
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:131]
- Profile Action ValidateUsernamePasswordAgainstLDAP: Attempting to
authenticate user dave_instructor
2016-10-31 14:06:05,350 - DEBUG [org.ldaptive.auth.FormatDnResolver:157]
- Formatting DN for dave_instructor with %s at streamingltd.com
2016-10-31 14:06:05,350 - DEBUG [org.ldaptive.auth.Authenticator:236] -
authenticate dn=dave_instructor at streamingltd.com with
request=[org.ldaptive.auth.AuthenticationRequest at 1619800477::user=dave_instructor,
retAttrs=[passwordExpirationTime, loginGraceRemaining]]
2016-10-31 14:06:05,350 - DEBUG
[org.ldaptive.auth.PooledBindAuthenticationHandler:67] - authenticate
criteria=[org.ldaptive.auth.AuthenticationCriteria at 336423920::dn=dave_instructor at streamingltd.com,
authenticationRequest=[org.ldaptive.auth.AuthenticationRequest at 1619800477::user=dave_instructor,
retAttrs=[passwordExpirationTime, loginGraceRemaining]]]
2016-10-31 14:06:05,351 - DEBUG [org.ldaptive.BindOperation:138] -
execute
request=[org.ldaptive.BindRequest at 2099864536::bindDn=dave_instructor at streamingltd.com,
saslConfig=null, controls=null] with
connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 1375646308::config=[org.ldaptive.ConnectionConfig at 760894897::ldapUrl=ldap://ad.streamingltd.com:389,
connectTimeout=3000, responseTimeout=-1,
sslConfig=[org.ldaptive.ssl.SslConfig at 95415994::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 6161f840,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
connectionInitializer=null],
providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 1679162275::metadata=[ldapUrl=ldap://ad.streamingltd.com:389,
count=1],
environment={java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3},
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1597750698::operationExceptionResultCodes=[PROTOCOL_ERROR,
SERVER_DOWN], properties={},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at 4b2114be,
controlProcessor=org.ldaptive.provider.ControlProcessor at 68d8ec7a,
environment=null, tracePackets=null, removeDnUrls=true,
searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED,
PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]],
providerConnection=org.ldaptive.provider.jndi.JndiConnection at 798d735c]
2016-10-31 14:06:05,434 - DEBUG
[org.ldaptive.auth.PooledBindAuthenticationHandler:85] - authenticate
response=[org.ldaptive.auth.AuthenticationHandlerResponse at 677001754::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 1375646308::config=[org.ldaptive.ConnectionConfig at 760894897::ldapUrl=ldap://ad.streamingltd.com:389,
connectTimeout=3000, responseTimeout=-1,
sslConfig=[org.ldaptive.ssl.SslConfig at 95415994::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 6161f840,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
connectionInitializer=null],
providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 1679162275::metadata=[ldapUrl=ldap://ad.streamingltd.com:389,
count=1],
environment={java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3},
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1597750698::operationExceptionResultCodes=[PROTOCOL_ERROR,
SERVER_DOWN], properties={},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at 4b2114be,
controlProcessor=org.ldaptive.provider.ControlProcessor at 68d8ec7a,
environment=null, tracePackets=null, removeDnUrls=true,
searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED,
PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]],
providerConnection=org.ldaptive.provider.jndi.JndiConnection at 798d735c],
result=false, resultCode=INVALID_CREDENTIALS,
message=javax.naming.AuthenticationException: [LDAP: error code 49 -
80090308: LdapErr: DSID-0C0903D9, comment: AcceptSecurityContext error,
data 52e, v2580], controls=null] for
criteria=[org.ldaptive.auth.AuthenticationCriteria at 336423920::dn=dave_instructor at streamingltd.com,
authenticationRequest=[org.ldaptive.auth.AuthenticationRequest at 1619800477::user=dave_instructor,
retAttrs=[passwordExpirationTime, loginGraceRemaining]]]
2016-10-31 14:06:05,436 - INFO [org.ldaptive.auth.Authenticator:259] -
Authentication failed for dn: dave_instructor at streamingltd.com
2016-10-31 14:06:05,436 - DEBUG [org.ldaptive.auth.Authenticator:284] -
authenticate
response=[org.ldaptive.auth.AuthenticationHandlerResponse at 677001754::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 1375646308::config=[org.ldaptive.ConnectionConfig at 760894897::ldapUrl=ldap://ad.streamingltd.com:389,
connectTimeout=3000, responseTimeout=-1,
sslConfig=[org.ldaptive.ssl.SslConfig at 95415994::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 6161f840,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
connectionInitializer=null],
providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 1679162275::metadata=[ldapUrl=ldap://ad.streamingltd.com:389,
count=1],
environment={java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3},
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1597750698::operationExceptionResultCodes=[PROTOCOL_ERROR,
SERVER_DOWN], properties={},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at 4b2114be,
controlProcessor=org.ldaptive.provider.ControlProcessor at 68d8ec7a,
environment=null, tracePackets=null, removeDnUrls=true,
searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED,
PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]],
providerConnection=org.ldaptive.provider.jndi.JndiConnection at 798d735c],
result=false, resultCode=INVALID_CREDENTIALS,
message=javax.naming.AuthenticationException: [LDAP: error code 49 -
80090308: LdapErr: DSID-0C0903D9, comment: AcceptSecurityContext error,
data 52e, v2580], controls=null] for dn=dave_instructor at streamingltd.com
with
request=[org.ldaptive.auth.AuthenticationRequest at 1619800477::user=dave_instructor,
retAttrs=[passwordExpirationTime, loginGraceRemaining]]
2016-10-31 14:06:05,440 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152]
- Profile Action ValidateUsernamePasswordAgainstLDAP: Login by
'dave_instructor' failed
2016-10-31 14:06:05,695 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:360] - Found
matching scheme, returning name of 'ssotestmoodle.medialibrary.com'
2016-10-31 14:06:05,696 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:783] - No UIInfo or
logos returning null
2016-10-31 14:06:05,696 - DEBUG
[net.shibboleth.idp.ui.context.RelyingPartyUIContext:529] - No
description matching the languages found, returning null


-- 
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info
Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP
Registered in the United Kingdom, number: OC317070.

More information about the users mailing list