Shibboleth with Active Directory rejects all user names

[Cantor, Scott]

> I've now copied the default ldap-authn-config.xml and
> password-authn-config.xml back into the config directory and this has
> fixed the java exception. I don't think I've edited any other files
> except for ldap.properties.

Most of the time editing the properties is more than enough to get a basic login working before worrying about pooling and all the other fancy features.

> I'm now getting "The password you entered was incorrect." for all login
> attempts, regardless of whether the username exists or not.

I don't think it comes out of the box with all the AD errors mapped, but if it says the password's incorrect, then the code AD is sending back matches one of the codes defined in the classified errors map for that error condition, it's that simple. If it wasn't, it would dump it out as an unclassified error on the page. I don't know enough about AD or LDAP to know how it's possible to get that result if the entry isn't found. I think you're making life harder by using DEBUG, it's too noisy. It will tell you why it failed regardless. Use DEBUG if you need DEBUG, not just for the fun of it.

-- Scott