Shibboleth with Active Directory rejects all user names

[Craig Pluchinsky]

Not sure if this will help but in the error log it gives the exact ldap 
error code and "sub error code".  Maybe double check the ldap password 
authn docs to make sure you got all the pieces configured.  Also 
at the bottom of the wiki page it tells you how to configure ad errors, 
assuming you set idp.authn.LDAP.authenticator to adAuthenticator

LDAP: error code 49 -
80090308: LdapErr: DSID-0C0903D9, comment: AcceptSecurityContext error,
data 52e, v2580], controls=null] for dn=dave_instructor at streamingltd.com


Using 
https://ldapwiki.com/wiki/Common%20Active%20Directory%20Bind%20Errors that 
error translates to bad password.


-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Mon, 31 Oct 2016, Tim Williams wrote:

> On 31/10/16 13:28, Cantor, Scott wrote:
>
>>
>> You had to have badly corrupted the Spring files for the password flow. It defaults to importing ldap-authn-config by way of password-authn-config and you can't have left that alone if you're getting that error.
>>
>> -- Scott
>>
>
> That's likely to be the case considering the extent to which I've
> fiddled with this to try and work out what was going wrong. The
> instructions here (near the bottom of the page):
>
> https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration
>
> gave the impression that these files needed to be edited to get AD to work.
>
> I've now copied the default ldap-authn-config.xml and
> password-authn-config.xml back into the config directory and this has
> fixed the java exception. I don't think I've edited any other files
> except for ldap.properties.
>
> I'm now getting "The password you entered was incorrect." for all login
> attempts, regardless of whether the username exists or not. I've
> enclosed the idp-process.log entry for a login attempt with a valid user
> in case it's of use helping to track this down.
>
> Thank you again!
>
> Tim W
>
>
>
> 2016-10-31 14:06:05,347 - DEBUG
> [net.shibboleth.idp.authn.AbstractExtractionAction:137] - Profile Action
> ExtractUsernamePasswordFromFormRequest: Trimming whitespace of input
> string 'dave_instructor'
> 2016-10-31 14:06:05,350 - DEBUG
> [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:131]
> - Profile Action ValidateUsernamePasswordAgainstLDAP: Attempting to
> authenticate user dave_instructor
> 2016-10-31 14:06:05,350 - DEBUG [org.ldaptive.auth.FormatDnResolver:157]
> - Formatting DN for dave_instructor with %s at streamingltd.com
> 2016-10-31 14:06:05,350 - DEBUG [org.ldaptive.auth.Authenticator:236] -
> authenticate dn=dave_instructor at streamingltd.com with
> request=[org.ldaptive.auth.AuthenticationRequest at 1619800477::user=dave_instructor,
> retAttrs=[passwordExpirationTime, loginGraceRemaining]]
> 2016-10-31 14:06:05,350 - DEBUG
> [org.ldaptive.auth.PooledBindAuthenticationHandler:67] - authenticate
> criteria=[org.ldaptive.auth.AuthenticationCriteria at 336423920::dn=dave_instructor at streamingltd.com,
> authenticationRequest=[org.ldaptive.auth.AuthenticationRequest at 1619800477::user=dave_instructor,
> retAttrs=[passwordExpirationTime, loginGraceRemaining]]]
> 2016-10-31 14:06:05,351 - DEBUG [org.ldaptive.BindOperation:138] -
> execute
> request=[org.ldaptive.BindRequest at 2099864536::bindDn=dave_instructor at streamingltd.com,
> saslConfig=null, controls=null] with
> connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 1375646308::config=[org.ldaptive.ConnectionConfig at 760894897::ldapUrl=ldap://ad.streamingltd.com:389,
> connectTimeout=3000, responseTimeout=-1,
> sslConfig=[org.ldaptive.ssl.SslConfig at 95415994::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 6161f840,
> trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
> handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
> connectionInitializer=null],
> providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 1679162275::metadata=[ldapUrl=ldap://ad.streamingltd.com:389,
> count=1],
> environment={java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
> com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3},
> providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1597750698::operationExceptionResultCodes=[PROTOCOL_ERROR,
> SERVER_DOWN], properties={},
> connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at 4b2114be,
> controlProcessor=org.ldaptive.provider.ControlProcessor at 68d8ec7a,
> environment=null, tracePackets=null, removeDnUrls=true,
> searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED,
> PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]],
> providerConnection=org.ldaptive.provider.jndi.JndiConnection at 798d735c]
> 2016-10-31 14:06:05,434 - DEBUG
> [org.ldaptive.auth.PooledBindAuthenticationHandler:85] - authenticate
> response=[org.ldaptive.auth.AuthenticationHandlerResponse at 677001754::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 1375646308::config=[org.ldaptive.ConnectionConfig at 760894897::ldapUrl=ldap://ad.streamingltd.com:389,
> connectTimeout=3000, responseTimeout=-1,
> sslConfig=[org.ldaptive.ssl.SslConfig at 95415994::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 6161f840,
> trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
> handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
> connectionInitializer=null],
> providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 1679162275::metadata=[ldapUrl=ldap://ad.streamingltd.com:389,
> count=1],
> environment={java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
> com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3},
> providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1597750698::operationExceptionResultCodes=[PROTOCOL_ERROR,
> SERVER_DOWN], properties={},
> connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at 4b2114be,
> controlProcessor=org.ldaptive.provider.ControlProcessor at 68d8ec7a,
> environment=null, tracePackets=null, removeDnUrls=true,
> searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED,
> PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]],
> providerConnection=org.ldaptive.provider.jndi.JndiConnection at 798d735c],
> result=false, resultCode=INVALID_CREDENTIALS,
> message=javax.naming.AuthenticationException: [LDAP: error code 49 -
> 80090308: LdapErr: DSID-0C0903D9, comment: AcceptSecurityContext error,
> data 52e, v2580], controls=null] for
> criteria=[org.ldaptive.auth.AuthenticationCriteria at 336423920::dn=dave_instructor at streamingltd.com,
> authenticationRequest=[org.ldaptive.auth.AuthenticationRequest at 1619800477::user=dave_instructor,
> retAttrs=[passwordExpirationTime, loginGraceRemaining]]]
> 2016-10-31 14:06:05,436 - INFO [org.ldaptive.auth.Authenticator:259] -
> Authentication failed for dn: dave_instructor at streamingltd.com
> 2016-10-31 14:06:05,436 - DEBUG [org.ldaptive.auth.Authenticator:284] -
> authenticate
> response=[org.ldaptive.auth.AuthenticationHandlerResponse at 677001754::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 1375646308::config=[org.ldaptive.ConnectionConfig at 760894897::ldapUrl=ldap://ad.streamingltd.com:389,
> connectTimeout=3000, responseTimeout=-1,
> sslConfig=[org.ldaptive.ssl.SslConfig at 95415994::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 6161f840,
> trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
> handshakeCompletedListeners=null], useSSL=false, useStartTLS=false,
> connectionInitializer=null],
> providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 1679162275::metadata=[ldapUrl=ldap://ad.streamingltd.com:389,
> count=1],
> environment={java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
> com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3},
> providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1597750698::operationExceptionResultCodes=[PROTOCOL_ERROR,
> SERVER_DOWN], properties={},
> connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at 4b2114be,
> controlProcessor=org.ldaptive.provider.ControlProcessor at 68d8ec7a,
> environment=null, tracePackets=null, removeDnUrls=true,
> searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED,
> PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]],
> providerConnection=org.ldaptive.provider.jndi.JndiConnection at 798d735c],
> result=false, resultCode=INVALID_CREDENTIALS,
> message=javax.naming.AuthenticationException: [LDAP: error code 49 -
> 80090308: LdapErr: DSID-0C0903D9, comment: AcceptSecurityContext error,
> data 52e, v2580], controls=null] for dn=dave_instructor at streamingltd.com
> with
> request=[org.ldaptive.auth.AuthenticationRequest at 1619800477::user=dave_instructor,
> retAttrs=[passwordExpirationTime, loginGraceRemaining]]
> 2016-10-31 14:06:05,440 - INFO
> [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152]
> - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by
> 'dave_instructor' failed
> 2016-10-31 14:06:05,695 - DEBUG
> [net.shibboleth.idp.ui.context.RelyingPartyUIContext:360] - Found
> matching scheme, returning name of 'ssotestmoodle.medialibrary.com'
> 2016-10-31 14:06:05,696 - DEBUG
> [net.shibboleth.idp.ui.context.RelyingPartyUIContext:783] - No UIInfo or
> logos returning null
> 2016-10-31 14:06:05,696 - DEBUG
> [net.shibboleth.idp.ui.context.RelyingPartyUIContext:529] - No
> description matching the languages found, returning null
>
>
> -- 
> Tim Williams BSc MSc MBCS
> AutoTrain
> 58 Jacoby Place
> Priory Road
> Edgbaston
> Birmingham
> B5 7UW
> United Kingdom
>
> Web : http://www.autotrain.org, http://www.utrain.info
> Tel : +44 (0)844 487 4117
>
> AutoTrain is a trading name of EuroMotor-AutoTrain LLP
> Registered in the United Kingdom, number: OC317070.
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>