LDAP uncaught exception

[Peter Schober]

* Losen, Stephen C. (scl) <scl at eservices.virginia.edu> [2016-09-06 13:49]:
> We have some folks (alums) who can still authenticate with our SSO
> solution, but who do not have records in LDAP anymore.  We are
> running shib IDP v3.2.1 and are using RemoteUser to integrate with
> our SSO.  When a person with no LDAP record logs in to SSO, the
> subsequent IDP LDAP lookup fails and we get an "Uncaught exception"
> from the IDP.  Is this expected behavior? Or does it indicate a
> misconfiguration on my part?  It's easy to reproduce with aacli.sh
> if you are using LDAP.  Just enter a principalName that doesn't
> exist in LDAP.

An uncaught exceptions not to be expected, not even if you changed the
default for the LDAP DataConnector parameter 'noResultIsError' from
false to true, which is the only related setting that comes to mind.
(Cf. https://wiki.shibboleth.net/confluence/display/IDP30/LDAPConnector )

> That brings up another issue.  We may need to allow alums to log
> into a few SPs.  I can define a PrincipalName attribute that does
> not depend on LDAP.  However, I did a little experimenting and I
> can't find a way to configure a SP so that the IDP avoids LDAP.  I
> tried configuring the IDP to release nothing but principalName to a
> test SP, but the IDP still did the LDAP lookup, resulting in the
> uncaught exception.

While there's now advanced configuration machinery to avoid
excersizing some data connectors based on the SP, that shouldn't be
needed in your case. Looking up data from LDAP shouldn't cause any
errors even if nothing was returned.

-peter