IDP3 fails with LDAP bind and space character in the DN/distinguished name

[Paul Engle]

In all those DNs, you have an empty DC component. I think that may be
the real problem. We have a space in our service account DN, and it's
never caused us any problems.

  -paul

On 8/7/2017 8:33 AM, Petursson, Sigurdur wrote:
> The Shibboleth IdP 3 appears to have issues with spaces in the
> distinguished name during an LDAP bind:
> 
> The following fail:
> 
> idp.authn.LDAP.bindDN = CN=IDP Service
> Account,CN=Users,DC=,DC=mydomain,DC=edu
> idp.authn.LDAP.bindDN = CN=IDP\ Service\
> Account,CN=Users,DC=,DC=mydomain,DC=edu
> idp.authn.LDAP.bindDN = "CN=IDP Service
> Account,CN=Users,DC=,DC=mydomain,DC=edu"
> idp.authn.LDAP.bindDN = 'CN=IDP Service
> Account,CN=Users,DC=,DC=mydomain,DC=edu'
> 
> The binding works only after modifying the underlying service account
> (removing spaces):
> 
> idp.authn.LDAP.bindDN =
> CN=IDPServiceAccount,CN=Users,DC=,DC=mydomain,DC=edu
> 
> Note that LDAP bind with space in the DN takes place without issues with
> client tools such as ldapsearch.
> 
> Is there a way to escape the space or might this be a bug?
> 
> 
> 
> 

-- 
Paul Engle
Office of Information Technology
pengle at rice.edu
713-348-4702