IDP3 fails with LDAP bind and space character in the DN/distinguished name

[Paul Engle]

Darn, I was hoping it was something simple for you. We are using v 3.3,
and my ldap.properties has:

idp.authn.LDAP.bindDN = cn=shibboleth,ou=Service Accounts,dc=rice,dc=edu

with no escaping at all.

  -paul

On 8/7/2017 12:01 PM, Petursson, Sigurdur wrote:
> Paul:
>   The empty component was me not doing a good sanitizing job. These all
> fail:
> 
> idp.authn.LDAP.bindDN = CN=IDP Service Account,CN=Users,DC=mydomain,DC=edu
> idp.authn.LDAP.bindDN = CN=IDP\ Service\
> Account,CN=Users,DC=mydomain,DC=edu
> idp.authn.LDAP.bindDN = "CN=IDP Service
> Account,CN=Users,DC=mydomain,DC=edu"
> idp.authn.LDAP.bindDN = 'CN=IDP Service
> Account,CN=Users,DC=mydomain,DC=edu'
> idp.authn.LDAP.bindDN = "CN=IDP\ Service\
> Account,CN=Users,DC=mydomain,DC=edu"
> 
> You say it works for you. Are you using IDP3? Do you use quotes or
> escape it in any way?
> 
> Rgds,
>   Sig
> 
> 
> 
> On 8/7/2017 10:12 AM, Paul Engle wrote:
>> In all those DNs, you have an empty DC component. I think that may be
>> the real problem. We have a space in our service account DN, and it's
>> never caused us any problems.
>>
>>    -paul
>>
>> On 8/7/2017 8:33 AM, Petursson, Sigurdur wrote:
>>> The Shibboleth IdP 3 appears to have issues with spaces in the
>>> distinguished name during an LDAP bind:
>>>
>>> The following fail:
>>>
>>> idp.authn.LDAP.bindDN = CN=IDP Service
>>> Account,CN=Users,DC=,DC=mydomain,DC=edu
>>> idp.authn.LDAP.bindDN = CN=IDP\ Service\
>>> Account,CN=Users,DC=,DC=mydomain,DC=edu
>>> idp.authn.LDAP.bindDN = "CN=IDP Service
>>> Account,CN=Users,DC=,DC=mydomain,DC=edu"
>>> idp.authn.LDAP.bindDN = 'CN=IDP Service
>>> Account,CN=Users,DC=,DC=mydomain,DC=edu'
>>>
>>> The binding works only after modifying the underlying service account
>>> (removing spaces):
>>>
>>> idp.authn.LDAP.bindDN =
>>> CN=IDPServiceAccount,CN=Users,DC=,DC=mydomain,DC=edu
>>>
>>> Note that LDAP bind with space in the DN takes place without issues with
>>> client tools such as ldapsearch.
>>>
>>> Is there a way to escape the space or might this be a bug?
>>>
>>>
>>>
>>>
> 

-- 
Paul Engle
Office of Information Technology
pengle at rice.edu
713-348-4702