IDP3 fails with LDAP bind and space character in the DN/distinguished name

[Tom Poage]

This form of escaping white space works for us:

idp.authn.LDAP.bindDN = uid=shib,ou=Special\u0020Users,dc=it,dc=ucdavis,dc=edu

Tom.

> On Aug 7, 2017, at 10:41 AM, Paul Engle <pengle at rice.edu> wrote:
> 
> 
> Darn, I was hoping it was something simple for you. We are using v 3.3,
> and my ldap.properties has:
> 
> idp.authn.LDAP.bindDN = cn=shibboleth,ou=Service Accounts,dc=rice,dc=edu
> 
> with no escaping at all.
> 
>  -paul
> 
> On 8/7/2017 12:01 PM, Petursson, Sigurdur wrote:
>> Paul:
>>  The empty component was me not doing a good sanitizing job. These all
>> fail:
>> 
>> idp.authn.LDAP.bindDN = CN=IDP Service Account,CN=Users,DC=mydomain,DC=edu
>> idp.authn.LDAP.bindDN = CN=IDP\ Service\
>> Account,CN=Users,DC=mydomain,DC=edu
>> idp.authn.LDAP.bindDN = "CN=IDP Service
>> Account,CN=Users,DC=mydomain,DC=edu"
>> idp.authn.LDAP.bindDN = 'CN=IDP Service
>> Account,CN=Users,DC=mydomain,DC=edu'
>> idp.authn.LDAP.bindDN = "CN=IDP\ Service\
>> Account,CN=Users,DC=mydomain,DC=edu"
>> 
>> You say it works for you. Are you using IDP3? Do you use quotes or
>> escape it in any way?
>> 
>> Rgds,
>>  Sig
>> 
>> 
>> 
>> On 8/7/2017 10:12 AM, Paul Engle wrote:
>>> In all those DNs, you have an empty DC component. I think that may be
>>> the real problem. We have a space in our service account DN, and it's
>>> never caused us any problems.
>>> 
>>>   -paul
>>> 
>>> On 8/7/2017 8:33 AM, Petursson, Sigurdur wrote:
>>>> The Shibboleth IdP 3 appears to have issues with spaces in the
>>>> distinguished name during an LDAP bind:
>>>> 
>>>> The following fail:
>>>> 
>>>> idp.authn.LDAP.bindDN = CN=IDP Service
>>>> Account,CN=Users,DC=,DC=mydomain,DC=edu
>>>> idp.authn.LDAP.bindDN = CN=IDP\ Service\
>>>> Account,CN=Users,DC=,DC=mydomain,DC=edu
>>>> idp.authn.LDAP.bindDN = "CN=IDP Service
>>>> Account,CN=Users,DC=,DC=mydomain,DC=edu"
>>>> idp.authn.LDAP.bindDN = 'CN=IDP Service
>>>> Account,CN=Users,DC=,DC=mydomain,DC=edu'
>>>> 
>>>> The binding works only after modifying the underlying service account
>>>> (removing spaces):
>>>> 
>>>> idp.authn.LDAP.bindDN =
>>>> CN=IDPServiceAccount,CN=Users,DC=,DC=mydomain,DC=edu
>>>> 
>>>> Note that LDAP bind with space in the DN takes place without issues with
>>>> client tools such as ldapsearch.
>>>> 
>>>> Is there a way to escape the space or might this be a bug?
>>>> 
>>>> 
>>>> 
>>>> 
>> 
> 
> -- 
> Paul Engle
> Office of Information Technology
> pengle at rice.edu
> 713-348-4702
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net