need assistance configuring ldap authentication

[vsheliga]

Hello everyone,

In IdP I configured ldap.properties using these settings:

idp.authn.LDAP.authenticator= bindSearchAuthenticator 
idp.authn.LDAP.userFilter= (sAMAccountName={user})
idp.attribute.resolver.LDAP.searchFilter=
(uid=$requestContext.principalName)

in attribute-resolver.xml file:


    
    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldaps://ndmudc2.facultystaff.local"
        baseDN="dc=facultystaff,dc=local"
        principal="cn=username,ou=stf,dc=facultystaff,dc=local"
        principalCredential="*****">
        <dc:FilterTemplate>
            
        </dc:FilterTemplate>
    </resolver:DataConnector>

Our users have been able to authenticate using their samaccountname, and
their attributes have been successfully released to SPs.

Recently we got request from management to switch from using samaccountname
in authentication flow to user’s email address.
I made these two changes in ldap.properties:

idp.authn.LDAP.userFilter= (mail ={user})
idp.attribute.resolver.LDAP.searchFilter=
(mail=$requestContext.principalName)

and attribute-resolver.xml I changed LDAP Connector section to


    
    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldaps://ndmudc2.facultystaff.local"
        baseDN="dc=facultystaff,dc=local"
        principal="cn=username,ou=stf,dc=facultystaff,dc=local"
        principalCredential="****">
        <dc:FilterTemplate>
            
        </dc:FilterTemplate>
    </resolver:DataConnector>


I got this error using email address for authentication:

2017-01-24 17:00:21,870 - WARN
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:175] -
Profile Action ValidateUsernamePasswordAgainstLDAP: Login by
username at ndm.edu produced exception
org.ldaptive.LdapException:
javax.naming.directory.InvalidSearchFilterException: invalid attribute
description; remaining name 'dc=facultystaff,dc=local'
	at
org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)
Caused by: javax.naming.directory.InvalidSearchFilterException: invalid
attribute description
	at com.sun.jndi.ldap.Filter.encodeSimpleFilter(Unknown Source)


Could somebody point me to the right direction? Should I provide the whole
ldap.properties and attribute-resolver.xml?
We use two different UPNs for our AD users: samaccountname at ndm.edu for
fac/staff users and samaccountname at live.ndm.edu for students. Email
addresses are the same as their UPNs for all our users. Our AD domain is not
in public namespace (facultystaff.local).
Thank you so much!

Varvara Sheliga, LAN Manager
Information Technology
Notre Dame of Maryland University




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/need-assistance-configuring-ldap-authentication-tp7630975.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.