authn eDirectory LDAP and grace logins

[Glenn Wearen]

Hi Daniel

I removed the password policy control, but the log output is much the 
same. I also added net.shibboleth.idp TRACE logging as the shibb wiki 
suggests but there's no additional logging of the LDAP response. I 
noticed the LDAP provider is org.ldptive.provider.jndi (see log output), 
should this be jldap?

I also don't get an invalid credentials log message when entering an 
incorrect password on an unexpired account,

In idp.properties I have

idp.authn.LDAP.authenticator                    = bindSearchAuthenticator
idp.authn.LDAP.returnAttributes                 = 
cn,passwordExpirationTime,passwordExpirationInterval,loginExpirationTime,loginGraceRemaining,loginDisabled,nspmPasswordPolicyDN 

idp.authn.LDAP.resolveEntryOnFailure            = true

I've attached ldap-authn-config.xml

2017-07-06 09:43:03,101 - TRACE 
[org.ldaptive.pool.BlockingConnectionPool:133] - no activator configured
2017-07-06 09:43:03,102 - DEBUG [org.ldaptive.BindOperation:138] - 
execute 
request=[org.ldaptive.BindRequest at 307203210::bindDn=cn=testexpired,ou=PPtest,o=myuni, 
saslConfig=null, controls=null] with 
connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 2066570975::config=[org.ldaptive.ConnectionConfig at 1170008111::ldapUrl=ldaps://testldaps.myuni.ie:636, 
connectTimeout=3000, responseTimeout=-1, 
sslConfig=[org.ldaptive.ssl.SslConfig at 400695691::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 5a8ff0f, 
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, 
handshakeCompletedListeners=null], useSSL=true, useStartTLS=false, 
connectionInitializer=null], 
providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 613663082::metadata=[ldapUrl=ldaps://testldaps.myuni.ie:636, 
count=1], 
environment={java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, 
com.sun.jndi.ldap.connect.timeout=3000, 
java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, 
java.naming.security.protocol=ssl, java.naming.ldap.version=3}, 
providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1618946280::operationExceptionResultCodes=[PROTOCOL_ERROR, 
SERVER_DOWN], properties={}, 
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at 1bc87547, 
controlProcessor=org.ldaptive.provider.ControlProcessor at 578940a9, 
environment=null, tracePackets=null, removeDnUrls=true, 
searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, 
PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], 
providerConnection=*org.ldaptive.provider.jndi*.JndiConnection at 3c56c8d6]
2017-07-06 09:43:06,111 - DEBUG 
[org.ldaptive.provider.jndi.NamingExceptionUtils:358] - naming exception 
class javax.naming.NamingException is ambiguous, maps to multiple result 
codes: [OPERATIONS_ERROR, ALIAS_PROBLEM, ALIAS_DEREFERENCING_PROBLEM, 
LOOP_DETECT, AFFECTS_MULTIPLE_DSAS, OTHER]
2017-07-06 09:43:06,111 - DEBUG 
[org.ldaptive.provider.jndi.NamingExceptionUtils:396] - could not find 
result code in naming exception LDAP response read timed out, timeout 
used:3000ms.
2017-07-06 09:43:06,112 - TRACE 
[org.ldaptive.pool.BlockingConnectionPool:177] - no passivator configured
2017-07-06 09:43:06,112 - TRACE 
[org.ldaptive.pool.BlockingConnectionPool:275] - waiting on pool lock 
for check in 0
2017-07-06 09:43:06,113 - TRACE 
[org.ldaptive.pool.BlockingConnectionPool:284] - returned active 
connection: 
org.ldaptive.pool.AbstractConnectionPool$DefaultPooledConnectionProxy at 7b2e3ce6
2017-07-06 09:43:06,115 - WARN 
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:175] 
- Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 
pptestExpired produced exception


On 05/07/2017 17:38, Daniel Fisher wrote:
> On Wed, Jul 5, 2017 at 12:00 PM, Glenn Wearen <glenn.wearen at heanet.ie 
> <mailto:glenn.wearen at heanet.ie>> wrote:
>
>     execute
>     request=[org.ldaptive.BindRequest at 584538662::bindDn=cn=pptestglenn,ou=PPtest,o=myuni,
>     saslConfig=null,
>     controls=[[org.ldaptive.control.PasswordPolicyControl at -350057371::criticality=false,
>     timeBeforeExpiration=0, graceAuthNsRemaining=0, error=null]]]
>
>
> You're sending a password policy control, which doesn't jive with the 
> configuration you've posted.
> Double check that you're running the right configuration.
>
> --Daniel Fisher
>
>
>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: ldap-authn-config.xml
Type: text/xml
Size: 8853 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20170706/19ab9d6b/attachment-0001.xml>