InvalidSearchFilterException: Missing 'equals' -- Problems connecting IdPv3 to LDAP

[Joachim]

Having the same problem here with ActiveDirectory 2012R2 and
bindSearchAuthenticator.
Direct/AD-Authenticator (sAMAccountName) is working fine but we like to
authenticate with mail-Attribute (which is not the same Domain as in UPN).
So we need Attribute lookup from Loginfields before Auth.

Error is:
Login Failure: javax.naming.directory.InvalidSearchFilterException: Missing
'equals'; remaining name 'DC=cchh,DC=local'

idp.authn.LDAP.authenticator                   = bindSearchAuthenticator
idp.authn.LDAP.ldapURL                          =
ldap://dc-1.cchh.local:3268
idp.authn.LDAP.useStartTLS                     = true
idp.authn.LDAP.useSSL                          = false
idp.authn.LDAP.sslConfig                       = certificateTrust
idp.authn.LDAP.trustCertificates                =
%{idp.home}/credentials/ldap-server.crt
idp.authn.LDAP.trustStore                       =
%{idp.home}/credentials/ldap-server.truststore
idp.authn.LDAP.returnAttributes                 = mail,sAMAccountName,cn

# Search DN resolution, used by anonSearchAuthenticator,
bindSearchAuthenticator
# for AD: CN=Users,DC=example,DC=org
idp.authn.LDAP.baseDN                           = DC=cchh,DC=local
idp.authn.LDAP.subtreeSearch                    = true
idp.authn.LDAP.userFilter                       = (sAMAccountName={user})

idp.authn.LDAP.bindDN                           =
CN=AdminUser,CN=Users,DC=cchh,DC=local
idp.authn.LDAP.bindDNCredential                 = #password#

# LDAP attribute configuration, see attribute-resolver.xml
# Note, this likely won't apply to the use of legacy V2 resolver
configurations
idp.attribute.resolver.LDAP.ldapURL             = %{idp.authn.LDAP.ldapURL}
idp.attribute.resolver.LDAP.connectTimeout      =
%{idp.authn.LDAP.connectTimeout:PT3S}
idp.attribute.resolver.LDAP.responseTimeout     =
%{idp.authn.LDAP.responseTimeout:PT3S}
idp.attribute.resolver.LDAP.baseDN              =
%{idp.authn.LDAP.baseDN:undefined}
idp.attribute.resolver.LDAP.bindDN              =
%{idp.authn.LDAP.bindDN:undefined}
idp.attribute.resolver.LDAP.bindDNCredential    =
%{idp.authn.LDAP.bindDNCredential:undefined}
idp.attribute.resolver.LDAP.useStartTLS         =
%{idp.authn.LDAP.useStartTLS:true}
idp.attribute.resolver.LDAP.trustCertificates   =
%{idp.authn.LDAP.trustCertificates:undefined}
#idp.attribute.resolver.LDAP.searchFilter        =
(sAMAccountName=$resolutionContext.principal)
#idp.attribute.resolver.LDAP.searchFilter        =
(employeeID=$resolutionContext.principal)
idp.attribute.resolver.LDAP.searchFilter        =
(uid=$resolutionContext.principal)


LOG:
2017-07-10 14:41:06,523 - DEBUG [org.ldaptive.SearchOperation:138] - execute
request=[org.ldaptive.SearchRequest at 17798364::baseDn=DC=cchh,DC=local,
***searchFilter=[org.ldaptive.SearchFilter at -207773372::filter=undefined***,
parameters={user=myUserName}], returnAttributes=[1.1], searchScope=SUBTREE,
timeLimit=0, sizeLimit=0, derefAliases=null, typesOnly=false,
binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null,
searchReferenceHandlers=null, controls=null, followReferrals=false,
intermediateResponseHandlers=null] with
connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 454555535::config=[org.ldaptive.ConnectionConfig at 1730761250::ldapUrl=ldap://dc-1.cchh.local:3268,
connectTimeout=3000, responseTimeout=3000, ......


Any Idea what's wrong?



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/InvalidSearchFilterException-Missing-equals-Problems-connecting-IdPv3-to-LDAP-tp7622732p7634258.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.