users Digest, Vol 75, Issue 26
vaishali prajapati
vbprajapati39 at gmail.com
Tue Sep 12 02:50:03 EDT 2017
Thanks.my error is solved but still i am not able to still login with
valid username and password .it <http://password.it> shows wrong password
for entered for valid user and password.
*idp-process.log* contains :
*[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:166] -
Profile Action ValidateUsernamePasswordAgainstLDAP: Login by '****' failed*
please refer this ldap.properties mainly dnFormat:
idp.authn.LDAP.authenticator = adAuthenticator
## Connection properties ##
idp.authn.LDAP.ldapURL = ldap://172.16.0.2:389
idp.authn.LDAP.useStartTLS = false
idp.authn.LDAP.useSSL = false
# Time in milliseconds that connects will block
idp.authn.LDAP.connectTimeout = PT5M
# Time in milliseconds to wait for responses
#idp.authn.LDAP.responseTimeout = PT5M
## Return attributes during authentication
idp.authn.LDAP.returnAttributes =
passwordExpirationTime,loginGraceRemaining
## DN resolution properties ##
# Search DN resolution, used by anonSearchAuthenticator,
bindSearchAuthenticator
# for AD: CN=Users,OU=Faculty,DC=****,DC=local
idp.authn.LDAP.baseDN = ou=Faculty,dc=***,dc=local
#idp.authn.LDAP.subtreeSearch = false
idp.authn.LDAP.userFilter = (sAMAccountName={user})
# bind search configuration
# for AD: idp.authn.LDAP.bindDN=adminuser at domain.com
idp.authn.LDAP.bindDN = ****@Faculty.***local
idp.authn.LDAP.bindDNCredential = *****
# Format DN resolution, used by directAuthenticator, adAuthenticator
# for AD use idp.authn.LDAP.dnFormat=%s at domain.com
idp.authn.LDAP.dnFormat =%s at Faculty.****.local
On Mon, Sep 11, 2017 at 5:20 PM, <users-request at shibboleth.net> wrote:
> Send users mailing list submissions to
> users at shibboleth.net
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://shibboleth.net/mailman/listinfo/users
> or, via email, send a message with subject or body 'help' to
> users-request at shibboleth.net
>
> You can reach the person managing the list at
> users-owner at shibboleth.net
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of users digest..."
>
>
> Today's Topics:
>
> 1. shibboleth IdP configuration with active directory
> (vaishali prajapati)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 11 Sep 2017 17:20:11 +0530
> From: vaishali prajapati <vbprajapati39 at gmail.com>
> To: users at shibboleth.net
> Subject: shibboleth IdP configuration with active directory
> Message-ID:
> <CAMPeQxGMpQ4tdUe90s4Jk5nkn-7Dm-YR-yZO=irK-iER+YFHCQ at mail.
> gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> ## Authenticator strategy, either anonSearchAuthenticator,
> bindSearchAuthenticator, directAuthenticator, adAuthenticator
> #idp.authn.LDAP.authenticator =bindSearchAuthenticator
>
> ## Connection properties ##
> idp.authn.LDAP.ldapURL = ldap://172.16.0.2:389
> #idp.authn.LDAP.useStartTLS = false
> #idp.authn.LDAP.useSSL = false
> # Time in milliseconds that connects will block
> #idp.authn.LDAP.connectTimeout = TS3M
> # Time in milliseconds to wait for responses
> #idp.authn.LDAP.responseTimeout = TS3M
> ## Return attributes during authentication
> idp.authn.LDAP.returnAttributes = passwordExpirationTime,
> loginGraceRemaining
>
> ## DN resolution properties ##
>
> # Search DN resolution, used by anonSearchAuthenticator,
> bindSearchAuthenticator
> # for AD:DN:Users,OU=***,DC=***,DC=***
> idp.authn.LDAP.baseDN = ou=***,dc=***,dc=***
> #idp.authn.LDAP.subtreeSearch = false
> idp.authn.LDAP.userFilter =(sAMAccountName={uid})
> # bind search configuration
>
> idp.authn.LDAP.bindDN
> =uid=****,ou=***,dc=***,dc=***
> idp.attribute.resolver.LDAP.bindDNCredential =****
> # Format DN resolution, used by directAuthenticator, adAuthenticator
>
> idp.authn.LDAP.dnFormat = ou=***,dc=***,dc=***
> idp.attribute.resolver.LDAP.returnAttributes =
> eduPersonPrincipalName,uid,sAMAccountName
> # LDAP attribute configuration, see attribute-resolver.xml
> # Note, this likely won't apply to the use of legacy V2 resolver
> configurations
> idp.attribute.resolver.LDAP.ldapURL =
> %{idp.authn.LDAP.ldapURL}
> idp.attribute.resolver.LDAP.connectTimeout = %{idp.authn.LDAP.
> connectTimeout:300}
> idp.attribute.resolver.LDAP.responseTimeout = %{idp.authn.LDAP.
> responseTimeout:300}
> idp.attribute.resolver.LDAP.baseDN = %{idp.authn.LDAP.baseDN:
> undefined}
> idp.attribute.resolver.LDAP.bindDN = %{idp.authn.LDAP.bindDN:
> undefined}
> idp.attribute.resolver.LDAP.bindDNCredential = %{idp.authn.LDAP.
> bindDNCredential:undefined}
> idp.attribute.resolver.LDAP.useStartTLS =
> %{idp.authn.LDAP.useStartTLS:true}
> idp.attribute.resolver.LDAP.trustCertificates = %{idp.authn.LDAP.
> trustCertificates:undefined}
> idp.attribute.resolver.LDAP.searchFilter = (uid=$resolutionContext.
> principal)
>
> # LDAP pool configuration, used for both authn and DN resolution
> #idp.pool.LDAP.minSize = 0
> #idp.pool.LDAP.maxSize = 10
> #idp.pool.LDAP.validateOnCheckout = false
> #idp.pool.LDAP.validatePeriodically = true
> #idp.pool.LDAP.validatePeriod = TS5M
> #idp.pool.LDAP.prunePeriod = 600
> #idp.pool.LDAP.idleTime = 600
>
> Attribute-resolver.xml contains:
>
> <?xml version="1.0" encoding="UTF-8"?>
>
> <AttributeResolver
> xmlns="urn:mace:shibboleth:2.0:resolver"
> xmlns:sec="urn:mace:shibboleth:2.0:security"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http:/
> /shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd
> urn:mace:shibboleth:2.0:security
> http://shibboleth.net/schema/idp/shibboleth-security.xsd">
>
>
>
>
>
>
>
> <AttributeDefinition xsi:type="Simple" id="uid" sourceAttributeID="
> sAMAccountName">
> <Dependency ref="myLDAP" />
> <AttributeEncoder xsi:type="SAML1String"
> name="urn:mace:dir:attribute-def:uid" encodeType="false" />
> <AttributeEncoder xsi:type="SAML2String"
> name="urn:oid:0.9.2342.19200300.100.1.1"
> friendlyName="uid" encodeType="false" />
> </AttributeDefinition>
>
> <AttributeDefinition xsi:type="Simple" id="mail"
> sourceAttributeID="mail">
> <Dependency ref="myLDAP" />
> <AttributeEncoder xsi:type="SAML1String"
> name="urn:mace:dir:attribute-def:mail" encodeType="false" />
> <AttributeEncoder xsi:type="SAML2String"
> name="urn:oid:0.9.2342.19200300.100.1.3"
> friendlyName="mail" encodeType="false" />
> </AttributeDefinition>
>
> <AttributeDefinition xsi:type="Simple" id="organizationalUnit"
> sourceAttributeID="ou">
> <Dependency ref="myLDAP" />
> <AttributeEncoder xsi:type="SAML1String"
> name="urn:mace:dir:attribute-def:ou" encodeType="false" />
> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.11"
> friendlyName="ou" encodeType="false" />
> </AttributeDefinition>
>
>
> <AttributeDefinition xsi:type="Simple" id="eduPersonAffiliation"
> sourceAttributeID="eduPersonAffiliation">
> <Dependency ref="myLDAP" />
> <AttributeEncoder xsi:type="SAML1String"
> name="urn:mace:dir:attribute-def:eduPersonAffiliation" encodeType="false"
> />
> <AttributeEncoder xsi:type="SAML2String"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
> friendlyName="eduPersonAffiliation" encodeType="false" />
> </AttributeDefinition>
>
> <AttributeDefinition xsi:type="Simple" id="eduPersonEntitlement"
> sourceAttributeID="eduPersonEntitlement">
> <Dependency ref="myLDAP" />
> <AttributeEncoder xsi:type="SAML1String"
> name="urn:mace:dir:attribute-def:eduPersonEntitlement" encodeType="false"
> />
> <AttributeEncoder xsi:type="SAML2String"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7"
> friendlyName="eduPersonEntitlement" encodeType="false" />
> </AttributeDefinition>
>
> <AttributeDefinition xsi:type="Scoped" id="eduPersonUniqueId"
> scope="%{idp.scope}" sourceAttributeID="localUniqueId">
> <Dependency ref="myLDAP" />
> <AttributeEncoder xsi:type="SAML1ScopedString"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.13" encodeType="false" />
> <AttributeEncoder xsi:type="SAML2ScopedString"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.13" friendlyName="eduPersonUniqueId"
> encodeType="false" />
> </AttributeDefinition>
>
> <AttributeDefinition xsi:type="Prescoped" id="eduPersonPrincipalName"
> sourceAttributeID="eduPersonPrincipalName">
> <Dependency ref="myLDAP" />
> <AttributeEncoder xsi:type="SAML1ScopedString"
> name="urn:mace:dir:attribute-def:eduPersonPrincipalName"
> encodeType="false"
> />
> <AttributeEncoder xsi:type="SAML2ScopedString"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="
> eduPersonPrincipalName"
> encodeType="false" />
> </AttributeDefinition>
>
> <AttributeDefinition xsi:type="Scoped" id="eduPersonScopedAffiliation"
> scope="%{idp.scope}" sourceAttributeID="eduPersonAffiliation">
> <Dependency ref="myLDAP" />
> <AttributeEncoder xsi:type="SAML1ScopedString"
> name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
> encodeType="false" />
> <AttributeEncoder xsi:type="SAML2ScopedString"
> name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
> friendlyName="eduPersonScopedAffiliation"
> encodeType="false" />
> </AttributeDefinition>
>
>
>
> <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
> principal="%{idp.attribute.resolver.LDAP.bindDN}"
> principalCredential="%{idp.attribute.resolver.LDAP.
> bindDNCredential}"
> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:false}"
> connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
> responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}">
> <FilterTemplate>
>
>
> <![CDATA[
> %{idp.attribute.resolver.LDAP.searchFilter}
> ]]>
>
>
> </FilterTemplate>
>
> </DataConnector>
>
>
> </AttributeResolver>
>
> Error generated during login:[net.shibboleth.idp.authn.impl.
> ValidateUsernamePasswordAgainstLDAP:192] - Profile Action
> ValidateUsernamePasswordAgainstLDAP: Login by shibboleth produced
> exception
> org.ldaptive.LdapException: javax.naming.NamingException: [LDAP: error code
> 1 - 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this
> operation a successful bind must be completed on the connection., data 0,
> v1db1^@]; remaining name 'ou=***,dc=***,dc=***'
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <http://shibboleth.net/pipermail/users/attachments/
> 20170911/72101968/attachment.html>
>
> ------------------------------
>
> Subject: Digest Footer
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> ------------------------------
>
> End of users Digest, Vol 75, Issue 26
> *************************************
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170912/b6d00179/attachment-0001.html>
More information about the users
mailing list