AD ports 389/636 vs 3268/3269 and LDAP referrals (from Shibb IdP)

[Matthew X. Economou]

David Bantz writes:

> For years I've used the global catalog port 3268 with startTLS to
> connect my IdP to our institutional Active Directory...

That configuration advice is outdated and refers to version 2 of the IdP, which is long dead.  You should be running version 3.3.2 of the IdP by now.  Note the new documentation URL:

https://wiki.shibboleth.net/confluence/display/IDP30/

> They requested I re-configure the IdP for what they describe as
> "normal" LDAP searches (port 389/636).

That's correct.  I have users spread across multiple top-level OUs, and as you discovered the LDAP client library bundled with the IdP has no trouble talking to Active Directory.  For the record we use the bind authenticator and the LDAP directory data connector, configured like this:

https://gist.github.com/xenophonf/5f7b73c8c5b7cb22a488ba0f7832bf1c
https://gist.github.com/xenophonf/1645e22c9dbd7fbfc76d4d8aac6a09f6#file-attribute-resolver-xml-L117

(I happen to have set the example search base to a single top-level OU, but it works with search base being the domain root, e.g., dc=example,dc=net.)

Best wishes,
Matthew

-- 
I FIGHT FOR THE USERS