IdP v3.4.4 change user for attribute search

[Kai Zimmer]

Hi,

i'm about to setup a Shibboleth IdP v3.4.4 connecting to a single local 
ldap server.

My problem is that attribute queries are executed under the login users 
account (here: zimmer) instead of the designated user (ldap read only) 
in the idp.authn.LDAP.bindDN variable (here: shibidp).

As the user account 'zimmer' does not have sufficient rights, it is not 
allowed to search in the ldap. Both accounts can successfully login to 
the ldap, though.

So where and how can i change the user for attribute queries (or why 
isn't the account shibidp used for it)?


<-------------------------------start ldap.properties 
---------------------------->

idp.authn.LDAP.authenticator                   = bindSearchAuthenticator

idp.authn.LDAP.ldapURL                         = 
ldap://somewhere.bbaw.de:389
idp.authn.LDAP.useStartTLS                     = false
idp.authn.LDAP.useSSL                          = false

idp.authn.LDAP.sslConfig                       = jvmTrust

idp.authn.LDAP.trustCertificates                = 
/etc/ssl/certs/T-TeleSec_GlobalRoot_Class_2.pem

idp.authn.LDAP.trustStore                       = 
%{idp.home}/credentials/ldap-server.truststore

idp.authn.LDAP.returnAttributes                  = mail,uid

idp.authn.LDAP.baseDN                           = ou=extra,dc=bbaw,dc=de
idp.authn.LDAP.subtreeSearch                    = false
idp.authn.LDAP.userFilter                       = (uid={user})

idp.authn.LDAP.bindDN                           = 
uid=shibidp,ou=tech,dc=bbaw,dc=de
idp.authn.LDAP.bindDNCredential                 = secret

idp.attribute.resolver.LDAP.ldapURL             = %{idp.authn.LDAP.ldapURL}
idp.attribute.resolver.LDAP.connectTimeout      = 
%{idp.authn.LDAP.connectTimeout:PT3S}
idp.attribute.resolver.LDAP.responseTimeout     = 
%{idp.authn.LDAP.responseTimeout:PT3S}
idp.attribute.resolver.LDAP.baseDN              = 
%{idp.authn.LDAP.baseDN:undefined}
idp.attribute.resolver.LDAP.bindDN              = 
%{idp.authn.LDAP.bindDN:undefined}
idp.attribute.resolver.LDAP.bindDNCredential    = 
%{idp.authn.LDAP.bindDNCredential:undefined}
idp.attribute.resolver.LDAP.useStartTLS         = 
%{idp.authn.LDAP.useStartTLS:false}
idp.attribute.resolver.LDAP.trustCertificates   = 
%{idp.authn.LDAP.trustCertificates:undefined}
idp.attribute.resolver.LDAP.searchFilter        = 
(uid=$resolutionContext.principal)

<-----------------------------------end 
ldap.properties----------------------------------------------->


<----------------------------------start 
idp-process.log---------------------------------------------->

2019-08-08 11:12:09,103 - DEBUG [org.ldaptive.auth.Authenticator:469] - 
IP:194.95.188.5 - entry resolution failed for 
resolver=[org.ldaptive.auth.SearchEntryResolver at 603993194::factory=null, 
baseDn=, userFilter=null, userFilterParameters=null, 
allowMultipleEntries=false, subtreeSearch=false, derefAliases=null, 
followReferrals=false, searchEntryHandlers=null]
org.ldaptive.LdapException: javax.naming.NameNotFoundException: [LDAP: 
error code 32 - No Such Object]; remaining name 
'uid=zimmer,ou=extra,dc=bbaw,dc=de'
     at 
org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)
Caused by: javax.naming.NameNotFoundException: [LDAP: error code 32 - No 
Such Object]
     at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3179)

<----------------------------------------end 
idp-process.log---------------------------------------------->


<------------------------------start ldap logfile----------------------->

Aug  8 11:12:09 ldap slapd[22766]: conn=1012 op=1 SRCH base="uid=zimmer,ou=extra,dc=bbaw,dc=de" scope=0 deref=0 filter="(objectClass=*)"
Aug  8 11:12:09 ldap slapd[22766]: conn=1012 op=1 SRCH attr=email uid givenName sn o cn
Aug  8 11:12:09 ldap slapd[22766]: ==> limits_get: conn=1012 op=1 self="uid=zimmer,ou=extra,dc=bbaw,dc=de" this="uid=zimmer,ou=extra,dc=bbaw,dc=de"
Aug  8 11:12:09 ldap slapd[22766]: => mdb_search
Aug  8 11:12:09 ldap slapd[22766]: mdb_dn2entry("uid=zimmer,ou=extra,dc=bbaw,dc=de")
Aug  8 11:12:09 ldap slapd[22766]: => mdb_dn2id("uid=zimmer,ou=extra,dc=bbaw,dc=de")
Aug  8 11:12:09 ldap slapd[22766]: <= mdb_dn2id: got id=0x135
Aug  8 11:12:09 ldap slapd[22766]: => mdb_entry_decode:
Aug  8 11:12:09 ldap slapd[22766]: <= mdb_entry_decode
Aug  8 11:12:09 ldap slapd[22766]: => access_allowed: search access to "uid=zimmer,ou=extra,dc=bbaw,dc=de" "entry" requested
Aug  8 11:12:09 ldap slapd[22766]: => dn: [2]
Aug  8 11:12:09 ldap slapd[22766]: => acl_get: [3] attr entry
Aug  8 11:12:09 ldap slapd[22766]: => acl_mask: access to entry "uid=zimmer,ou=extra,dc=bbaw,dc=de", attr "entry" requested
Aug  8 11:12:09 ldap slapd[22766]: => acl_mask: to all values by "uid=zimmer,ou=extra,dc=bbaw,dc=de", (=0)
Aug  8 11:12:09 ldap slapd[22766]: <= check a_dn_pat: uid=jaecontrol,ou=tech,dc=bbaw,dc=de
Aug  8 11:12:09 ldap slapd[22766]: <= check a_dn_pat: uid=shibidp,ou=tech,dc=bbaw,dc=de
Aug  8 11:12:09 ldap slapd[22766]: <= acl_mask: no more <who> clauses, returning =0 (stop)
Aug  8 11:12:09 ldap slapd[22766]: => slap_access_allowed:*search access denied*  by =0

<----------------------------end ldap logfile ------------------------------->


Best regards,

Kai

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190808/2ab52da8/attachment.html>