userPrincipalName as idp.authn.LDAP.dnFormat

[Mr. Christopher Bland]

Hi All,

I have gone through a number of postings regarding LDAP authentication errors and think I understand just need some expert help resolving it.  Our AD environment is migrated from another directory based solution.  As a result we have users with userPrincipalNames like user1 at fdu.edu, user2 at student.fdu.edu, plus others.  Additionally none of these actually match the domain of our AD implementation.  With V2 we put userFilter="userPrincipalName={0}” in our login.config file and (userPrincipalName=$requestContext.principalName) in attribute-resolver.xml. Things worked great.  I am working on a V3 server and am having challenges.

In my ldap.properties I have 

idp.authn.LDAP.authenticator  = adAuthenticator
idp.authn.LDAP.userFilter = (userPrincipalName={user})
idp.attribute.resolver.LDAP.searchFilter = (userPrincipalName=$requestContext.principalName)

Not sure if that is correct since I have seen people use {uid}, {0}, (sAMAccountName=$resolutionContext.principal), plus a few others in their posts. 

I am currently getting the following error:

DEBUG [org.ldaptive.auth.FormatDnResolver:176] - Formatting DN for chris at fdu.edu with undefined

I think this is because I need to properly set idp.authn.LDAP.dnFormat.  All references to idp.authn.LDAP.dnFormat for AD environments say to use idp.authn.LDAP.dnFormat  = %s@<AD_REALM>.  However as I mentioned earlier my users don’t have username at domain I have user at realm.  I have not seen anything that leads me to believe that I can have multiple DN formats.  I have seen that if I have multiple AD sources that I could idp.authn.LDAP.dnFormat.1 and idp.authn.LDAP.dnFormat.2 but does that mean that I have to duplicate all of my settings even though I have a single AD Forest?  I also saw on GitHub I might be able to set idp.authn.LDAP.dnFormat.1 = undefined.  Not sure what this would get me.  

-Chris