ldap authenticator problems

Wed Apr 21 19:51:13 UTC 2021

That file is inside idp-conf-impl-4.1.0.jar

Regards

-----Mensaje original-----
De: users <users-bounces at shibboleth.net> En nombre de Rene Paquin
Enviado el: miércoles, 21 de abril de 2021 21:40
Para: Shib Users <users at shibboleth.net>
Asunto: RE: ldap authenticator problems

In the error message it refers to a file " defined in class path resource [net/shibboleth/idp/flows/authn/password-authn-beans.xml]"  yet I cannot find that file anywhere.  

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Rene Paquin
Sent: April 21, 2021 3:09 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: ldap authenticator problems

This is confusing.  I created an IDP instance based on v4.01 with what is in essence the same configuration as 4.1 in terms of ldap connector etc and it works but when I switch to v 4.1 I get those ldap authentication errors.  

Rene

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Rene Paquin
Sent: April 21, 2021 11:28 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: ldap authenticator problems

I have that set to bindSearchAuthenticator  and I have all the ldap properties setup.  

## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator
idp.authn.LDAP.authenticator                   = bindSearchAuthenticator

## Connection properties ##
idp.authn.LDAP.ldapURL                          = ldaps://xxxxxxxxxxxxxxx.xxx
idp.authn.LDAP.useStartTLS                     = true
# Time in milliseconds that connects will block
idp.authn.LDAP.connectTimeout                  = PT3S
# Time in milliseconds to wait for responses
idp.authn.LDAP.responseTimeout                 = PT3S
# Connection strategy to use when multiple URLs are supplied, either ACTIVE_PASSIVE, ROUND_ROBIN, RANDOM
#idp.authn.LDAP.connectionStrategy               = ACTIVE_PASSIVE

## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
idp.authn.LDAP.sslConfig                       = certificateTrust
## If using certificateTrust above, set to the trusted certificate's path
idp.authn.LDAP.trustCertificates                = %{idp.home}/credentials/ldap-server.crt

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: April 21, 2021 11:23 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: ldap authenticator problems

The easiest way I managed to reproduce what I think is that exact error is by uncommenting but also clearing out the idp.authn.LDAP.authenticator property in ldap.properties

That's nothing I would expect anybody to accidentally do, but that does create the exception.

We can patch the NPE regardless so it's not just crashing that way, but the code has to have one of those authenticator "types" to wire things up with default behavior so it's got to be something, or left undefined so it defaults.

-- Scott

-- 
For Consortium Member technical support, see https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fcan01.safelinks.protection.outlook.com%2f%3furl%3dhttps%253A%252F%252Fwiki.shibboleth.net%252Fconfluence%252Fx%252FcoFAAg%26amp%3bdata%3d04%257C01%257Crpaquin%2540wlu.ca%257Cc1d4a4f3ea194f6cdb2d08d904f8f4a9%257Cb45a5125b29846bc8b89ea5a7343fde8%257C1%257C0%257C637546289569726091%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C1000%26amp%3bsdata%3d1JZVa9owWvDzhM4f4Aaagj3nghMyvjKwPF2bdBSQZ8I%253D%26amp%3breserved%3d0&umid=b77f1525-c93f-418a-9d23-4a3b43342d81&auth=1c980b950b810d2ebe959a136e6fc6796ec23183-b5491a6dc28f17b12eb36316c1829e0214555ce9
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-- 
For Consortium Member technical support, see https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fcan01.safelinks.protection.outlook.com%2f%3furl%3dhttps%253A%252F%252Fwiki.shibboleth.net%252Fconfluence%252Fx%252FcoFAAg%26amp%3bdata%3d04%257C01%257Crpaquin%2540wlu.ca%257Cc1d4a4f3ea194f6cdb2d08d904f8f4a9%257Cb45a5125b29846bc8b89ea5a7343fde8%257C1%257C0%257C637546289569726091%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C1000%26amp%3bsdata%3d1JZVa9owWvDzhM4f4Aaagj3nghMyvjKwPF2bdBSQZ8I%253D%26amp%3breserved%3d0&umid=b77f1525-c93f-418a-9d23-4a3b43342d81&auth=1c980b950b810d2ebe959a136e6fc6796ec23183-b5491a6dc28f17b12eb36316c1829e0214555ce9
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-- 
For Consortium Member technical support, see https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fcan01.safelinks.protection.outlook.com%2f%3furl%3dhttps%253A%252F%252Fwiki.shibboleth.net%252Fconfluence%252Fx%252FcoFAAg%26amp%3bdata%3d04%257C01%257Crpaquin%2540wlu.ca%257Cc1d4a4f3ea194f6cdb2d08d904f8f4a9%257Cb45a5125b29846bc8b89ea5a7343fde8%257C1%257C0%257C637546289569726091%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C1000%26amp%3bsdata%3d1JZVa9owWvDzhM4f4Aaagj3nghMyvjKwPF2bdBSQZ8I%253D%26amp%3breserved%3d0&umid=b77f1525-c93f-418a-9d23-4a3b43342d81&auth=1c980b950b810d2ebe959a136e6fc6796ec23183-b5491a6dc28f17b12eb36316c1829e0214555ce9
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-- 
For Consortium Member technical support, see https://ddec1-0-en-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fwiki.shibboleth.net%2fconfluence%2fx%2fcoFAAg&umid=b77f1525-c93f-418a-9d23-4a3b43342d81&auth=1c980b950b810d2ebe959a136e6fc6796ec23183-56488ab42604b4f5835461428b2e2cf43e8aa089
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net