A bit lost on how tu trigger username-password validation against LDAP in IDPV4

[Claude Libois]

I did a copy/paste error in my explanation the beans in idp v3.4.3 was
containing the following definition of the
ValidateUsernamePasswordAgainstLDAP

<bean id="ValidateUsernamePasswordAgainstLDAP"
    class="net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP"
scope="prototype"
    p:savePasswordToCredentialSet="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential')
?: false}"
    p:removeContextAfterValidation="#{getObject('shibboleth.authn.Password.RemoveAfterValidation')
?: true}"
    p:authenticator-ref="shibboleth.authn.LDAP.authenticator"
    p:addDefaultPrincipals="#{getObject('shibboleth.authn.Password.addDefaultPrincipals')
?:
        (getObject('shibboleth.authn.Password.PrincipalOverride') == null
            or getObject('shibboleth.authn.Password.PrincipalOverride').isEmpty())}"
    p:supportedPrincipals="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"
    p:classifiedMessages-ref="shibboleth.authn.Password.ClassifiedMessageMap"
    p:resultCachingPredicate="#{getObject('shibboleth.authn.Password.resultCachingPredicate')}"
    p:matchExpression="#{getObject('shibboleth.authn.Password.matchExpression')}"
    p:returnAttributes-ref="shibboleth.authn.LDAP.returnAttributes"
    p:lockoutManager="#{getObject('shibboleth.authn.Password.AccountLockoutManager')}"
/>

so for idpv4 we have changed to the net.shibboleth.idp.authn.impl.
LDAPCredentialValidator
implementation which has a lot less property and doesn't seems to be
triggered by the state

<evaluate expression="ValidateUsernamePassword" />

Regards,
Claude

Le mer. 5 mai 2021 à 09:53, Claude Libois <clibois.work at gmail.com> a écrit :

> Hello,
> We are currently upgrading from idp 3.4.3 to idp 4.0.x
> I our 3.4.x flow we used to trigger username/password against ldap in a
> flow:
>
> <action-state id="ValidateUsernamePassword" parent="authn/conditions#ValidateUsernamePassword">
>     <evaluate expression="ValidateUsernamePassword" />
>     <evaluate expression="'proceed'" />
>
>     <transition on="proceed" to="ContinueSuccessfulAuthentication" />
>
>     <!-- Fall through to a different flow if login fails on a passive or non-browser request. -->
>     <transition on="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" to="ReselectFlow" />
>
>     <!-- Other event transitions are determined by deployer in /flows/authn/conditions/conditions-flow.xml -->
> </action-state>
>
> and the beans was containing
>
> <bean id="ValidateUsernamePasswordAgainstLDAP"
>         class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator" scope="prototype"
>         p:savePasswordToCredentialSet="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') ?: false}"
>         p:removeContextAfterValidation="#{getObject('shibboleth.authn.Password.RemoveAfterValidation') ?: true}"
>         p:authenticator-ref="shibboleth.authn.LDAP.authenticator"
>         p:supportedPrincipals="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"
>         p:matchExpression="#{getObject('shibboleth.authn.Password.matchExpression')}"
>         p:returnAttributes-ref="shibboleth.authn.LDAP.returnAttributes"
>         />
>         <bean id="PopulateSubjectCanonicalizationContext"
>         class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
>         p:availableFlows-ref="shibboleth.PostLoginSubjectCanonicalizationFlows" />
>
> </beans>
>
> The alias ValidateUsernamePassword was defined with the alias
>   <alias name="ValidateUsernamePasswordAgainstLDAP"
> alias="ValidateUsernamePassword" />  in the password-authn-conf.xml
>
> I have noticed there was quite a lot of changes in the way of defining the
> validate user/pwd against LDAP. The class
> ValidateUsernamePasswordAgainstLDAP  no more exist and I have replace it
> with the LDAPCredentialValidator:
>
> <bean id="ValidateUsernamePasswordAgainstLDAP"
>         class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator" scope="prototype"
>         p:savePasswordToCredentialSet="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') ?: false}"
>         p:removeContextAfterValidation="#{getObject('shibboleth.authn.Password.RemoveAfterValidation') ?: true}"
>         p:authenticator-ref="shibboleth.authn.LDAP.authenticator"
>         p:supportedPrincipals="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"
>         p:matchExpression="#{getObject('shibboleth.authn.Password.matchExpression')}"
>         p:returnAttributes-ref="shibboleth.authn.LDAP.returnAttributes"
>         />
>         <bean id="PopulateSubjectCanonicalizationContext"
>         class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" scope="prototype"
>         p:availableFlows-ref="shibboleth.PostLoginSubjectCanonicalizationFlows" />
>
> </beans>
>
>
> However, the doValidate of the  LDAPCredentialValidator is never
> triggered.
> I have read the
> https://wiki.shibboleth.net/confluence/display/IDP4/PasswordAuthnConfiguration
> There is an alternative to the alias  ValidateUsernamePassword.
> I have then updated my  password-authn-config and ldap-authn-config by
> disabling the alias and adding:
> <util:list id="shibboleth.authn.Password.Validators">
> <ref bean="shibboleth.LDAPValidator" />
> </util:list>
>
> However, I don't know how to wire the shibboleth.LDAPValidator with my
> ValidateUsernamePasswordAgainstLDAP.
> Moreover, I don't know how to trigger the doValidate from the
> ValidateUsernamePasswordAgainstLDAP.
>
> Could somebody point me on how to trigger the validation manually or what
> are the "convention" to have the password against LDAP triggered after
> having submit the j_username and j_password ?
> Best Regards,
> Claude
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210505/c8d602eb/attachment.htm>