connect shibboleth idp 3.4 with G Suite
Aisha Al Fudhaili
aisha at omren.om
Tue Jul 19 06:54:20 UTC 2022
Hi,
Im try to connect windows shibboleth idp 3.4 with G Suite<https://workspace.google.com/business/>, but I get errors.
Ldap.properties
# LDAP authentication configuration, see authn/ldap-authn-config.xml
# Note, this doesn't apply to the use of JAAS
## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator
idp.authn.LDAP.authenticator = bindSearchAuthenticator
## Connection properties ##
idp.authn.LDAP.ldapURL = ldap://ldap.google.com:636
idp.authn.LDAP.useStartTLS = true
idp.authn.LDAP.useSSL = true
# Time in milliseconds that connects will block
#idp.authn.LDAP.connectTimeout = PT3S
# Time in milliseconds to wait for responses
#idp.authn.LDAP.responseTimeout = PT3S
## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
idp.authn.LDAP.sslConfig = certificateTrust
## If using certificateTrust above, set to the trusted certificate's path
idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-client.crt
## If using keyStoreTrust above, set to the truststore path
#idp.authn.LDAP.trustStore = %{idp.home}/credentials/ldap-server.truststore
## Return attributes during authentication
idp.authn.LDAP.returnAttributes = passwordExpirationTime
## DN resolution properties ##
# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator
# for AD: CN=Users,DC=example,DC=org
#idp.authn.LDAP.baseDN = ou=people,dc=example,dc=org
idp.authn.LDAP.baseDN = dc=cas,dc=edu,dc=om
#idp.authn.LDAP.subtreeSearch = false
idp.authn.LDAP.userFilter = (uid={user})
# bind search configuration
# for AD: idp.authn.LDAP.bindDN=adminuser at domain.com<mailto:idp.authn.LDAP.bindDN=adminuser at domain.com>
idp.authn.LDAP.bindDN = uid=Myusername,ou=Users
idp.authn.LDAP.bindDNCredential = mypassword
# Format DN resolution, used by directAuthenticator, adAuthenticator
# for AD use idp.authn.LDAP.dnFormat=%s at domain.com<mailto:idp.authn.LDAP.dnFormat=%25s at domain.com>
#idp.authn.LDAP.dnFormat = ou=Users,dc=cas,dc=edu,dc=om
# LDAP attribute configuration, see attribute-resolver.xml
# Note, this likely won't apply to the use of legacy V2 resolver configurations
#idp.attribute.resolver.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL}
#idp.attribute.resolver.LDAP.connectTimeout = %{idp.authn.LDAP.connectTimeout:PT3S}
#idp.attribute.resolver.LDAP.responseTimeout = %{idp.authn.LDAP.responseTimeout:PT3S}
#idp.attribute.resolver.LDAP.baseDN = %{idp.authn.LDAP.baseDN:undefined}
#idp.attribute.resolver.LDAP.bindDN = %{idp.authn.LDAP.bindDN:undefined}
#idp.attribute.resolver.LDAP.bindDNCredential = %{idp.authn.LDAP.bindDNCredential:undefined}
#idp.attribute.resolver.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true}
#idp.attribute.resolver.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates:undefined}
#idp.attribute.resolver.LDAP.searchFilter = (uid=$resolutionContext.principal)
# LDAP pool configuration, used for both authn and DN resolution
#idp.pool.LDAP.minSize = 3
#idp.pool.LDAP.maxSize = 10
#idp.pool.LDAP.validateOnCheckout = false
#idp.pool.LDAP.validatePeriodically = true
#idp.pool.LDAP.validatePeriod = PT5M
#idp.pool.LDAP.prunePeriod = PT5M
#idp.pool.LDAP.idleTime = PT10M
#idp.pool.LDAP.blockWaitTime = PT3S
#idp.pool.LDAP.failFastInitialize = false
Logs
2022-07-19 10:46:37,967 - 185.186.207.49 - ERROR [org.springframework.webflow.execution.ActionExecutionException:76] -
org.springframework.webflow.execution.ActionExecutionException: Exception thrown executing [AnnotatedAction at 6b982776 targetAction = [EvaluateAction at 3a1bfb02 expression = ValidateUsernamePassword, resultExpression = [null]], attributes = map[[empty]]] in state 'ValidateUsernamePassword' of flow 'authn/Password' -- action execution attributes were 'map[[empty]]'
at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:62)
Caused by: org.springframework.binding.expression.EvaluationException: An ELException occurred getting the value for expression 'ValidateUsernamePassword' on context [class org.springframework.webflow.engine.impl.RequestControlContextImpl]
at org.springframework.binding.expression.spel.SpringELExpression.getValue(SpringELExpression.java:94)
Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1021E: A problem occurred whilst attempting to access the property 'ValidateUsernamePassword': 'Error creating bean with name 'ValidateUsernamePasswordAgainstLDAP' defined in file [C:\Program Files (x86)\Shibboleth\IdP\system\flows\authn\password-authn-beans.xml]: Cannot resolve reference to bean 'shibboleth.authn.LDAP.authenticator' while setting bean property 'authenticator'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchAuthenticator' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchDnResolver' while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchDnResolver' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchPooledConnectionFactory' while setting bean property 'connectionFactory'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchPooledConnectionFactory' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchConnectionPool' while setting bean property 'connectionPool'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchConnectionPool' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-client.crt] cannot be resolved to absolute file path - web application archive not expanded?'
at org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:221)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ValidateUsernamePasswordAgainstLDAP' defined in file [C:\Program Files (x86)\Shibboleth\IdP\system\flows\authn\password-authn-beans.xml]: Cannot resolve reference to bean 'shibboleth.authn.LDAP.authenticator' while setting bean property 'authenticator'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchAuthenticator' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchDnResolver' while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchDnResolver' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchPooledConnectionFactory' while setting bean property 'connectionFactory'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchPooledConnectionFactory' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchConnectionPool' while setting bean property 'connectionPool'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchConnectionPool' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-client.crt] cannot be resolved to absolute file path - web application archive not expanded?
at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:359)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchAuthenticator' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchDnResolver' while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchDnResolver' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchPooledConnectionFactory' while setting bean property 'connectionFactory'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchPooledConnectionFactory' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchConnectionPool' while setting bean property 'connectionPool'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchConnectionPool' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-client.crt] cannot be resolved to absolute file path - web application archive not expanded?
at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:359)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchDnResolver' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchPooledConnectionFactory' while setting bean property 'connectionFactory'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchPooledConnectionFactory' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchConnectionPool' while setting bean property 'connectionPool'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchConnectionPool' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-client.crt] cannot be resolved to absolute file path - web application archive not expanded?
at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:359)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchPooledConnectionFactory' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Cannot resolve reference to bean 'bindSearchConnectionPool' while setting bean property 'connectionPool'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchConnectionPool' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-client.crt] cannot be resolved to absolute file path - web application archive not expanded?
at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:359)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'bindSearchConnectionPool' defined in file [C:\Program Files (x86)\Shibboleth\IdP\conf\authn\ldap-authn-config.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-client.crt] cannot be resolved to absolute file path - web application archive not expanded?
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1619)
Caused by: java.lang.IllegalArgumentException: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-client.crt] cannot be resolved to absolute file path - web application archive not expanded?
at org.ldaptive.provider.jndi.JndiProvider.getJndiStartTLSConnectionFactory(JndiProvider.java:167)
Caused by: java.security.GeneralSecurityException: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-client.crt] cannot be resolved to absolute file path - web application archive not expanded?
at net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig.createSSLContextInitializer(X509ResourceCredentialConfig.java:107)
Caused by: java.io.FileNotFoundException: ServletContext resource [/C:/Program Files (x86)/Shibboleth/IdP/credentials/ldap-client.crt] cannot be resolved to absolute file path - web application archive not expanded?
at org.springframework.web.util.WebUtils.getRealPath(WebUtils.java:274)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220719/64eb2f64/attachment.htm>
More information about the users
mailing list