IDP41 configuration problem to authenticate against multiples branches of an AD

[Lanthier, Stéphanie]

Dear Shibboleth users list's members,

I am humbly looking for help in the following context.

I am newly playing with Shibboleth IDP 4, using the docker image from i2incommon/shib-idp:4.1.7_20220418.
The last time I played with shibidp, it was on version 2. As a newbie with shibidp4 and Spring, I first succeed to authenticate against a single branch of our institutional Active Directory forest.

My next goal would be to authenticate against the multiples branches of AD (each branch contains mutually exclusive types of accounts).

As AD does not support extensible matching, I figured out that I could re-use the block that appears in the IDP30 doc under the title "Example for two Active Directories with two DN Resolvers for each" available at the URL https://shibboleth.atlassian.net/wiki/spaces/IDP30/pages/2494726327/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ExamplefortwoActiveDirectorieswithtwoDNResolversforeach.

On the IDP30 doc, the block is intended to be added in the ldap-authn-config.xml file. As I a am working with IDP41, for which the ldap-authn-config.xml file deprecated, I instead added the block just before the last line of my password-authn-config.xml.

I also modified accordingly the ldap.properties file, in particular :
idp.authn.LDAP.authenticator = adAggregateAuthenticator

Now, when I visit a SP that sends me to the authentication page, I receive an error about "authenticatorType property did not have a valid value" (full error below).

Reading that, I feel that the name adAggregateAuthenticator may be the "not valid value".

Well, I would be pleased to get advices to achieve my goal.

Best regards,
Stéphanie

P.S. The full error message displayed on screen :

Uncaught Exception
A software error was encountered that prevents normal operation:

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.authn.Password.Validators': Cannot resolve reference to bean 'shibboleth.LDAPValidator' while setting bean property 'sourceList' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ValidateUsernamePasswordAgainstLDAP' defined in class path resource [net/shibboleth/idp/flows/authn/password-authn-beans.xml]: Cannot resolve reference to bean 'shibboleth.authn.LDAP.authenticator' while setting bean property 'authenticator'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.authn.LDAP.authenticator' defined in class path resource [net/shibboleth/idp/flows/authn/password-authn-beans.xml]: Error setting property values; nested exception is org.springframework.beans.PropertyBatchUpdateException; nested PropertyAccessExceptions (1) are: PropertyAccessException 1: org.springframework.beans.MethodInvocationException: Property 'authenticatorType' threw exception; nested exception is java.lang.IllegalArgumentException: authenticatorType property did not have a valid value

______________________________
Stéphanie Lanthier
Conseillère en architecture d'entreprise
Services informatiques<https://servicesinformatiques.uqam.ca/> - Service aux utilisateurs
Université du Québec à Montréal

lanthier.stephanie at uqam.ca<mailto:lanthier.stephanie at uqam.ca>
514 987-3000 poste 3510

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220504/995072c3/attachment.htm>