Shibb IDP issue

[Sathyaprasad, Sandeep (NIH/CIT) [C]]

We aren't using Shibb IDP for LDAP-authentication hence we don't have anything defined in ldap-auth-config file. I checked on this file and this default-file has been retained since 2019 and has remained the same during the shibb IDP upgrade process. Can we remove this file all together if this has got refences to JNDI?

We are using header based logic for providing shibb IDP sessions and we have defined the ldap connections in the ldap.properties file and using the LDAP data connector in the attribute-resolver file for pulling the user attributes. 

<DataConnector id="myLDAP" xsi:type="LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}" 
        principal="%{idp.attribute.resolver.LDAP.bindDN}"
        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
        connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
        trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
        responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}">
        <FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </FilterTemplate>
	    <ConnectionPool
            minPoolSize="%{idp.pool.LDAP.minSize:3}"
            maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
            blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
            validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
            validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
            expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"
            failFastInitialize="%{idp.pool.LDAP.failFastInitialize:false}" />
    </DataConnector>

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Wednesday, November 8, 2023 3:57 PM
To: Shib Users <users at shibboleth.net>
Cc: Sathyaprasad, Sandeep (NIH/CIT) [C] <sathyaprasads at mail.nih.gov>
Subject: [EXTERNAL] Re: Shibb IDP issue

There is no way that I know of whereby a 4.3 IdP would have a stack trace like that, that's JNDI. 4.x uses UnboundID as the LDAP implementation (and 5.x uses a native implementation inside ldaptive).

We stopped supporting JNDI a long time ago, and it doesn't actually work reliably anymore, which is entirely consistent with that behavior.

-- Scott


CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and are confident the content is safe.