ldap warning "Unsuccessful search response" after upgrade to IDP 5

[David Stava]

> Am I correct that you have been sanitising your posts containing
> "user at domain" and that 'domain' really is ista.ac.at or ist.ac.at?

> Or does that error msg literally contain the string "user at domain"?


It's not literal user at domain. It contains the "actual-username at ista.ac.at"


> From the config you posted there's no apparent invalid DN syntax so I
> guess that leaves what Scott said wrt ldap-authn-config.xml.


I got rid of ldap-authn-config.xml by using the default password-authn-config.xml from the IDP 5 installation. If there are other config files involved please let me know.


Thanks for pointing out the LDAP result code 34, I will check if there might be some issue on the AD.


David Stava



________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober via users <users at shibboleth.net>
Sent: Wednesday, April 3, 2024 12:29:06 PM
To: Shib Users
Cc: Peter Schober
Subject: Re: ldap warning "Unsuccessful search response" after upgrade to IDP 5

David Stava <David.Stava at ist.ac.at> [2024-04-03 10:02 CEST]:
> in ldap.properties we have

Those look fine to me.

> > INVALID_DN_SYNTAX (coming from your LDAP server) still seems clear?
>
> I'm not sure what do you mean?

I just meant that as an error message result code 34 is quite
specific. Also I was thinking that "user at domain" literally isn't a
valid LDAP Distinguished Name (cf. RFC 4514) but then this error code
comes from the M$ implementation and those allows for DNs of such
format.

Am I correct that you have been sanitising your posts containing
"user at domain" and that 'domain' really is ista.ac.at or ist.ac.at?
Or does that error msg literally contain the string "user at domain"?
(Sanitising the user-specific part is of course fine.)

> Error resolving entry for username at domain. Unsuccessful search response:
> org.ldaptive.SearchResponse at 1220993256::messageID=2, controls=[],
> resultCode=INVALID_DN_SYNTAX, matchedDN=, diagnosticMessage=0000208F:
> NameErr: DSID-03100233, problem 2006 (BAD_NAME), data 8350

To me the main thing here is LDAP Result Code 34
("INVALID_DN_SYNTAX"), but there's quite a bit of additional
information above added by the server (starting with
"diagnosticMessage") which you'd have to ask the vendor about.

>From the config you posted there's no apparent invalid DN syntax so I
guess that leaves what Scott said wrt ldap-authn-config.xml.
  Nothing else makes much sense when you've been using the same LDAP
server with earlier versions of the software but using the same
ldap.properties.

-peter
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240403/f6a7ed4a/attachment.htm>