ldap warning "Unsuccessful search response" after upgrade to IDP 5

[David Stava]

> Do you have `idp.authn.LDAP.returnAttributes` set?
> From your logs it looks like the EntryResolver is running and that should only happen if you’re asking for additional attributes at authentication.
>If you do in fact need returnAttributes, I don’t believe the dnFormat configuration will work with that type of format.
> In that case, you’d need to switch to using bindSearchAuthenticator with AD.


Dear Daniel,


yes, we have idp.authn.LDAP.returnAttributes set. When I comment it out the message disappears. Many thanks for the hint! I will check whether to keep it and switch to bindSearchAuthenticator.


David Stava


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Fisher, Daniel via users <users at shibboleth.net>
Sent: Wednesday, April 3, 2024 1:31:12 PM
To: Shib Users
Cc: Fisher, Daniel
Subject: Re: ldap warning "Unsuccessful search response" after upgrade to IDP 5


> On Apr 3, 2024, at 4:02 AM, David Stava via users <users at shibboleth.net> wrote:
>
>
> Dear Peter,
>
> many thanks for your reply.
>
> in ldap.properties we have
> idp.authn.LDAP.dnFormat                         = %s at ista.ac.at
> idp.authn.LDAP.baseDN                           = dc=ista,dc=ac,dc=at
> idp.authn.LDAP.userFilter                       = (sAMAccountName={user})
>

Do you have `idp.authn.LDAP.returnAttributes` set?
From your logs it looks like the EntryResolver is running and that should only happen if you’re asking for additional attributes at authentication.
If you do in fact need returnAttributes, I don’t believe the dnFormat configuration will work with that type of format.
In that case, you’d need to switch to using bindSearchAuthenticator with AD.

—Daniel Fisher


--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240403/eb30525d/attachment.htm>