IdP 5.1.2 and adAuthenticator

[Michael Grady]

Using the adAuthenticator for password authentication against AD, with version 5.1.2 of the IdP, we are seeing the following WARN message before each successful (or unsuccessful) password attempt:

2024-05-01 22:14:07,444 - nnn,nnn,nnn,nnn - WARN [org.ldaptive.auth.Authenticator:509] - Entry resolution failed for resolver=[org.ldaptive.auth.SearchEntryResolver at 756283682::factory=null, baseDn=, userFilter=null, userFilterParameters=null, allowMultipleEntries=false, subtreeSearch=false, derefAliases=NEVER, binaryAttributes=null, entryHandlers=null]
org.ldaptive.LdapException: Error resolving entry for user at domain.edu. Unsuccessful search response: org.ldaptive.SearchResponse at -2128907959::messageID=2, controls=[], resultCode=INVALID_DN_SYNTAX, matchedDN=, diagnosticMessage=0000208F: NameErr: DSID-03100232, problem 2006 (BAD_NAME), data 8350, best match of:
        'user at domain.edu'
^@, referuser at domainies=[], references=[]
        at org.ldaptive.auth.AbstractSearchEntryResolver.resolve(AbstractSearchEntryResolver.java:297)

2024-05-01 22:14:07,474 - nnn,nnn,nnn,nnn - INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:174] - Credential Validator ldap: Login by 'user' succeeded

The authentication is succeeding fine (assuming you provided the correct password), but it would be most preferable to not have that WARN message. Did we miss something that needs to be changed from IdP 4.3.3 to 5.1.2?

--
Michael A. Grady
IAM Architect, Unicon, Inc.