JSATTR-33

[Mark Boyce]

Hi Daniel,

Idp.authn.LDAP.returnAttributes is not commented out;

idp.authn.LDAP.returnAttributes                 = cn,mail,displayName,memberOf

Thanks,
m.

Mark L. Boyce
Senior Identity Management Analyst
University of California, Office of the President
Office: 510.987.9681
Cell: 209.851.0196

From: users <users-bounces at shibboleth.net> On Behalf Of Fisher, Daniel via users
Sent: Wednesday, October 16, 2024 11:09 AM
To: Shib Users <users at shibboleth.net>
Cc: Fisher, Daniel <dfisher at vt.edu>
Subject: Re: JSATTR-33


CAUTION: EXTERNAL EMAIL
On Oct 16, 2024, at 11:22 AM, Mark Boyce via users <users at shibboleth.net<mailto:users at shibboleth.net>> wrote:

Morning all,

I’m experiencing what would be best described as the LDAP Connection intermittently reverting to the default values as described in bug JSATTR-33. We’re running the latest Shibboleth, v5.1.3, which is supposed to have included a fix for the issue. So I’m at a loss here…

From the IdP Process log:
2024-10-11 14:03:33,012 - 10.49.173.183 - WARN [org.ldaptive.auth.Authenticator:509] - Entry resolution failed for resolver=[org.ldaptive.auth.SearchEntryResolver at 1229362959::factory=null, baseDn=, userFilter=null, userFilterParameters=null, allowMultipleEntries=false, subtreeSearch=false, derefAliases=NEVER, binaryAttributes=null, entryHandlers=null]
org.ldaptive.LdapException: Error resolving entry for [username here]@ucop.edu<mailto:ebreed at ucop.edu>. Unsuccessful search response: org.ldaptive.SearchResponse at -1954686158::messageID=4363<mailto:org.ldaptive.SearchResponse at -1954686158::messageID=4363>, controls=[], resultCode=INVALID_DN_SYNTAX, matchedDN=, diagnosticMessage=0000208F: NameErr: DSID-03100232, problem 2006 (BAD_NAME), data 8350, best match of:
        'ebreed at ucop.edu<mailto:ebreed at ucop.edu>'
, referralURLs=[], entries=[], references=[]
        at org.ldaptive.auth.AbstractSearchEntryResolver.resolve(AbstractSearchEntryResolver.java:297)

I believe this is related to IDP-2287, not JSATTR-33.
Confirm that idp.authn.LDAP.returnAttributes is commented out in your configuration.

Note that these log entries are WARN, not ERROR.

—Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241016/3e511fd7/attachment.htm>