problem with adAuthenticator - non printable characters added to username
Marcin Rożek
marcin.rozek at wum.edu.pl
Tue Jul 28 09:30:42 UTC 2026
Hello,
I've installed shibboleth 5.2.3 and configured it to use adAuthenticator.
User is successfully authenticated:
2026-07-28 09:17:28,487 - 172.18.0.60 - INFO [org.ldaptive.auth.Authenticator:?] - Authentication succeeded for dn: s000003 at domain.pl
2026-07-28 09:17:28,487 - 172.18.0.60 - INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:?] - Credential Validator ldap: Login by 's000003' succeeded
2026-07-28 09:17:28,512 - 172.18.0.60 - INFO [net.shibboleth.idp.authn.impl.FinalizeAuthentication:?] - Profile Action FinalizeAuthentication: Principal s000003 authenticated
But attribute resolution fails because something somehow adds non-printable characters %0A%09 at the beginning and %0A%00 at the end of username provided by user:
best match of:%0A%09's000003 at domain.pl'%0A%00
%0A is LF (line feed)
%09 is TAB
%00 null
Full log:
2026-07-28 09:17:28,481 - 172.18.0.60 - WARN [org.ldaptive.auth.Authenticator:537] - Entry resolution failed for resolver=[org.ldaptive.auth.SearchEntryResolver at 1818477161::factory=null, , baseDn=, userFilter=null, userFilterParameters=null, allowMultipleEntries=false, subtreeSearch=false, derefAliases=NEVER, binaryAttributes=null]
org.ldaptive.LdapException: Error resolving entry for s000003 at domain.pl. Unsuccessful search response: org.ldaptive.SearchResponse at 548017834::messageID=2, controls=[], resultCode=INVALID_DN_SYNTAX, matchedDN=, diagnosticMessage=0000208F: NameErr: DSID-03100233, problem 2006 (BAD_NAME), data 8350, best match of:%0A%09's000003 at domain.pl'%0A%00, referralURLs=[], entries=[], references=[]
at org.ldaptive.auth.AbstractSearchEntryResolver.resolve(AbstractSearchEntryResolver.java:308)
at org.ldaptive.auth.Authenticator.resolveEntry(Authenticator.java:534)
at org.ldaptive.auth.Authenticator.authenticate(Authenticator.java:389)
at org.ldaptive.auth.Authenticator.authenticate(Authenticator.java:276)
at net.shibboleth.idp.authn.impl.LDAPCredentialValidator.doValidate(LDAPCredentialValidator.java:152)
at net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator.doValidate(AbstractUsernamePasswordCredentialValidator.java:230)
at net.shibboleth.idp.authn.AbstractCredentialValidator.validate(AbstractCredentialValidator.java:138)
at net.shibboleth.idp.authn.impl.ValidateCredentials.doExecute(ValidateCredentials.java:184)
at net.shibboleth.idp.authn.AbstractAuthenticationAction.doExecute(AbstractAuthenticationAction.java:98)
at org.opensaml.profile.action.AbstractProfileAction.execute(AbstractProfileAction.java:170)
at net.shibboleth.idp.profile.AbstractProfileAction.doExecute(AbstractProfileAction.java:156)
at net.shibboleth.idp.authn.impl.AbstractAuditingValidationAction.doExecute(AbstractAuditingValidationAction.java:111)
at net.shibboleth.idp.profile.AbstractProfileAction.execute(AbstractProfileAction.java:127)
at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:51)
at org.springframework.webflow.action.EvaluateAction.doExecute(EvaluateAction.java:77)
at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:188)
at org.springframework.webflow.execution.AnnotatedAction.execute(AnnotatedAction.java:145)
at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:51)
at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:101)
at org.springframework.webflow.engine.State.enter(State.java:194)
at org.springframework.webflow.engine.Transition.execute(Transition.java:228)
at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395)
at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214)
at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116)
at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547)
at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390)
at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210)
at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105)
at org.springframework.webflow.engine.State.enter(State.java:194)
at org.springframework.webflow.engine.Transition.execute(Transition.java:228)
at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395)
at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214)
at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116)
at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547)
at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390)
at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210)
at org.springframework.webflow.engine.ViewState.handleEvent(ViewState.java:231)
at org.springframework.webflow.engine.ViewState.resume(ViewState.java:195)
at org.springframework.webflow.engine.Flow.resume(Flow.java:537)
at org.springframework.webflow.engine.impl.FlowExecutionImpl.resume(FlowExecutionImpl.java:259)
at org.springframework.webflow.executor.FlowExecutorImpl.resumeExecution(FlowExecutorImpl.java:168)
at org.springframework.webflow.mvc.servlet.FlowHandlerAdapter.handle(FlowHandlerAdapter.java:254)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:963)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:866)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1000)
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:903)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:520)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:874)
at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:587)
at org.eclipse.jetty.ee9.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1424)
at org.eclipse.jetty.ee9.servlet.ServletHolder.handle(ServletHolder.java:783)
at org.eclipse.jetty.ee9.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1670)
at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:116)
at net.shibboleth.shared.spring.servlet.impl.RequestResponseContextFilter.runFilter(RequestResponseContextFilter.java:69)
at net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractConditionalFilter.java:83)
at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:114)
at net.shibboleth.shared.spring.servlet.impl.DynamicResponseHeaderFilter.runFilter(DynamicResponseHeaderFilter.java:129)
at net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractConditionalFilter.java:83)
at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:114)
at net.shibboleth.shared.spring.servlet.impl.CookieBufferingFilter.runFilter(CookieBufferingFilter.java:71)
at net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractConditionalFilter.java:83)
at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:114)
at net.shibboleth.idp.conf.impl.SLF4JMDCServletFilter.runFilter(SLF4JMDCServletFilter.java:115)
at net.shibboleth.shared.servlet.AbstractConditionalFilter.doFilter(AbstractConditionalFilter.java:83)
at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:114)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:199)
at net.shibboleth.shared.spring.servlet.impl.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:80)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116)
at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:114)
at net.shibboleth.shared.spring.servlet.impl.ChainingFilter$Chain.doFilter(ChainingFilter.java:110)
at net.shibboleth.shared.spring.servlet.impl.ChainingFilter.doFilter(ChainingFilter.java:76)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:355)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:272)
at org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:210)
at org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
at org.eclipse.jetty.ee9.servlet.ServletHandler.doHandle(ServletHandler.java:526)
at org.eclipse.jetty.ee9.nested.ScopedHandler.handle(ScopedHandler.java:125)
at org.eclipse.jetty.ee9.security.SecurityHandler.handle(SecurityHandler.java:603)
at org.eclipse.jetty.ee9.nested.HandlerWrapper.handle(HandlerWrapper.java:124)
at org.eclipse.jetty.ee9.nested.ScopedHandler.nextHandle(ScopedHandler.java:195)
at org.eclipse.jetty.ee9.nested.SessionHandler.doHandle(SessionHandler.java:612)
at org.eclipse.jetty.ee9.nested.ScopedHandler.nextHandle(ScopedHandler.java:193)
at org.eclipse.jetty.ee9.nested.ContextHandler.doHandle(ContextHandler.java:1047)
at org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:162)
at org.eclipse.jetty.ee9.servlet.ServletHandler.doScope(ServletHandler.java:483)
at org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:160)
at org.eclipse.jetty.ee9.nested.SessionHandler.doScope(SessionHandler.java:589)
at org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:160)
at org.eclipse.jetty.ee9.nested.ContextHandler.doScope(ContextHandler.java:962)
at org.eclipse.jetty.ee9.nested.ScopedHandler.handle(ScopedHandler.java:123)
at org.eclipse.jetty.ee9.nested.ContextHandler.handle(ContextHandler.java:1738)
at org.eclipse.jetty.ee9.nested.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1586)
at org.eclipse.jetty.ee9.nested.HttpChannel.dispatch(HttpChannel.java:737)
at org.eclipse.jetty.ee9.nested.HttpChannel.handle(HttpChannel.java:520)
at org.eclipse.jetty.ee9.nested.ContextHandler$CoreContextHandler$CoreToNestedHandler.handle(ContextHandler.java:3098)
at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1253)
at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:178)
at org.eclipse.jetty.server.Server.handle(Server.java:197)
at org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:804)
at org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:420)
at org.eclipse.jetty.server.internal.HttpConnection$FillableCallback.succeeded(HttpConnection.java:1790)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
at org.eclipse.jetty.io.ssl.SslConnection$SslEndPoint.onFillable(SslConnection.java:614)
at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:415)
at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:156)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:54)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:1009)
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1240)
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1194)
at java.base/java.lang.Thread.run(Thread.java:1474)
Any idea how's that possible?! Some kind of bug in code?!
Best regards,
Marcin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260728/dd3dd119/attachment.htm>
More information about the users
mailing list