problem with adAuthenticator - non printable characters added to username

[Peter Schober]

Marcin Rożek via users <users at shibboleth.net> [2026-07-28 11:31 CEST]:
> I've installed shibboleth 5.2.3 and configured it to use adAuthenticator.
[...]
> But attribute resolution fails because something somehow adds
> non-printable characters %0A%09 at the beginning and %0A%00 at the
> end of username provided by user:
[...]
> 2026-07-28 09:17:28,481 - 172.18.0.60 - WARN
> [org.ldaptive.auth.Authenticator:537] - Entry resolution failed for
> resolver=[org.ldaptive.auth.SearchEntryResolver at 1818477161::factory=null, , baseDn=, userFilter=null, userFilterParameters=null, allowMultipleEntries=false, subtreeSearch=false, derefAliases=NEVER, binaryAttributes=null]

Did you set idp.authn.LDAP.returnAttributes, by any chance?
("Note that this property is not compatible with the adAuthenticator")

Entry resolution != attribute resolver, and from the timestamp
of the above message this came before the log line with
"FinalizeAuthentication: Principal s000003 authenticated".
So despite the warning and the stack trace it seems to me
authentication succeeded. Attribute resolution would come after that
and can also be tested independently of authentication using the
'aacli' tool the IDP comes with.

I have no idea where those chars come from, but I'd have a good look
at your ldap.properties, possibly with an editor that can make such
characters visible.

-peter