<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Jason,<div><br></div><div><div><div><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">14:46:28.365 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:164] -<br>Error occured attempting authentication<br>javax.naming.NoPermissionException: [LDAP: error code 50 - Insufficient<br>Access Rights]<br><span class="Apple-tab-span" style="white-space: pre; "> </span>at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3049)<br>~[na:1.6.0_26]<br><span class="Apple-tab-span" style="white-space: pre; "> </span>at ...<br>...<br><br>I'm a programmer and I have to "wing it" when it comes to Linux admin<br>stuff. Does anyone know what I should check to resolve this error? I can<br>connect to the LDAP server with my other web apps and Apache Directory<br>Studio.</span></blockquote><br></div></div></div><div>Your LDAP configuration in the IdP is apparently not the same as the configuration in the other webapps or in Apache DS. I would suspect that the IdP is attempting to bind anonymously with your IdP's configuration(login.config) while in the other webapps and Apache DS, you're binding with a service account. This could easily happen by omission by following other configuration examples.</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass</a></div><div><br></div><div>If this is indeed the case, you can either enable anonymous binds to your directory, or add a username and password(bindDn and bindCredential) to your login.config so that the IdP uses a service account to authenticate users.</div><div><br></div><div>Hope this helps,</div><div>Nate.</div></body></html>