<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">You'll need to look at your ldap access
logs to see exactly what searches are occurring.<br>
<br>
On 12-10-05 4:12 AM, Mauro Minella wrote:<br>
</div>
<blockquote
cite="mid:29E7B8530496AB4089D46F3537AF3A2E26C4CB@DB3EX14MBXC325.europe.corp.microsoft.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.tag
{mso-style-name:tag;}
span.pln
{mso-style-name:pln;}
span.atn
{mso-style-name:atn;}
span.pun
{mso-style-name:pun;}
span.atv
{mso-style-name:atv;}
span.EmailStyle27
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle28
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
color:black;}
span.EmailStyle31
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">I made another step forward, maybe now it’s
just a LDAP query issue.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">As I said, it seems that the same function
</span><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">ShibUserPassAuth</span><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">ShibUserPassAuth {<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US"> edu.vt.middleware.ldap.jaas.LdapLoginModule
required<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US"> host="SHIBDOMAIN.LOCAL"<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US"> port="389"<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US"> base="CN=Users,DC=shibdomain,DC=local"<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US"> serviceCredential="*****"<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US"> serviceUser=<a class="moz-txt-link-rfc2396E" href="mailto:adreader@shibdomain.local">"adreader@shibdomain.local"</a><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US"> subtreeSearch = "true"<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US"> userField="userPrincipalName ";<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">};<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">in login.config does work with passive clients,
but it returns
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">oct 05, 2012 9:55:00 AM
org.apache.catalina.realm.JAASRealm authenticate<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">WARNING: Login exception authenticating
username "john.smith"<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">javax.security.auth.login.LoginException:
Cannot authenticate dn, invalid dn<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">…<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">, if I use ECP.
<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">Deepening ShibUserPassAuth, I noted that if I’
NOT using the line<o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">userFilter="(objectclass=*)"<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">If I add that line to ShibUserPassAuth, I get a
different error:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">ott 05, 2012 9:59:38 AM
org.apache.catalina.realm.JAASRealm authenticate<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">WARNING: Login exception authenticating
username "john.smith"<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">javax.security.auth.login.LoginException: Found
more than (1) DN for: john.smith<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">at
edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:167)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:35.4pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext"
lang="EN-US">…<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">Of course I have just 1 user
“<a class="moz-txt-link-abbreviated" href="mailto:john.smith@shibdomain.eduteamit.com">john.smith@shibdomain.eduteamit.com</a>” in my Active
Directory.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">The first strange thing to me, is that this
line is NOT needed for PASSIVE authentication, which works
smoothly.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">Anyway, I’m even willing to add it if it makes
my solution work. Can you help me finding the right syntax
to avoid the error?
<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"
lang="EN-US">Mauro</span><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"
lang="EN-US"><o:p></o:p></span></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Ryan Suarez
System Administrator - IT
Sheridan College
1430 Trafalgar Road
Oakville, ON
L6H 2L1
905.845.9430 x2146</pre>
</body>
</html>