<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
On 05/20/2013 03:31 PM, Nate Klingenstein wrote:<br>
> It's your choice whether authentication happens via an
anonymous BIND or via a search by an authenticated DN. The LDAP
login module supports both.<br>
> In order to retrieve attributes about the user from a
directory, the IdP will need a privileged user account to perform
the search.<br>
<br>
<br>
After successfully using Shib 2 SSO with my SP using LDAP search via
an anonymous BIND I am now trying to do the same by authenticating
with a privileged user by specifying bindDn and bindCredentials for
the JAAS config for my LdapLoginModule as follows:<br>
<br>
ShibUserPassAuth {<br>
<br>
edu.vt.middleware.ldap.jaas.LdapLoginModule required<br>
ldapUrl=<a class="moz-txt-link-rfc2396E" href="ldap://wellfleet1.wellfleetsoftware.com:33389/">"ldap://wellfleet1.wellfleetsoftware.com:33389/"</a><br>
baseDn="dc=springframework,dc=org"<br>
bindDn="uid=admin,ou=system,dc=springframework,dc=org"<br>
bindCredentials="secret"<br>
ssl="false"<br>
userFilter="uid={0}"<br>
subtreeSearch="true";<br>
};<br>
<br>
I have verified that I can connect with my LDAP server using both
spring-security as well as using the <a href="http://jxplorer.org/">JExplorer
LDAP client GUI</a>.<br>
<br>
However, when I try to login during a SAML SSO initiated by my SP I
get authentication failure with the following stack trace and debug
log:<br>
<br>
18:07:03.365 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind
with the following parameters:<br>
18:07:03.365 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -
authtype = simple<br>
18:07:03.365 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn
= uid=admin,ou=system,dc=springframework,dc=org<br>
18:07:03.365 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -
credential = <suppressed><br>
18:07:03.366 - TRACE
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:87] - env
= {java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
java.naming.provider.url=<a class="moz-txt-link-freetext" href="ldap://wellfleet1.wellfleetsoftware.com:33389/">ldap://wellfleet1.wellfleetsoftware.com:33389/</a>,
bindCredentials=secret}<br>
18:07:03.382 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] -
Error connecting to LDAP URL:
<a class="moz-txt-link-freetext" href="ldap://wellfleet1.wellfleetsoftware.com:33389/">ldap://wellfleet1.wellfleetsoftware.com:33389/</a><br>
javax.naming.AuthenticationException: [LDAP: error code 49 - Bind
failed: null]<br>
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3087)
~[na:1.7.0_21]<br>
at
com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3033)
~[na:1.7.0_21]<br>
at
com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2835)
~[na:1.7.0_21]<br>
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2749)
~[na:1.7.0_21]<br>
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:316)
~[na:1.7.0_21]<br>
at
com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193)
~[na:1.7.0_21]<br>
at
com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)
~[na:1.7.0_21]<br>
at
com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
~[na:1.7.0_21]<br>
at
com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
~[na:1.7.0_21]<br>
at
javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
~[na:1.7.0_21]<br>
at
javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:307)
~[na:1.7.0_21]<br>
at javax.naming.InitialContext.init(InitialContext.java:242)
~[na:1.7.0_21]<br>
at
javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:153)
~[na:1.7.0_21]<br>
at
edu.vt.middleware.ldap.handler.DefaultConnectionHandler.connectInternal(DefaultConnectionHandler.java:134)
~[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.handler.AbstractConnectionHandler.connect(AbstractConnectionHandler.java:156)
~[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.AbstractLdap.connect(AbstractLdap.java:1006)
[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.AbstractLdap.getContext(AbstractLdap.java:1058)
[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.AbstractLdap.search(AbstractLdap.java:214)
[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.auth.SearchDnResolver.resolve(SearchDnResolver.java:139)
[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.auth.Authenticator.getDn(Authenticator.java:106)
[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.jaas.JaasAuthenticator.authenticate(JaasAuthenticator.java:74)
[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.auth.Authenticator.authenticate(Authenticator.java:320)
[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.auth.Authenticator.authenticate(Authenticator.java:277)
[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.jaas.JaasAuthenticator.authenticate(JaasAuthenticator.java:60)
[vt-ldap-3.3.6.jar:na]<br>
at
edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:103)
[vt-ldap-3.3.6.jar:na]<br>
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native
Method) ~[na:1.7.0_21]<br>
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
~[na:1.7.0_21]<br>
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
~[na:1.7.0_21]<br>
at java.lang.reflect.Method.invoke(Method.java:601)
~[na:1.7.0_21]<br>
at
javax.security.auth.login.LoginContext.invoke(LoginContext.java:784)
[na:1.7.0_21]<br>
at
javax.security.auth.login.LoginContext.access$000(LoginContext.java:203)
[na:1.7.0_21]<br>
at
javax.security.auth.login.LoginContext$4.run(LoginContext.java:698)
[na:1.7.0_21]<br>
at
javax.security.auth.login.LoginContext$4.run(LoginContext.java:696)
[na:1.7.0_21]<br>
at java.security.AccessController.doPrivileged(Native
Method) [na:1.7.0_21]<br>
at
javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:695)
[na:1.7.0_21]<br>
at
javax.security.auth.login.LoginContext.login(LoginContext.java:594)
[na:1.7.0_21]<br>
at
edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.authenticateUser(UsernamePasswordLoginServlet.java:177)
[shibboleth-identityprovider-2.4.0.jar:na]<br>
<br>
What could I be doing wrong. Note I have tried specifying bindDn
with fully qualified DN as well as DN relative to baseDN (
"uid=admin,ou=system" ) with no luck and same results in either
case.<br>
<br>
Any advice would be greatly appreciated.<br>
<pre class="moz-signature" cols="72">--
Regards,
Farrukh Najmi
Web: <a class="moz-txt-link-freetext" href="http://www.wellfleetsoftware.com">http://www.wellfleetsoftware.com</a>
</pre>
</body>
</html>