<div dir="ltr">On Sun, Jul 7, 2013 at 11:03 PM, Oleg Chaikovsky <span dir="ltr"><<a href="mailto:oleg.chaikovsky@aegisidentity.com" target="_blank">oleg.chaikovsky@aegisidentity.com</a>></span> wrote:<br><div class="gmail_extra">
<div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="">Hello – <u></u><u></u></p>
<p class="">I am attempting to connect IdP 2.4 to an MSFT AD server. The LDAP admin tells me that the dn he provided is correct. However, when I connect, and try to use testshib as a basic test, I get an invalid dn error (see part of idp-process.log
below. <u></u><u></u></p>
<p class=""><u></u> <u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:102] - Looking up DN using userFilter<br></p><p class=""><u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the following parameters:<u></u><u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] - dn = ou=VVC Fac-Staff,dc=vvc,dc=edu<u></u><u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] - filter = sAMAccountName={0}<u></u><u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] - filterArgs = [Shibboleth.Ldap]<u></u><u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] - searchControls = javax.naming.directory.SearchControls@465863<u></u><u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] - handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler@a54cbb9]<u></u><u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:<u></u><u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - authtype = simple<u></u><u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn = cn=shibboleth ldap,ou=service accounts,dc=vvc,dc=edu<u></u><u></u></p>
<p class="">19:46:55.209 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] - credential = <suppressed><u></u><u></u></p>
<p class="">19:46:55.584 - INFO [edu.vt.middleware.ldap.auth.SearchDnResolver:161] - Search for user: Shibboleth.Ldap failed using filter: sAMAccountName={0}</p></div></div></blockquote><div><br></div><div style>The logs indicate you are attempting to authenticate the user name 'Shibboleth.Ldap', is this correct? If so, no entry was found using the filter (sAMAccountName={0}) under ou=VVC Fac-Staff,dc=vvc,dc=edu. This can be caused by a variety of issues, some of which are: you need a subtree search, the service account you are using doesn't have the correct read access, or the user name is misspelled. Check your LDAP logs and the problem should become apparent.</div>
<div style><br></div><div style>--Daniel Fisher</div><div style><br></div></div></div></div>