<div dir="ltr">On Sun, Jul 14, 2013 at 11:14 PM, Oleg Chaikovsky <span dir="ltr"><<a href="mailto:oleg.chaikovsky@aegisidentity.com" target="_blank">oleg.chaikovsky@aegisidentity.com</a>></span> wrote:<br><div class="gmail_extra">
<div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal">Shibboleth IdP 2.4<u></u><u></u></p>
<p class="MsoNormal">Windows<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Connecting to AD using LDAPS – and here is the error – and the login.config file. I have searched other logs (except the ldap log) and found nothing to help discover the problem. When I use ldp.exe tool on Windows from the IdP server to
connect to the AD server, using the same principal and credential, and baseDn, I can search just fine for any user. When I attempt to authenticate using testshib as a base – I get an authentication failed – but the error is simply
<u></u><u></u></p>
<p class="MsoNormal">19:44:00.227 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:194] - User authentication for USERID failed<u></u><u></u></p>
<p class="MsoNormal">javax.security.auth.login.LoginException: java.lang.NullPointerException<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I have searched on the userlist archives – and only found the fact that folks have fixed their issue – but not where the fix was applied. I have tried both a baseDn of ou=GROUP, dc=domain, dc=edu and simply the two dc’s (at the recommendation
of the ldap admin). I simply can’t determine for myself where the error may lie.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks<u></u><u></u></p>
<p class="MsoNormal">Oleg<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">--------------------------<u></u><u></u></p>
<p class="MsoNormal">Login.config file portion<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> edu.vt.middleware.ldap.jaas.LdapLoginModule required<u></u><u></u></p>
<p class="MsoNormal"> ldapURL="ldaps://<a href="http://server.domain.edu" target="_blank">server.domain.edu</a>"<u></u><u></u></p>
<p class="MsoNormal"> port="636"<u></u><u></u></p>
<p class="MsoNormal"> ssl="true"<u></u><u></u></p>
<p class="MsoNormal"> baseDn="dc=domain,dc=edu"<u></u><u></u></p>
<p class="MsoNormal"> bindDn="<a href="mailto:USERID@domain.edu" target="_blank">USERID@domain.edu</a>"<u></u><u></u></p>
<p class="MsoNormal"> bindCredential="somepassword”<u></u><u></u></p>
<p class="MsoNormal"> subtreeSearch="true"<u></u><u></u></p>
<p class="MsoNormal"> userFilter="samAccountName={0}";</p></div></div></blockquote><div><br></div><div>Try ldapUrl instead of ldapURL.</div><div><br></div><div>--Daniel Fisher</div><div> </div></div></div>
</div>