<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi there,<br><br>I'm currently using Shibboleth with LDAP resolver, with the following config:<br><br><br> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br> ldapURL="ldap://dc.domain.local"<br> baseDN="ou=people,dc=domain,dc=local"<br> principal="cn=svc.ldap,cn=users,dc=domain,dc=local"<br> principalCredential="mypassword"><br> <resolver:Dependency ref="krb_principalname" /><br> <dc:FilterTemplate><br> <![CDATA[<br> (&(|(sAMAccountName=$requestContext.principalName)(userprincipalname=$requestContext.principalName))(objectclass=user))<br> ]]><br> </dc:FilterTemplate><br> </resolver:DataConnector><br><br>This is working fine.<br><br>But If I set the baseDN to "dc=domain,dc=local", the attribute resolver no longer works.<br> I know my svc.ldap is allowed to perform searches under that DN. I know the user I search exists.<br><br>This is what is shown on the logs:<br><br>11:40:44.604 - ERROR [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:379] - Received the following error from data connector myLDAP, no failover data connector available<br>edu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResolutionException: An error occurred when attempting to search the LDAP<br> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector.searchLdap(LdapDataConnector.java:372) ~[shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector.resolve(LdapDataConnector.java:315) ~[shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector.resolve(LdapDataConnector.java:50) ~[shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.ContextualDataConnector.resolve(ContextualDataConnector.java:77) ~[shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.ContextualDataConnector.resolve(ContextualDataConnector.java:31) ~[shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveDataConnector(ShibbolethAttributeResolver.java:374) [shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveDependencies(ShibbolethAttributeResolver.java:410) [shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttribute(ShibbolethAttributeResolver.java:332) [shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttributes(ShibbolethAttributeResolver.java:284) [shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttributes(ShibbolethAttributeResolver.java:131) [shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.getAttributes(ShibbolethSAML2AttributeAuthority.java:175) ~[shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.getAttributes(ShibbolethSAML2AttributeAuthority.java:59) ~[shibboleth-common-1.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.resolveAttributes(AbstractSAML2ProfileHandler.java:480) ~[shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:307) ~[shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:173) ~[shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) ~[shibboleth-identityprovider-2.4.0.jar:na]<br> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) ~[shibboleth-common-1.4.0.jar:na]<br> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) ~[servlet-api-2.5.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.35.jar:6.0.35]<br> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) ~[shibboleth-identityprovider-2.4.0.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.35.jar:6.0.35]<br> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) ~[shibboleth-identityprovider-2.4.0.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.35.jar:6.0.35]<br> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) ~[shibboleth-common-1.4.0.jar:na]<br> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) ~[catalina-6.0.35.jar:6.0.35]<br> at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) ~[tomcat-coyote-6.0.35.jar:6.0.35]<br> at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) ~[tomcat-coyote-6.0.35.jar:6.0.35]<br> at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:776) ~[tomcat-coyote-6.0.35.jar:6.0.35]<br> at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:705) ~[tomcat-coyote-6.0.35.jar:6.0.35]<br> at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:898) ~[tomcat-coyote-6.0.35.jar:6.0.35]<br> at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) ~[tomcat-coyote-6.0.35.jar:6.0.35]<br> at java.lang.Thread.run(Thread.java:701) ~[na:1.6.0_27]<br>11:40:44.604 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:484] - Error resolving attributes for principal 'user@DOMAIN.LOCAL'. No name identifier or attribute statement will be included in response<br><br>Any idea how to fix?<br><br>Thanks.<br><br>Regards,<br>Ricardo<br> </div></body>
</html>