<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.StileMessaggioDiPostaElettronica17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 2.0cm 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="IT" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Dear ShibUsers,<o:p></o:p></p>
<p class="MsoNormal">I’ve just installed Shib 2.4.0 on Windows Server 2012 R2 (Domain Controller), with Java 7u51 (32bit).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I configured Shib to rely on AD through the adreader user (adreader@eduteamit.com).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Before federating with Office 365, I tested it from <a href="https://www.testshib.org/register.html">
https://www.testshib.org/register.html</a> where I uploaded the file <a href="https://sts.eduteamit.com:444/idp-metadata-444.xml">
https://sts.eduteamit.com:444/idp-metadata-444.xml</a>, which seemed to work. In fact, if I open
<a href="https://sp.testshib.org/">https://sp.testshib.org/</a> and enter <a href="https://sts.eduteamit.com/idp/shibboleth">
https://sts.eduteamit.com/idp/shibboleth</a>, I’m correctly redirected to my authentication page
<a href="https://sts.eduteamit.com:444/idp/Authn/UserPassword">https://sts.eduteamit.com:444/idp/Authn/UserPassword</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However, when I enter a <a href="mailto:myuser@eduteamit.com">
myuser@eduteamit.com</a>’s credentials (myuser, aaa111AAA or even <a href="mailto:myuser@eduteamit.com">
myuser@eduteamit.com</a>, aaa111AAA), I get the error “Login has failed”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Looking at idpprocess.log, it says the following. Thank you for any help<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Mauro<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:170] - Attempting to authenticate user myuser<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:180] - useFirstPass = false<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:181] - tryFirstPass = false<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:182] - storePass = false<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:183] - clearPass = false<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:184] - setLdapPrincipal = true<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:185] - setLdapDnPrincipal = false<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:186] - setLdapCredential = true<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:187] - defaultRole = []<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:188] - principalGroupName = null<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:189] - roleGroupName = null<o:p></o:p></p>
<p class="MsoNormal">19:54:35.730 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:77] - userRoleAttribute = [sAMAccountName]<o:p></o:p></p>
<p class="MsoNormal">19:54:35.733 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:83] - Created authenticator: edu.vt.middleware.ldap.auth.AuthenticatorConfig@4749977::env={java.naming.provider.url=ldap://localhost:389, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}<o:p></o:p></p>
<p class="MsoNormal">19:54:35.733 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:108] - Looking up DN using userField<o:p></o:p></p>
<p class="MsoNormal">19:54:35.733 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the following parameters:<o:p></o:p></p>
<p class="MsoNormal">19:54:35.733 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] - dn = CN=Users,DC=eduteamit,DC=com<o:p></o:p></p>
<p class="MsoNormal">19:54:35.733 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] - filter = (samAccountName={0})<o:p></o:p></p>
<p class="MsoNormal">19:54:35.733 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] - filterArgs = [myuser]<o:p></o:p></p>
<p class="MsoNormal">19:54:35.734 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] - searchControls = javax.naming.directory.SearchControls@68ec99<o:p></o:p></p>
<p class="MsoNormal">19:54:35.734 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] - handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler@854bb0]<o:p></o:p></p>
<p class="MsoNormal">19:54:35.734 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:<o:p></o:p></p>
<p class="MsoNormal">19:54:35.734 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - authtype = simple<o:p></o:p></p>
<p class="MsoNormal">19:54:35.734 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn = adreader@eduteamit.com<o:p></o:p></p>
<p class="MsoNormal">19:54:35.735 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] - credential = <suppressed><o:p></o:p></p>
<p class="MsoNormal">19:54:35.742 - INFO [edu.vt.middleware.ldap.auth.SearchDnResolver:161] - Search for user: myuser failed using filter: (samAccountName={0})<o:p></o:p></p>
<p class="MsoNormal">19:54:35.743 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:136] - Authentication failed<o:p></o:p></p>
<p class="MsoNormal">javax.naming.AuthenticationException: Cannot authenticate dn, invalid dn<o:p></o:p></p>
<p class="MsoNormal"> at edu.vt.middleware.ldap.auth.AbstractAuthenticator.authenticateAndAuthorize(AbstractAuthenticator.java:160) ~[vt-ldap-3.3.6.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at edu.vt.middleware.ldap.jaas.JaasAuthenticator.authenticate(JaasAuthenticator.java:83) ~[vt-ldap-3.3.6.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at edu.vt.middleware.ldap.auth.Authenticator.authenticate(Authenticator.java:320) ~[vt-ldap-3.3.6.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at edu.vt.middleware.ldap.auth.Authenticator.authenticate(Authenticator.java:277) ~[vt-ldap-3.3.6.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at edu.vt.middleware.ldap.jaas.JaasAuthenticator.authenticate(JaasAuthenticator.java:60) ~[vt-ldap-3.3.6.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:103) ~[vt-ldap-3.3.6.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at java.lang.reflect.Method.invoke(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext.invoke(Unknown Source) [na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext.access$000(Unknown Source) [na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext$4.run(Unknown Source) [na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext$4.run(Unknown Source) [na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at java.security.AccessController.doPrivileged(Native Method) [na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext.invokePriv(Unknown Source) [na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext.login(Unknown Source) [na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.authenticateUser(UsernamePasswordLoginServlet.java:177) [shibboleth-identityprovider-2.4.0.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.service(UsernamePasswordLoginServlet.java:123) [shibboleth-identityprovider-2.4.0.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.0.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.0.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:861) [tomcat-coyote.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:606) [tomcat-coyote.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at java.lang.Thread.run(Unknown Source) [na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal">19:54:35.744 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:194] - User authentication for myuser failed<o:p></o:p></p>
<p class="MsoNormal">javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn<o:p></o:p></p>
<p class="MsoNormal"> at edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:138) ~[vt-ldap-3.3.6.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at java.lang.reflect.Method.invoke(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext.invoke(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext.access$000(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext$4.run(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext$4.run(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at java.security.AccessController.doPrivileged(Native Method) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext.invokePriv(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at javax.security.auth.login.LoginContext.login(Unknown Source) ~[na:1.7.0_51]<o:p></o:p></p>
<p class="MsoNormal"> at edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.authenticateUser(UsernamePasswordLoginServlet.java:177) [shibboleth-identityprovider-2.4.0.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet.service(UsernamePasswordLoginServlet.java:123) [shibboleth-identityprovider-2.4.0.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.4.0.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) [shibboleth-identityprovider-2.4.0.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.4.0.jar:na]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) [catalina.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:861) [tomcat-coyote.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:606) [tomcat-coyote.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.36]<o:p></o:p></p>
<p class="MsoNormal"> at java.lang.Thread.run(Unknown Source) [na:1.7.0_51]<o:p></o:p></p>
</div>
</body>
</html>