<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Thu, 19 Jun 2014, at 13:37 , Christopher Bongaarts <<a href="mailto:cab@umn.edu">cab@umn.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); float: none; display: inline !important;">The "invalid dn" is from VT-LDAP, and indicates that the search for the user failed (i.e. the userFilter did not match any users). Nothing to do with the bindDn (unless the issue is that the bindDn doesn't have sufficient access to see the target user).</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"></blockquote></div><br><div>That’s what I said to myself, but then read the logs more closely to see that the dn being used is the dn AD returned in the search for the user. That is, </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>the user provides an identifier</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>IdP does a search for the record</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>AD provides a fully qualified dn [it ain’t provided by the user, the IdP doesn’t know how to build it from scratch, so I am assuming it was returned by AD]</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>IdP attempts (via VT-LDAP) to bind using that dn and the user-provided password</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Then I see the message “Cannot authenticate dn, invalid dn” </div><div><br></div><div>Here’s an example from an apparently resourceful user who after one failure tried again providing a different identifier; the two different identifiers both correctly result in the same correct dn.</div><div>And in case you’re wondering, yes, both identifiers are correct and both were validated by direct inspection of the AD record.</div><div><br></div><div><div style="margin: 0px; font-size: 9px; font-family: Monaco; background-color: rgb(255, 250, 194);">12:32:23.457 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:180] - Authentication failed for dn: CN=jlrosenthal,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu</div><div style="margin: 0px; font-size: 9px; font-family: Monaco; background-color: rgb(255, 250, 194);">12:32:23.460 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:176] - User authentication for jlrosenthal failed</div><div style="margin: 0px; font-size: 9px; font-family: Monaco; background-color: rgb(255, 250, 194);">javax.security.auth.login.LoginException: <span style="background-color: #e6e600">Cannot authenticate dn</span>, invalid dn</div></div><div><br></div><div><div style="margin: 0px; font-size: 9px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;"><div style="margin: 0px;">13:33:42.494 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:180] - Authentication failed for dn: CN=jlrosenthal,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu</div><div style="margin: 0px;">13:33:42.497 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:176] - User authentication for 31115951 failed</div><div style="margin: 0px;">javax.security.auth.login.LoginException: <span style="background-color: #e6e600">Cannot authenticate dn</span>, invalid dn</div><div><br></div></div></div><div><br></div><div>This failure mode is entirely different from another scenario occasionally seen:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>the user provides an identifier</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>IdP does a search for the record</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>No record is found using the user-provided identifier and IdP configured search</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Then I see the message “Search for user: {identifier} failed using filter…”</div><div><br></div><div><div style="margin: 0px; font-size: 9px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;">14:38:37.369 - INFO [edu.vt.middleware.ldap.auth.SearchDnResolver:161] - <span style="background-color: #e6e600">Search for user</span>: cmatth15 failed using filter: (|(sAMAccountName={0})(uaIdentifier={0}))</div></div><div><br></div><div><br></div></body></html>