<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Fri, 20 Jun 2014, at 06:34 , Daniel Fisher <<a href="mailto:dfisher@vt.edu">dfisher@vt.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Thu, Jun 19, 2014 at 6:09 PM, David Bantz <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:<br><blockquote type="cite"><br>Here’s an example from an apparently resourceful user who after one failure<br>tried again providing a different identifier; the two different identifiers<br>both correctly result in the same correct dn.<br>And in case you’re wondering, yes, both identifiers are correct and both<br>were validated by direct inspection of the AD record.<br><br>12:32:23.457 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:180] -<br>Authentication failed for dn:<br>CN=jlrosenthal,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu<br>12:32:23.460 - DEBUG<br>[edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:176]<br>- User authentication for jlrosenthal failed<br>javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn<br><br></blockquote><br>Are you certain those log messages were produced by the same thread?<br></blockquote><div><br></div><div>They are adjacent lines in the idp-process.log.</div><br><blockquote type="cite">I'd like to see your login configuration, I'm confused as to what<br>would produce this behavior.<br></blockquote><div><br></div><div><br></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">ShibUserPassAuth {</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 15px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">// EDIR Auth</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> ldapUrl="<a href="ldap://edir.alaska.edu:636">ldap://edir.alaska.edu:636</a>"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> baseDn="ou=people,dc=alaska,dc=edu"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> bindDn="uid=shibboleth03,ou=resource,dc=alaska,dc=edu"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> bindCredential="shibboleth+20090303"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> ssl="true"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> tls="false"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> userField="uid,uasystemid,bannerid";</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 15px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">// UA AD Auth</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> ldapUrl="<a href="ldap://fbk-adua02.ua.ad.alaska.edu:3268">ldap://fbk-adua02.ua.ad.alaska.edu:3268</a> <a href="ldap://fbk-adua03.ua.ad.alaska.edu:3268">ldap://fbk-adua03.ua.ad.alaska.edu:3268</a>"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> bindCredential="lkjhyuio87"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> subtreeSearch="true"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">// Directly reference imported certificate for CA used to create/sign UA AD server certs </div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/UA_AD_CA.pem}"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> ssl="false"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> tls="true"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> userField="sAMAccountName,uaIdentifier";</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 15px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">// Example Kerberos authentication, requires Sun's JVM</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">// See: <a href="https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass">https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass</a></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">/*</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> com.sun.security.auth.module.Krb5LoginModule required</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> useKeyTab="true"</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> keyTab="/path/to/idp/keytab/file";</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">*/</div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); min-height: 15px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);">};</div><blockquote type="cite"><br>--Daniel Fisher<br>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></blockquote></div><br></body></html>