<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Mar 4, 2015 at 1:02 PM, Rod Widdowson <span dir="ltr"><<a href="mailto:rdw@steadingsoftware.com" target="_blank">rdw@steadingsoftware.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">> (1) Any suggestions on why the authentication phase is not completed?<br>
<br>
<br>
</span>What are you setting "base" to in login.config? As I recall it needs to be something like<br>
<br>
nase="CN=Users, DC=toplevel, DC=edu"<br>
<br>
For a domain called <a href="http://toplevel.edu" target="_blank">toplevel.edu</a><br><br></blockquote><div><br></div><div>This is my BaseDN line:</div><div><br></div><div>baseDN="cn=Users,dc=bucknell,dc=edu"<br></div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
If you haven't found it already <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues</a> has a wealth of useful info.<br>
<span class=""><font color="#888888"><br><br></font></span></blockquote><div><br></div><div>Yes, I found that page. Completely disabled encryption and tried both types of BindDN as listed in this article. Also, I tried using the Global Catalog port, but our Windows Admins keep that port closed. And because we've always distributed attributes from the AD server, the referrals have always been set to follow. (Not sure about the objectSid and objectGUID params).</div><div><br></div><div>Also, a final note: I've tried using ldapsearch with the given BaseDN and the BindDN as "<a href="mailto:serviceuser@bucknell.edu">serviceuser@bucknell.edu</a>" and am able to successfully query the AD database.</div><div><br></div><div>I might give Kerberos a try anyway, since I've hit a wall with LDAP.</div><div><br></div><div>Thanks,</div><div>Mike</div></div><br></div></div>