<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hm. Ok, a couple of things that are worth a look:</p>
<p><br>
</p>
<p>1. In login.config I don't think you want to have binddn or usercredentials. I'm also not sure that the trailing slash on the ldapUrl is a good idea, so:</p>
<p><br>
</p>
edu.vt.middleware.ldap.jaas.LdapLoginModule required<br>
<div> ldapUrl="ldap://<a href="http://XXXXXX.bucknell.edu:389/">XXXXXX.bucknell.edu:389</a>"</div>
<div> ssl="false"</div>
<div> tls="false"</div>
<div> baseDN="cn=Users,dc=bucknell,dc=edu"</div>
<div> subtreeSearch="false"</div>
<div> userFilter="cn={0}";</div>
<p><br>
</p>
<p>I'm not even sure I'd bother with the :389 on the ldapUrl line. That you're telling it to use ldap:// should be suffficient, I think. Mine are "ldaps://192.168.1.1" and "ssl=true" here, so I'm guessing on that.<br>
</p>
<p><br>
</p>
<p>2. In attribute-resolver.xml, you probably need to specify a DN for "principal", not a UPN. And same as above, I don't think you want the trailing slash, so:</p>
<p><br>
</p>
<resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
<div> ldapURL="ldap://<a href="http://XXXXXX.bucknell.edu/">XXXXXX.bucknell.edu</a>" </div>
<div> baseDN="cn=Users,dc=bucknell,dc=edu" </div>
<div> principal="cn=<a href="mailto:servicename@bucknell.edu">servicename</a>,cn=users,dc=bucknell,dc=edu"</div>
<div> principalCredential="XXXXXXXX"></div>
<div> <dc:FilterTemplate></div>
<div> <![CDATA[</div>
<div> (sAMAccountName=$requestContext.principalName)</div>
<div> ]]></div>
<div> </dc:FilterTemplate></div>
<div> <dc:ReturnAttributes>employeeType uid cn sn displayName givenName mail bucknellEmployeeType memberOf bucknelleduPersonEntitlement</dc:ReturnAttributes></div>
<div> <dc:LDAPProperty name="java.naming.referral" value="follow"/></div>
<div> </resolver:DataConnector></div>
<p><br>
</p>
<p>Probably. An equivalent ldapsearch for testing would be something like:</p>
<p><br>
</p>
<p>ldapsearch -x -LLL -H ldap://<a title="Ctrl+Click or tap to follow the link" href="http://XXXXXX.bucknell.edu/">XXXXXX.bucknell.edu/</a> -D cn=<a href="mailto:servicename@bucknell.edu">servicename</a>,cn=users,dc=bucknell,dc=edu -W -b cn=Users,dc=bucknell,dc=edu
'(samaccountname=bob)' employeeType uid cn sn displayName givenName mail bucknellEmployeeType memberOf bucknelleduPersonEntitlement</p>
<p><br>
</p>
<p>You'll need to specify a valid samaccountname, of course, unless you have something named "bob" to search for.</p>
<p><br>
</p>
<p><br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users-bounces@shibboleth.net <users-bounces@shibboleth.net> on behalf of Michael Dahlberg <olgamirth@gmail.com><br>
<b>Sent:</b> Thursday, March 05, 2015 3:33 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Active Directory as Authentication Source</font>
<div> </div>
</div>
<div>
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Mar 5, 2015 at 4:03 PM, David Gersic <span dir="ltr">
<<a href="mailto:dgersic@niu.edu" target="_blank">dgersic@niu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-color:rgb(204,204,204); border-left-style:solid; padding-left:1ex">
<div dir="ltr">
<div style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif; background-color:rgb(255,255,255)">
<p><span style="font-size:12pt">It might help to post the actual configuration file you're using. Mask out the sensitive bits before posting, of course.</span></p>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>David:</div>
<div><br>
</div>
<div>No problem. Just didn't think anybody would want to see that. The entire non-commented-out part of login.conf is as follows:</div>
<div><br>
</div>
<div>ShibUserPassAuth {</div>
<div><br>
</div>
<div> edu.vt.middleware.ldap.jaas.LdapLoginModule required<br>
</div>
<div> ldapUrl="ldap://<a href="http://XXXXXX.bucknell.edu:389/">XXXXXX.bucknell.edu:389/</a>"</div>
<div> ssl="false"</div>
<div> tls="false"</div>
<div> baseDN="cn=Users,dc=bucknell,dc=edu"</div>
<div> subtreeSearch="false"</div>
<div> bindDn="<a href="mailto:servicename@bucknell.edu">servicename@bucknell.edu</a>"</div>
<div> bindCredential="XXXXXXX"</div>
<div> userFilter="cn={0}";</div>
<div><br>
</div>
<div>};<br>
</div>
<div><br>
</div>
<div>The LDAP connector in the attribute-resolver.xml file:</div>
<div><br>
</div>
<div>
<div> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"</div>
<div> ldapURL="ldap://<a href="http://XXXXXX.bucknell.edu/">XXXXXX.bucknell.edu/</a>" </div>
<div> baseDN="cn=Users,dc=bucknell,dc=edu" </div>
<div> principal="<a href="mailto:servicename@bucknell.edu">servicename@bucknell.edu</a>"</div>
<div> principalCredential="XXXXXXXX"></div>
<div> <dc:FilterTemplate></div>
<div> <![CDATA[</div>
<div> (sAMAccountName=$requestContext.principalName)</div>
<div> ]]></div>
<div> </dc:FilterTemplate></div>
<div> <dc:ReturnAttributes>employeeType uid cn sn displayName givenName mail bucknellEmployeeType memberOf bucknelleduPersonEntitlement</dc:ReturnAttributes></div>
<div> <dc:LDAPProperty name="java.naming.referral" value="follow"/></div>
<div> </resolver:DataConnector></div>
<div><br>
</div>
</div>
<div><br>
</div>
<div>And this is the login handler portion of handler.xml</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div> <ph:LoginHandler xsi:type="ph:UsernamePassword" </div>
<div> jaasConfigurationLocation="file:///usr/local/idp/conf/login.config"></div>
<div> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod></div>
<div> </ph:LoginHandler></div>
<div><br>
</div>
<div> <ph:LoginHandler xsi:type="ph:PreviousSession"></div>
<div> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</ph:AuthenticationMethod></div>
<div> </ph:LoginHandler></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>It all seems pretty standard which is why I am so confused as to why it's not working.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Mike</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>