<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>-b "" -s base is quite different from -b "cn=Users,dc=bucknell,dc=edu" however, so your test here isn't what your config is doing.</p>
<p><br>
</p>
<p><br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users-bounces@shibboleth.net <users-bounces@shibboleth.net> on behalf of Michael Dahlberg <olgamirth@gmail.com><br>
<b>Sent:</b> Wednesday, March 04, 2015 2:13 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Active Directory as Authentication Source</font>
<div> </div>
</div>
<div>
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Mar 4, 2015 at 2:27 PM, Daniel Fisher <span dir="ltr">
<<a href="mailto:dfisher@vt.edu" target="_blank">dfisher@vt.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-color:rgb(204,204,204); border-left-style:solid; padding-left:1ex">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote"><span class="">On Wed, Mar 4, 2015 at 1:23 PM, Michael Dahlberg
<span dir="ltr"><<a href="mailto:olgamirth@gmail.com" target="_blank">olgamirth@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-color:rgb(204,204,204); border-left-style:solid; padding-left:1ex">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div>Also, a final note: I've tried using ldapsearch with the given BaseDN and the BindDN as "<a href="mailto:serviceuser@bucknell.edu" target="_blank">serviceuser@bucknell.edu</a>" and am able to successfully query the AD database.</div>
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
</span>
<div>When you use ldapsearch, do you see 'ref:' values in the output? It could be that the err=32 that you're seeing is caused by a referral that the IDP is following when it performs DN resolution.</div>
<span class=""><font color="#888888">
<div><br>
</div>
</font></span></div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>I ran the following command (removed some of the info that the Windows Admins rather I not put on a public list)</div>
<div><br>
</div>
<div>ldapsearch -x -D "<a href="mailto:servicename@bucknell.edu">servicename@bucknell.edu</a>" -b "" -s base -H ldap://<a href="http://XXXXX.bucknell.edu">XXXXX.bucknell.edu</a> -W <br>
</div>
<div><br>
</div>
<div>and received a long list various info about the AD database. However, no referrals though. I don't think that is the problem though, because I do include this </div>
<div><br>
</div>
<div><dc:LDAPProperty name="java.naming.referral" value="follow"/><br>
</div>
<div><br>
</div>
<div>in the attribute-resolver.xml file.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Mike</div>
<div> </div>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</body>
</html>