<div dir="ltr">Hi<div><br></div><div>I am trying to retrieve the user's mobile number at the authentication phase. We have an Active Directory LDS server. In my previous experience AD servers didn't need any special permissions to read the directory but AD LDS has three roles - admin, readers and users. Users can't retrieve anything from the LDAP but can authenticate against it. While readers can read the LDAP and attributes and admins have full access. So once I created a reader user and configured its credentials, I am now getting attributes from the LDAP at the attribute resolution phase but nothing at the authentication phase.</div><div><br></div><div>I initially thought the problem might be the fact I was using adAuthenticator and that did not seem to set the bind credentials (so that we use the reader credentials) so I switched to using the bindSearchAuthenticator but still not getting anything returned. Logs are shown below. I am checking the LdapEntry within the LDAPResponseContext for the attributes.</div><div><br></div><div>Any help or hints would be much appreciated!</div><div><br></div><div>Thanks</div><div>Ranil</div><div><br></div><div><div>2015-05-01 21:47:37,895 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[org.ldaptive.SearchRequest@-1419595123::baseDn=CN=De Silva\, Ranil (Industrie IT),CN=Users,CN=WIN-GVB9BF0AETR,DC=local, searchFilter=[org.ldaptive.SearchFilter@1642584434::filter=(objectClass=*), parameters={}], returnAttributes=[mobile,  userPrincipalName], searchScope=OBJECT, timeLimit=0, sizeLimit=0, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@1083387473::config=[org.ldaptive.ConnectionConfig@356447101::ldapUrl=ldap://localhost:389, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@241911687::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@680ec918, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@2108005285::metadata=[ldapUrl=ldap://localhost:389, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@554515992::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@5a74ae5a, controlProcessor=org.ldaptive.provider.ControlProcessor@7c2f21d9, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@681d415b]</div><div>2015-05-01 21:47:37,915 - DEBUG [org.ldaptive.auth.Authenticator:381] - entry resolution failed for resolver=[org.ldaptive.auth.SearchEntryResolver@2011441867::factory=null, baseDn=, userFilter=null, userFilterParameters=null, allowMultipleEntries=false, subtreeSearch=false, derefAliases=null, followReferrals=false, searchEntryHandlers=null]</div><div>org.ldaptive.LdapException: javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-031522DA, problem 2001 (NO_OBJECT), data 0, best match of:</div><div><span class="" style="white-space:pre"> </span>'CN=WIN-GVB9BF0AETR,DC=local'</div><div> ]; remaining name 'CN=De Silva\, Ranil (Industrie IT),CN=Users,CN=WIN-GVB9BF0AETR,DC=local'</div><div><span class="" style="white-space:pre">  </span>at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)</div><div>Caused by: javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-031522DA, problem 2001 (NO_OBJECT), data 0, best match of:</div><div><span class="" style="white-space:pre">       </span>'CN=WIN-GVB9BF0AETR,DC=local'</div><div> ]</div><div><span class="" style="white-space:pre">    </span>at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)</div><div>2015-05-01 21:47:37,917 - INFO [org.ldaptive.auth.Authenticator:259] - Authentication succeeded for dn: CN=De Silva\, Ranil (Industrie IT),CN=Users,CN=WIN-GVB9BF0AETR,DC=local</div><div>2015-05-01 21:47:37,918 - DEBUG [org.ldaptive.auth.Authenticator:284] - authenticate response=[org.ldaptive.auth.AuthenticationHandlerResponse@1895928734::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@1083387473::config=[org.ldaptive.ConnectionConfig@356447101::ldapUrl=ldap://localhost:389, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@241911687::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@680ec918, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@2108005285::metadata=[ldapUrl=ldap://localhost:389, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@554515992::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@5a74ae5a, controlProcessor=org.ldaptive.provider.ControlProcessor@7c2f21d9, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@681d415b], result=true, resultCode=SUCCESS, message=null, controls=null] for dn=CN=De Silva\, Ranil (Industrie IT),CN=Users,CN=WIN-GVB9BF0AETR,DC=local with request=[org.ldaptive.auth.AuthenticationRequest@1271068359::user=<a href="mailto:ranil.desilva@industrieit.com">ranil.desilva@industrieit.com</a>, retAttrs=[mobile,  userPrincipalName]]</div><div>2015-05-01 21:47:37,919 - INFO [net.shibboleth.idp.twofactor.impl.ValidateUsernamePasswordAgainstLDAP:183] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by '<a href="mailto:ranil.desilva@industrieit.com">ranil.desilva@industrieit.com</a>' succeeded</div><div>2015-05-01 21:47:37,920 - DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:274] - Profile Action ValidateUsernamePasswordAgainstLDAP: Adding custom Principal(s) defined on underlying flow descriptor</div></div><div><br></div><div><div><br></div><br>
</div></div>

<br>
<div><font face="Arial, Helvetica, sans-serif" size="2"><br></font></div><font face="Arial, Helvetica, sans-serif" size="2">This email is confidential and intended solely for the person(s) to whom it is addressed.</font>