<HTML><HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 11.00.9600.17728"></HEAD>
<BODY style="FONT: 10pt Segoe UI; MARGIN: 4px 4px 1px">
<DIV>System : </DIV>
<DIV> </DIV>
<DIV>IDP 3.1.1 + ApacheDS 2.0.0</DIV>
<DIV> </DIV>
<DIV>Problem :</DIV>
<DIV> </DIV>
<DIV>Upon authentication, the user johndoe cannot log in due to the LDAP provider (ApacheDS) returning an empty DN to IDP's request.</DIV>
<DIV> </DIV>
<DIV>What you should know :</DIV>
<DIV> </DIV>
<DIV>Using Apache Directory Studio (or ldapsearch) and the same search parameters (base DN, filter, etc.), the LDAP provider return a record (<FONT size=2>uid=johndoe,ou=users,ou=system).</FONT></DIV>
<DIV><FONT size=2>From the ApacheDS log, the request from ldapsearch, Apache Directory Studio and the IDP are exactly the same.</FONT></DIV>
<DIV>I know this is not an ApacheDS mailing list. If you think that this is most certainly an ApacheDS problem, just let me know.</DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV>
<DIV>My questions :</DIV>
<DIV> </DIV>
<DIV>1. What could be the reason for ApacheDS to return different results to what appear to be the same request ?</DIV>
<DIV>2. Is there any log I can enable to know more about the failed search in the IDP ?</DIV>
<DIV>3. Do you see something in the request that could be the cause of the empty search result ?</DIV></DIV>
<DIV> </DIV>
<DIV>Regards,</DIV>
<DIV> </DIV>
<DIV>Guillaume Gilbert</DIV><FONT size=2>
<DIV> </DIV>
<DIV>****</DIV>
<DIV>IDP log showing that the resolved dn=null for user=johndoe.</DIV>
<DIV></FONT> </DIV>
<DIV> </DIV>
<DIV>2015-05-11 14:11:18,162 - DEBUG [net.shibboleth.idp.authn.AbstractExtractionAction:137] - Profile Action ExtractUsernamePasswordFromFormRequest: Trimming whitespace of input string 'johndoe'<BR>2015-05-11 14:11:18,505 - DEBUG [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:175] - Profile Action ValidateUsernamePasswordAgainstLDAP: Attempting to authenticate user johndoe<BR>2015-05-11 14:11:18,505 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:244] - resolve user=johndoe<BR>2015-05-11 14:11:18,505 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:310] - searching for DN using userFilter<BR>2015-05-11 14:11:18,521 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[org.ldaptive.SearchRequest@120094930::baseDn=ou=users,ou=system, searchFilter=[org.ldaptive.SearchFilter@-502823576::filter=(uid={user}), parameters={user=johndoe}], returnAttributes=[1.1], searchScope=ONELEVEL, timeLimit=0, sizeLimit=0, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@186870607::config=[org.ldaptive.ConnectionConfig@766727255::ldapUrl=ldap://I061061:10389, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@1770781508::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@3d356e9c, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=true, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory@1184190621::metadata=[ldapUrl=ldap://I061061:10389, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1299702300::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, <A href="mailto:connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@26fef221">connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@26fef221</A>, <A href="mailto:controlProcessor=org.ldaptive.provider.ControlProcessor@57009b1">controlProcessor=org.ldaptive.provider.ControlProcessor@57009b1</A>, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null], sslSocketFactory=[org.ldaptive.ssl.TLSSocketFactory@1770893370::factory=sun.security.ssl.SSLSocketFactoryImpl@1b98d815, sslConfig=[org.ldaptive.ssl.SslConfig@1770781508::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@3d356e9c, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null]], hostnameVerifier=null], <A href="mailto:providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection@4aa64ebd">providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection@4aa64ebd</A>]<BR>2015-05-11 14:11:18,521 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response@1447081603::result=[org.ldaptive.SearchResult@4303153::entries=[], references=[]], resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1] for request=[org.ldaptive.SearchRequest@120094930::baseDn=ou=users,ou=system, searchFilter=[org.ldaptive.SearchFilter@-502823576::filter=(uid={user}), parameters={user=johndoe}], returnAttributes=[1.1], searchScope=ONELEVEL, timeLimit=0, sizeLimit=0, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@186870607::config=[org.ldaptive.ConnectionConfig@766727255::ldapUrl=ldap://I061061:10389, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@1770781508::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@3d356e9c, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=true, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory@1184190621::metadata=[ldapUrl=ldap://I061061:10389, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1299702300::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, <A href="mailto:connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@26fef221">connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@26fef221</A>, <A href="mailto:controlProcessor=org.ldaptive.provider.ControlProcessor@57009b1">controlProcessor=org.ldaptive.provider.ControlProcessor@57009b1</A>, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null], sslSocketFactory=[org.ldaptive.ssl.TLSSocketFactory@1770893370::factory=sun.security.ssl.SSLSocketFactoryImpl@1b98d815, sslConfig=[org.ldaptive.ssl.SslConfig@1770781508::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@3d356e9c, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null]], hostnameVerifier=null], <A href="mailto:providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection@4aa64ebd">providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection@4aa64ebd</A>]<BR>2015-05-11 14:11:18,521 - INFO [org.ldaptive.auth.PooledSearchDnResolver:268] - search for user=johndoe failed using filter=[org.ldaptive.SearchFilter@-502823576::filter=(uid={user}), parameters={user=johndoe}]<BR>2015-05-11 14:11:18,521 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:279] - resolved dn=null for user=johndoe<BR>2015-05-11 14:11:18,521 - DEBUG [org.ldaptive.auth.Authenticator:236] - authenticate dn=null with request=[org.ldaptive.auth.AuthenticationRequest@702203685::user=johndoe, retAttrs=[1.1, objectclass]]<BR>2015-05-11 14:11:18,521 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:194] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'johndoe' failed<BR>2015-05-11 14:11:18,552 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:360] - found matching schema, returning name of 'preprod.adfs.accescsq.ca'<BR>2015-05-11 14:11:18,552 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:809] - No UIInfo or logos returning null<BR>2015-05-11 14:11:18,552 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:529] - No description matching the languages found, returning null</DIV>
<DIV> </DIV>
<DIV>
<DIV> </DIV>
<DIV>****</DIV>
<DIV><FONT size=2>ApacheDS log when the request comes from Apache Directory Studio (or ldapsearch) :</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>[14:23:34] DEBUG [org.apache.directory.api.CODEC_LOG] - Decoded LdapMessage : MessageType : SEARCH_REQUEST<BR>Message ID : 14<BR> SearchRequest<BR> baseDn : 'ou=users,ou=system'<BR> filter : '(uid=johndoe)'<BR> scope : single level<BR> typesOnly : false<BR> Size Limit : no limit<BR> Time Limit : no limit<BR> Deref Aliases : never Deref Aliases<BR> attributes : '1.1', 'objectClass'<BR><A href="mailto:org.apache.directory.api.ldap.model.message.SearchRequestImpl@2fa1713a">org.apache.directory.api.ldap.model.message.SearchRequestImpl@2fa1713a</A><BR>[14:23:34] DEBUG [org.apache.directory.api.CODEC_LOG] - Encoded message <BR> MessageType : SEARCH_RESULT_ENTRY<BR>Message ID : 14<BR> Search Result Entry<BR>Entry<BR> dn[n]: uid=johndoe,ou=users,ou=system<BR> objectClass: top<BR> objectClass: person<BR> objectClass: organizationalPerson<BR> objectClass: inetOrgPerson<BR> objectClass: extensibleObject</DIV>
<DIV>[14:23:34] DEBUG [org.apache.directory.api.CODEC_LOG] - Encoded message <BR> MessageType : SEARCH_RESULT_DONE<BR>Message ID : 14<BR> Search Result Done<BR> Ldap Result<BR> Result code : (SUCCESS) success<BR> Matched Dn : 'null'<BR> Diagnostic message : 'null'</DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>***</FONT></DIV>
<DIV><FONT size=2>ApacheDS log when the request comes from Apache Directory Studio :</DIV></FONT>
<DIV> </DIV>
<DIV>[14:27:27] DEBUG [org.apache.directory.api.CODEC_LOG] - Decoded LdapMessage : MessageType : SEARCH_REQUEST<BR>Message ID : 6<BR> SearchRequest<BR> baseDn : 'ou=users,ou=system'<BR> filter : '(uid=johndoe)'<BR> scope : single level<BR> typesOnly : false<BR> Size Limit : no limit<BR> Time Limit : no limit<BR> Deref Aliases : never Deref Aliases<BR> attributes : '1.1'<BR><A href="mailto:org.apache.directory.api.ldap.model.message.SearchRequestImpl@e1e168f8">org.apache.directory.api.ldap.model.message.SearchRequestImpl@e1e168f8</A><BR>[14:27:27] DEBUG [org.apache.directory.api.CODEC_LOG] - Encoded message <BR> MessageType : SEARCH_RESULT_DONE<BR>Message ID : 6<BR> Search Result Done<BR> Ldap Result<BR> Result code : (SUCCESS) success<BR> Matched Dn : 'null'<BR> Diagnostic message : 'null'</DIV></FONT></DIV>
<DIV> </DIV>
<DIV>***</DIV>
<DIV>ldap.configuration</DIV>
<DIV> </DIV>
<DIV># LDAP authentication configuration, see authn/ldap-authn-config.xml</DIV>
<DIV> </DIV>
<DIV>## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator<BR>#idp.authn.LDAP.authenticator = anonSearchAuthenticator</DIV>
<DIV> </DIV>
<DIV>## Connection properties ##<BR>idp.authn.LDAP.ldapURL = <A href="ldap://I061061:10389">ldap://I061061:10389</A><BR>#idp.authn.LDAP.useStartTLS = true<BR>#idp.authn.LDAP.useSSL = false<BR>#idp.authn.LDAP.connectTimeout = 3000</DIV>
<DIV> </DIV>
<DIV>## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust<BR>#idp.authn.LDAP.sslConfig = certificateTrust<BR>## If using certificateTrust above, set to the trusted certificate's path<BR>idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-server.crt<BR>## If using keyStoreTrust above, set to the truststore path<BR>idp.authn.LDAP.trustStore = %{idp.home}/credentials/ldap-server.truststore</DIV>
<DIV> </DIV>
<DIV>## Return attributes during authentication<BR>## NOTE: this is not used during attribute resolution; configure that directly in the<BR>## attribute-resolver.xml configuration via a DataConnector's <dc:ReturnAttributes> element<BR>idp.authn.LDAP.returnAttributes = cn,sn,mail</DIV>
<DIV> </DIV>
<DIV>## DN resolution properties ##</DIV>
<DIV> </DIV>
<DIV># Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator<BR>idp.authn.LDAP.baseDN = ou=users,ou=system<BR>#idp.authn.LDAP.subtreeSearch = false<BR>idp.authn.LDAP.userFilter = (uid={user})<BR># bind search configuration<BR>idp.authn.LDAP.bindDN = uid=admin,ou=system<BR>idp.authn.LDAP.bindDNCredential = ********</DIV>
<DIV> </DIV>
<DIV># Format DN resolution, used by directAuthenticator, adAuthenticator<BR>idp.authn.LDAP.dnFormat = uid=%s</DIV>
<DIV> </DIV>
<DIV># LDAP attribute configuration, see attribute-resolver.xml<BR>idp.attribute.resolver.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL}<BR>idp.attribute.resolver.LDAP.baseDN = %{idp.authn.LDAP.baseDN}<BR>idp.attribute.resolver.LDAP.bindDN = %{idp.authn.LDAP.bindDN}<BR>idp.attribute.resolver.LDAP.bindDNCredential = %{idp.authn.LDAP.bindDNCredential}<BR>idp.attribute.resolver.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true}<BR>idp.attribute.resolver.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates}<BR>idp.attribute.resolver.LDAP.searchFilter = (uid=$requestContext.principalName)</DIV>
<DIV> </DIV><BR>
<p>
<font size="2" face="Lucida Sans">-----<b>Avis relatif à la
confidentialité</b>----- </font>
</p>
<p>
<font size="2" face="Lucida Sans">Le présent courriel et toutes les
pièces jointes peuvent contenir de l'information confidentielle. Toute
utilisation ou distribution non autorisée du contenu de ce courriel est
interdite. Si vous n'êtes pas le destinataire de ce message, veuillez,
s'il-vous-plaît, le supprimer et en informer immédiatement l'expéditeur. </font>
</p>
<p>
<font size="2" face="Lucida Sans">This email communication, including
all attachments, may contain confidential information. Any unauthorized
use or distribution of the contents of this email is prohibited. If you
are not the intended recipient of this email, please delete it and
notify the sender immediately.</font>
</p>
</BODY></HTML>