<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255);">
<p style="color: rgb(0, 0, 0);">Hello Shibboleth users,</p>
<p style="color: rgb(0, 0, 0);"><br>
</p>
<p style="color: rgb(0, 0, 0);">I am in the process of setting up a shibboleth server and have run into a problem authentication with my ldap server. I am using CAS as my remote user provider using
<a href="https://github.com/Unicon/shib-cas-authn3">Unicon's authn plugin</a>, which works great as far as I can tell. I need to be able to resolve attributes to send to my vendors, but the only parameter given to Shibboleth from CAS is the principalName. So
to get the necessary data I have to do an ldap lookup. I am getting successful ldap authentication but am getting errors on the baseDN property. Here is the error:<br>
</p>
<p style="color: rgb(0, 0, 0);"><br>
</p>
<p class="x_p1"><span class="x_s1"><font color="#ff0000">2015-08-08 17:56:11,849 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:256] - Profile Action ResolveAttributes: Error resolving attributes</font></span></p>
<p class="x_p1"><span class="x_s1"><font color="#ff0000">net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector 'psdldap': Unable to execute LDAP search</font></span></p>
<p class="x_p1"><span class="x_s1"><font color="#ff0000"> at net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector.retrieveAttributes(LDAPDataConnector.java:148)</font></span></p>
<p class="x_p1"><span class="x_s1"><font color="#ff0000">Caused by: org.ldaptive.LdapException: javax.naming.directory.InvalidSearchFilterException: invalid attribute description; remaining name 'ou=psd,dc=peninsula,dc=wednet,dc=edu'</font></span></p>
<p class="x_p1"><span class="x_s1"><font color="#ff0000"> at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)</font></span></p>
<p class="x_p1"><span class="x_s1"><font color="#ff0000">Caused by: javax.naming.directory.InvalidSearchFilterException: invalid attribute description</font></span></p>
<p></p>
<p class="x_p1"><span class="x_s1"><font color="#ff0000"> at com.sun.jndi.ldap.Filter.encodeSimpleFilter(Unknown Source)</font></span></p>
<p class="x_p1" style="color: rgb(0, 0, 0);"><span class="x_s1"><br>
</span></p>
<p class="x_p1" style="color: rgb(0, 0, 0);"><span class="x_s1"><br>
</span></p>
<p class="x_p1" style="color: rgb(0, 0, 0);"><span class="x_s1">And here is my ldap data connector:</span></p>
<p class="x_p1" style="color: rgb(0, 0, 0);"><span class="x_s1"><br>
</span></p>
<p class="x_p1"><font color="#006fc9"><span class="x_s1"><</span><span class="x_s2">resolver</span><span class="x_s3">:</span><span class="x_s1">DataConnector </span><span class="x_s4">xsi</span><span class="x_s3">:</span><span class="x_s4">type</span><span class="x_s5">=</span><span class="x_s6">"dc:LDAPDirectory"</span><span class="x_s1"> </span><span class="x_s4">xmlns</span><span class="x_s5">=</span><span class="x_s6">"urn:mace:shibboleth:2.0:resolver:dc"</span><span class="x_s1"> </span><span class="x_s4">id</span><span class="x_s5">=</span><span class="x_s6">"psdldap"</span><span class="x_s1"></span><span class="x_s4">ldapURL</span><span class="x_s5">=</span><span class="x_s6">"ldap://172.31.1.36:389"</span><span class="x_s1"> </span><span class="x_s4">baseDN</span><span class="x_s5">=</span><span class="x_s6">"ou=psd,dc=peninsula,dc=wednet,dc=edu"</span><span class="x_s1"> </span><span class="x_s4">principal</span><span class="x_s5">=</span><span class="x_s6">"serv_ldapbind@psd401.net"</span><span class="x_s1"></span><span class="x_s4">principalCredential</span><span class="x_s5">=</span><span class="x_s6">"password"</span><span class="x_s1"> </span><span class="x_s4">lowercaseAttributeNames</span><span class="x_s5">=</span><span class="x_s6">"true"</span><span class="x_s1"> </span><span class="x_s4">useStartTLS</span><span class="x_s5">=</span><span class="x_s6">"false"</span><span class="x_s1">></span></font></p>
<p class="x_p2"><font color="#006fc9"><span class="x_s6"></span><br>
</font></p>
<p class="x_p3"><font color="#006fc9"><span class="x_s5"> </span><span class="x_s6"><</span><span class="x_s2">dc</span><span class="x_s3">:</span><span class="x_s6">FilterTemplate></span></font></p>
<p class="x_p4"><font color="#006fc9"><span class="x_s6"> </span><span class="x_s4"><![</span><span class="x_s7">CDATA</span><span class="x_s4">[</span></font></p>
<p class="x_p1"><span class="x_s6"><font color="#006fc9"> (samaccountname=$requestContext.principalName)</font></span></p>
<p class="x_p1"><font color="#006fc9"><span class="x_s6"> </span><span class="x_s4">]]></span></font></p>
<p class="x_p3"><font color="#006fc9"><span class="x_s5"> </span><span class="x_s6"></</span><span class="x_s2">dc</span><span class="x_s3">:</span><span class="x_s6">FilterTemplate></span></font></p>
<p class="x_p2"><font color="#006fc9"><span class="x_s6"></span></font></p>
<p class="x_p1"><span class="x_s1"><font color="#006fc9"></font></span></p>
<p class="x_p2"><font color="#006fc9"><span class="x_s6"></span><br>
</font></p>
<p class="x_p4"><font color="#006fc9"><span class="x_s6"> </span><span class="x_s1"><ReturnAttributes></span><span class="x_s6">givenname employeetype distinguishedname</span><span class="x_s1"></ReturnAttributes></span></font></p>
<p class="x_p1"><font color="#006fc9"><span class="x_s1"></span></font></p>
<p class="x_p3"><font color="#006fc9"><span class="x_s6"></</span><span class="x_s2">resolver</span><span class="x_s3">:</span></font><span class="x_s6"><font color="#006fc9">DataConnector></font></span></p>
<p class="x_p3" style="color: rgb(0, 0, 0);"><span class="x_s6"><br>
</span></p>
<p class="x_p3" style="color: rgb(0, 0, 0);"><span class="x_s6">if I change the principal to invalid credentials I get the expected INVALID_CREDENTIALS error. T</span><span class="x_s6" style="font-size: 12pt;">o me it looks like the authentication was successful,
but it could not search or find the user. Would this be an issue with BaseDN or the FilterTemplate? </span><span style="font-size: 12pt;">Here</span><span style="font-size: 12pt;"> </span><span style="font-size: 12pt;">is the debug ldap </span><span style="font-size: 12pt;">request:</span></p>
<p><font color="#757b80"><br>
</font></p>
<p class="p1"><span class="s1"><font color="#757b80">DEBUG [org.ldaptive.BindOperation:138] - execute request=[org.ldaptive.BindRequest@1833441181::bindDn=serv_ldapbind@psd401.net, saslConfig=null, controls=null] with connection=[org.ldaptive.DefaultConnectionFacto</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">ry$DefaultConnection@403078264::config=[org.ldaptive.ConnectionConfig@902444170::ldapUrl=ldap://172.31.1.36:389, connectTimeout=-1, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@1849650076::credentialConfig=org.ldaptive.ssl.Cr</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">edentialConfigFactory$2@5b20750, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@179503</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">7211::bindDn=serv_ldapbind@psd401.net, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@1372960410::metadata=[ldapUrl=ldap://172.31.1.36:389,
count=1], environment={java</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.ldap.version=3}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@353212268::operationExceptionResultCodes=[PROTOCOL_ERROR,
SERVER_DOWN], properties={}, co</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">nnectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiveConnectionStrategy@2f503e40, controlProcessor=org.ldaptive.provider.ControlProcessor@3d26f404, environment=null, tracePackets=null,
removeDnUrls=true, searchIgnoreRe</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">sultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@25c7626f]</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">2015-08-08 18:20:09,980 - DEBUG [org.ldaptive.BindOperation:168] - execute response=[org.ldaptive.Response@503115302::result=null, resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null,
referralURLs=null, messageId=-1] f</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">or request=[org.ldaptive.BindRequest@1833441181::bindDn=serv_ldapbind@psd401.net, saslConfig=null, controls=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@403078264::config=[org.ldaptive.ConnectionConfig@90</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">2444170::ldapUrl=ldap://172.31.1.36:389, connectTimeout=-1, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@1849650076::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2@5b20750, trustManagers=null,
enabledCipherSuites</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1795037211::bindDn=serv_ldapbind@psd401.net,
bindSaslConfig=null, bindControls</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@1372960410::metadata=[ldapUrl=ldap://172.31.1.36:389, count=1], environment={java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
java.naming.ld</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">ap.version=3}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@353212268::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiv</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">eConnectionStrategy@2f503e40, controlProcessor=org.ldaptive.provider.ControlProcessor@3d26f404, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED,
PARTIAL_RESULTS], s</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">slSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@25c7626f]</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">2015-08-08 18:20:09,982 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[org.ldaptive.SearchRequest@1882631444::baseDn=ou=psd,dc=peninsula,dc=wednet,dc=edu, searchFilter=[org.ldaptive.SearchFilter@-2030641523::filter=????????</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">????????????(cn=martinb)</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">????????</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">????, parameters={}], returnAttributes=[givenname, employeetype, distinguishedname], searchScope=SUBTREE, timeLimit=3000, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED,
searchEntryHandlers=</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">[[org.ldaptive.handler.CaseChangeEntryHandler@1319618537::dnCaseChange=NONE, attributeNameCaseChange=LOWER, attributeValueCaseChange=NONE]], searchReferenceHandlers=null, controls=null, followReferrals=false,
intermediateResponseHandlers=</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@403078264::config=[org.ldaptive.ConnectionConfig@902444170::ldapUrl=ldap://172.31.1.36:389, connectTimeout=-1, responseTimeout=-1,
sslConfig=[org.ldaptive.ssl.</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">SslConfig@1849650076::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2@5b20750, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false,
useStartTLS=false, connection</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">Initializer=[org.ldaptive.BindConnectionInitializer@1795037211::bindDn=serv_ldapbind@psd401.net, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@1372960410::metadata=[l</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">dapUrl=ldap://172.31.1.36:389, count=1], environment={java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.ldap.version=3}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@353212268::operationExceptionRe</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">sultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiveConnectionStrategy@2f503e40, controlProcessor=org.ldaptive.provider.ControlProcessor@3d26f404,
environment=</font></span></p>
<p class="p1"><span class="s1"><font color="#757b80">null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@</font></span></p>
<p></p>
<p class="p1"><span class="s1"><font color="#757b80">25c7626f]</font></span></p>
<p style="color: rgb(0, 0, 0);"><br>
</p>
<div id="Signature" style="color: rgb(0, 0, 0);">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<p class="p1"><b><br>
</b></p>
<p class="p1"><b>Brandon Martin</b></p>
<p class="p1">martinb@psd401.net</p>
<p class="p1">Peninsula School District</p>
<p class="p1"><i>Data Integration Analyst</i></p>
<p class="p1"></p>
<p class="p1">Ext: 3712</p>
</div>
</div>
</div>
</body>
</html>