<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1446234828684_2971">Thank you peter. We have decided to try JAAS since we could not get it working this way. Has anyone seen this error before?</div><div id="yui_3_16_0_1_1446234828684_2972"><br></div><div dir="ltr" id="yui_3_16_0_1_1446234828684_3040">2015-10-30 15:40:58,646 - ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode incoming request<br class="" id="yui_3_16_0_1_1446234828684_3042">org.opensaml.messaging.decoder.MessageDecodingException: No SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP Redirect message<br class="" id="yui_3_16_0_1_1446234828684_3044"> at org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:73)<br class="" id="yui_3_16_0_1_1446234828684_3046">2015-10-30 15:48:24,012 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:199] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by testuser failed<br class="" id="yui_3_16_0_1_1446234828684_3048">javax.security.auth.login.LoginException: Authentication failed: [org.ldaptive.auth.AuthenticationResponse@1542122009::authenticationResultCode=DN_RESOLUTION_FAILURE, ldapEntry=null, accountState=null, result=false, resultCode=null, message=DN cannot be null, controls=null]<br class="" id="yui_3_16_0_1_1446234828684_3050"> at org.ldaptive.jaas.LdapLoginModule.login(LdapLoginModule.java:160)</div><div id="yui_3_16_0_1_1446234828684_3081" dir="ltr"><br></div><div id="yui_3_16_0_1_1446234828684_3118" dir="ltr">We edited JAAS.config with our information. Thank you<br></div><div id="yui_3_16_0_1_1446234828684_2973"><br></div><div id="yui_3_16_0_1_1446234828684_2911"><span></span></div> <br><div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <font face="Arial" size="2"> On Thursday, October 29, 2015 3:15 PM, Peter Schober <peter.schober@univie.ac.at> wrote:<br> </font> </div> <br><br> <div class="y_msg_container">First of all, you're missing an error description.<br clear="none"><div class="yqt4452076203" id="yqtfd86192"><br clear="none">* Ower All <<a shape="rect" ymailto="mailto:owerall@yahoo.com" href="mailto:owerall@yahoo.com">owerall@yahoo.com</a>> [2015-10-29 19:24]:<br clear="none">> idp.authn.LDAP.ldapURL = ldaps://test.domain.com (do I need a port # here?)<br clear="none">> #idp.authn.LDAP.useStartTLS = true<br clear="none">> #idp.authn.LDAP.useSSL = false<br clear="none">> #idp.authn.LDAP.connectTimeout = 3000<br clear="none">> #idp.authn.LDAP.sslConfig = jvmTrust<br clear="none">> idp.authn.LDAP.baseDN = ou=test,dc=domain,dc=com<br clear="none">> #idp.authn.LDAP.subtreeSearch = false<br clear="none">> idp.authn.LDAP.bindDN = <a shape="rect" ymailto="mailto:testacct@test.domain.com" href="mailto:testacct@test.domain.com">testacct@test.domain.com</a><br clear="none">> idp.authn.LDAP.bindDNCredential = ***** </div><br clear="none"><br clear="none">As per<br clear="none"><a shape="rect" href="https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration</a><br clear="none">the parameter idp.authn.LDAP.useStartTLS defaults to true (which will<br clear="none">be active if you leave it commented out), which won't work when you're<br clear="none">connecting with an ldapURL of ldaps.<br clear="none">So next I'd uncomment idp.authn.LDAP.useStartTLS and set it to false.<br clear="none"><br clear="none">Then your ldapURL is ldaps (implying useSSL, to me) but the default of<br clear="none">idp.authn.LDAP.useSSL=false is active. No idea what the libraries will<br clear="none">do in such a case, but it doesn't make much sense.<br clear="none"><br clear="none">To what port you should connect is up to your deployment, we can't<br clear="none">tell you. The libraries will pick the IANA-defined standard port from<br clear="none">the ldapURL, I'd expect. So once the scheme in the ldapURL is correct<br clear="none">you'd only have to add a port if you're not connecting to the<br clear="none">IANA-defined standard ports, but e.g. to MS-AD's "global catalog"<br clear="none">(AFAIK). In short: ask your MS-AD admins.<br clear="none"><br clear="none">There's also a section on MS-AD in the documentation.<br clear="none"><a shape="rect" href="https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ActiveDirectoryConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ActiveDirectoryConfiguration</a><br clear="none"><br clear="none">-peter<br clear="none">-- <br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br></div> </div> </div> </div></div></body></html>