<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
For one thing, your idp.authn.LDAP.bindDN is definitely wrong.<br>
Should be more like "cn=bind_account_name,ou=test,dc=domain,dc=com"<br>
<br>
-Brian<br>
<br>
<div class="moz-cite-prefix">On 10/30/2015 12:57 PM, Ower All wrote:<br>
</div>
<blockquote
cite="mid:255226042.344389.1446235066184.JavaMail.yahoo@mail.yahoo.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div style="color:#000; background-color:#fff;
font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial,
Lucida Grande, sans-serif;font-size:16px">
<div id="yui_3_16_0_1_1446234828684_2971">Thank you peter. We
have decided to try JAAS since we could not get it working
this way. Has anyone seen this error before?</div>
<div id="yui_3_16_0_1_1446234828684_2972"><br>
</div>
<div dir="ltr" id="yui_3_16_0_1_1446234828684_3040">2015-10-30
15:40:58,646 - ERROR
[org.opensaml.profile.action.impl.DecodeMessage:73] - Profile
Action DecodeMessage: Unable to decode incoming request<br
class="" id="yui_3_16_0_1_1446234828684_3042">
org.opensaml.messaging.decoder.MessageDecodingException: No
SAMLRequest or SAMLResponse query path parameter, invalid SAML
2 HTTP Redirect message<br class=""
id="yui_3_16_0_1_1446234828684_3044">
at
org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:73)<br
class="" id="yui_3_16_0_1_1446234828684_3046">
2015-10-30 15:48:24,012 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:199]
- Profile Action ValidateUsernamePasswordAgainstJAAS: Login by
testuser failed<br class=""
id="yui_3_16_0_1_1446234828684_3048">
javax.security.auth.login.LoginException: Authentication
failed:
[org.ldaptive.auth.AuthenticationResponse@1542122009::authenticationResultCode=DN_RESOLUTION_FAILURE,
ldapEntry=null, accountState=null, result=false,
resultCode=null, message=DN cannot be null, controls=null]<br
class="" id="yui_3_16_0_1_1446234828684_3050">
at
org.ldaptive.jaas.LdapLoginModule.login(LdapLoginModule.java:160)</div>
<div id="yui_3_16_0_1_1446234828684_3081" dir="ltr"><br>
</div>
<div id="yui_3_16_0_1_1446234828684_3118" dir="ltr">We edited
JAAS.config with our information. Thank you<br>
</div>
<div id="yui_3_16_0_1_1446234828684_2973"><br>
</div>
<div id="yui_3_16_0_1_1446234828684_2911"><span></span></div>
<br>
<div class="qtdSeparateBR"><br>
<br>
</div>
<div style="display: block;" class="yahoo_quoted">
<div style="font-family: HelveticaNeue, Helvetica Neue,
Helvetica, Arial, Lucida Grande, sans-serif; font-size:
16px;">
<div style="font-family: HelveticaNeue, Helvetica Neue,
Helvetica, Arial, Lucida Grande, sans-serif; font-size:
16px;">
<div dir="ltr"> <font face="Arial" size="2"> On Thursday,
October 29, 2015 3:15 PM, Peter Schober
<a class="moz-txt-link-rfc2396E" href="mailto:peter.schober@univie.ac.at"><peter.schober@univie.ac.at></a> wrote:<br>
</font> </div>
<br>
<br>
<div class="y_msg_container">First of all, you're missing
an error description.<br clear="none">
<div class="yqt4452076203" id="yqtfd86192"><br
clear="none">
* Ower All <<a moz-do-not-send="true" shape="rect"
ymailto="mailto:owerall@yahoo.com"
href="mailto:owerall@yahoo.com">owerall@yahoo.com</a>>
[2015-10-29 19:24]:<br clear="none">
>
idp.authn.LDAP.ldapURL =
<a class="moz-txt-link-freetext" href="ldaps://test.domain.com">ldaps://test.domain.com</a> (do I need a port # here?)<br
clear="none">
> #idp.authn.LDAP.useStartTLS =
true<br clear="none">
> #idp.authn.LDAP.useSSL =
false<br clear="none">
> #idp.authn.LDAP.connectTimeout = 3000<br
clear="none">
> #idp.authn.LDAP.sslConfig =
jvmTrust<br clear="none">
> idp.authn.LDAP.baseDN
= ou=test,dc=domain,dc=com<br clear="none">
> #idp.authn.LDAP.subtreeSearch =
false<br clear="none">
>
idp.authn.LDAP.bindDN = <a
moz-do-not-send="true" shape="rect"
ymailto="mailto:testacct@test.domain.com"
href="mailto:testacct@test.domain.com"><a class="moz-txt-link-abbreviated" href="mailto:testacct@test.domain.com">testacct@test.domain.com</a></a><br
clear="none">
> idp.authn.LDAP.bindDNCredential =
***** </div>
<br clear="none">
<br clear="none">
As per<br clear="none">
<a moz-do-not-send="true" shape="rect"
href="https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration"
target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration</a><br
clear="none">
the parameter idp.authn.LDAP.useStartTLS defaults to
true (which will<br clear="none">
be active if you leave it commented out), which won't
work when you're<br clear="none">
connecting with an ldapURL of ldaps.<br clear="none">
So next I'd uncomment idp.authn.LDAP.useStartTLS and set
it to false.<br clear="none">
<br clear="none">
Then your ldapURL is ldaps (implying useSSL, to me) but
the default of<br clear="none">
idp.authn.LDAP.useSSL=false is active. No idea what the
libraries will<br clear="none">
do in such a case, but it doesn't make much sense.<br
clear="none">
<br clear="none">
To what port you should connect is up to your
deployment, we can't<br clear="none">
tell you. The libraries will pick the IANA-defined
standard port from<br clear="none">
the ldapURL, I'd expect. So once the scheme in the
ldapURL is correct<br clear="none">
you'd only have to add a port if you're not connecting
to the<br clear="none">
IANA-defined standard ports, but e.g. to MS-AD's "global
catalog"<br clear="none">
(AFAIK). In short: ask your MS-AD admins.<br
clear="none">
<br clear="none">
There's also a section on MS-AD in the documentation.<br
clear="none">
<a moz-do-not-send="true" shape="rect"
href="https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ActiveDirectoryConfiguration"
target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ActiveDirectoryConfiguration</a><br
clear="none">
<br clear="none">
-peter<br clear="none">
-- <br clear="none">
To unsubscribe from this list send an email to <a
moz-do-not-send="true" shape="rect"
ymailto="mailto:users-unsubscribe@shibboleth.net"
href="mailto:users-unsubscribe@shibboleth.net"><a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></a><br>
<br>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Brian Biggs
Sonoma State University
</pre>
</body>
</html>