<html><body>
<p><font size="2" face="sans-serif">Hi All!</font><br>
<br>
<font size="2" face="sans-serif">I am trying to configure both the authentication and attribute retrieval using the credentials provided by the user. According to the docs, this should be possible using the directAuthenticator strategy.</font><br>
<br>
<font size="2" face="sans-serif">The authentication works fine but the attribute resolution fails with the following error:</font><br>
<br>
<font size="2" face="sans-serif">2015-12-22 15:14:15,437 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:257] - Profile Action ResolveAttributes: Error resolving attributes</font><br>
<font size="2" face="sans-serif">net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector 'LDAP_01': Unable to execute LDAP search</font><br>
<font size="2" face="sans-serif"> at net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector.retrieveAttributes(LDAPDataConnector.java:168)</font><br>
<font size="2" face="sans-serif">Caused by: org.ldaptive.LdapException: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on]; remaining name 'OU=People,DC=global,DC=un,DC=org'</font><br>
<font size="2" face="sans-serif"> at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)</font><br>
<font size="2" face="sans-serif">Caused by: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1]b1</font><br>
<font size="2" face="sans-serif"> at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)</font><br>
<font size="2" face="sans-serif">2015-12-22 15:14:15,526 - WARN [net.shibboleth.idp.saml.nameid.impl.AttributeSourcedSAML2NameIDGenerator:154] - Unable to locate AttributeContext</font><br>
<br>
<font size="2" face="sans-serif">ldap-auth-config-xml:</font><br>
<font size="2" face="sans-serif"><!-- Direct Search Configuration --></font><br>
<font size="2" face="sans-serif"> <bean name="directAuthenticator" class="org.ldaptive.auth.Authenticator" p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}"></font><br>
<font size="2" face="sans-serif"> <constructor-arg index="0" ref="formatDnResolver" /></font><br>
<font size="2" face="sans-serif"> <constructor-arg index="1" ref="authHandler" /></font><br>
<font size="2" face="sans-serif"> </bean></font><br>
<br>
<font size="2" face="sans-serif">ldap.properties:</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.authenticator = directAuthenticator</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.ldapURL = ldaps://host:636</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.useStartTLS = false</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.useSSL = true</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.connectTimeout= 3000</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.sslConfig = certificateTrust</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap.crt</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.returnAttributes = division, telephoneNumber, mail, givenName, employeeID, cn, sn, memberOf, employeeNumber</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.baseDN = OU=People,DC=global,DC=un,DC=org</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.subtreeSearch = false</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.userFilter = (cn={user})</font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.bindDN = </font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.bindDNCredential = </font><br>
<font size="2" face="sans-serif">idp.authn.LDAP.dnFormat = CN=%s,OU=People,DC=global,DC=un,DC=org</font><br>
<br>
<font size="2" face="sans-serif">idp.attribute.resolver.LDAP.returnAttributes = *</font><br>
<font size="2" face="sans-serif">idp.attribute.resolver.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL}</font><br>
<font size="2" face="sans-serif">idp.attribute.resolver.LDAP.baseDN = %{idp.authn.LDAP.baseDN}</font><br>
<font size="2" face="sans-serif">idp.attribute.resolver.LDAP.bindDN = %{idp.authn.LDAP.bindDN}</font><br>
<font size="2" face="sans-serif">idp.attribute.resolver.LDAP.bindDNCredential = %{idp.authn.LDAP.bindDNCredential}</font><br>
<font size="2" face="sans-serif">idp.attribute.resolver.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS}</font><br>
<font size="2" face="sans-serif">idp.attribute.resolver.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates}</font><br>
<font size="2" face="sans-serif">idp.attribute.resolver.LDAP.searchFilter = (cn=$requestContext.principalName)</font><br>
<br>
<br>
<font size="2" face="sans-serif">attribute-resolver.xml:</font><br>
<font size="2" face="sans-serif"> <resolver:DataConnector id="LDAP_01" xsi:type="dc:LDAPDirectory"</font><br>
<font size="2" face="sans-serif"> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"</font><br>
<font size="2" face="sans-serif"> baseDN="%{idp.attribute.resolver.LDAP.baseDN}" </font><br>
<font size="2" face="sans-serif"> principal="%{idp.attribute.resolver.LDAP.bindDN}"</font><br>
<font size="2" face="sans-serif"> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"</font><br>
<font size="2" face="sans-serif"> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"></font><br>
<font size="2" face="sans-serif"> <dc:FilterTemplate></font><br>
<font size="2" face="sans-serif"> <![CDATA[</font><br>
<font size="2" face="sans-serif"> %{idp.attribute.resolver.LDAP.searchFilter}</font><br>
<font size="2" face="sans-serif"> ]]></font><br>
<font size="2" face="sans-serif"> </dc:FilterTemplate></font><br>
<font size="2" face="sans-serif"> <dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes></font><br>
<font size="2" face="sans-serif"> </resolver:DataConnector></font><br>
<br>
<font size="2" face="sans-serif">Thanks!</font><br>
<br>
<font size="2" face="sans-serif">Zoltan</font></body></html>