<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:14pt; color:#000000; background-color:#FFFFFF; font-family:'Times New Roman',Times,serif">
<p></p>
<p style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;">Hello,</p>
<p style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"><br>
</p>
<p style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;">I have Shibboleth 2.4 setup and working with LDAPs authentication. I have 2 LDAPs one is in remote and the other one is Local, OpenLDAP, hosted in the same server were IDP is installed.
UID is unique in each LDAPs(No UID duplication). My configuration in: </p>
<p style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"><br>
</p>
<p style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<font color="#006fc9">1) login.config file has: </font></p>
<p style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
</p>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> edu.vt.middleware.ldap.jaas.LdapLoginModule required</div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
ldapUrl="ldap://<font color="#ff0000">L</font><font color="#ff0000">ocalLDAP</font>.lib.wayne.edu:636"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> baseDn="dc=LocalLDAP,dc=lib,dc=wayne,dc=edu"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> bindDn="bindDninfo"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> bindCredential="password"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> ssl="false"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> userFilter="uid={0}";</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> </div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> edu.vt.middleware.ldap.jaas.LdapLoginModule required</div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
ldapUrl="ldap://<font color="#ff0000">RemoteLDAP</font>.wayne.edu:636/ou=People,dc=wayne,dc=edu?uid?one?"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> baseDn="dc=RemoteLDAP,dc=wayne,dc=edu"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> bindDn="bindDninfo"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> bindCredential="password"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> ssl="false"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> userFilter="uid={0}";</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"><br>
</div>
<p style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
</p>
<p style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<font color="#006fc9">2) attribute-resolver.xml file has:</font></p>
<p style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
</p>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<font color="#ff0000"><!-- Local Open Source LDAP Connector --></font></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <span style="font-size: 14pt;"> <resolver:DataConnector id="myLocalLDAP" xsi:type="dc:LDAPDirectory"</span></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> xmlns="urn:mace:shibboleth:2.0:resolver:dc"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> ldapURL="ldap://LocalLDAP.lib.wayne.edu:389" </div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> baseDN="dc=LocalLDAP,dc=lib,dc=wayne,dc=edu" </div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> principal="principalinfo"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> principalCredential="password"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> connectionStrategy="ACTIVE_PASSIVE" </div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> lowercaseAttributeNames="true"></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <dc:FilterTemplate></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <![CDATA[</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> (uid=$requestContext.principalName)</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> ]]></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> </dc:FilterTemplate></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <dc:ReturnAttributes>uid</dc:ReturnAttributes></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <ConnectionPool minPoolSize="3"/></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> </resolver:DataConnector></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <span style="font-size: 14pt;"> </span></div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<font color="#ff0000"><!-- Remmote LDAP Connector --></font></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <span style="font-size: 14pt;"> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"</span></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> xmlns="urn:mace:shibboleth:2.0:resolver:dc"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> ldapURL="ldap://RemoteLDAP.wayne.edu:389/ou=People,dc=wayne,dc=edu?uid?one?"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> principal="principalinfo"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> principalCredential="password"</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <span style="font-size: 14pt;"> lowercaseAttributeNames="true"></span></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <dc:FilterTemplate></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <![CDATA[</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> (uid=$requestContext.principalName)</div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> ]]></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> </dc:FilterTemplate></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <dc:ReturnAttributes>uid</dc:ReturnAttributes></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> <ConnectionPool minPoolSize="3"/></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"> </resolver:DataConnector></div>
<div style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"><br>
</div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
3) <font color="#006fc9">attribute-filter.xml has:</font><br>
<div style="color: rgb(0, 0, 0);"> <afp:AttributeFilterPolicy id="uid"></div>
<div style="color: rgb(0, 0, 0);"> <afp:PolicyRequirementRule xsi:type="basic:ANY" /></div>
<div style="color: rgb(0, 0, 0);"> <afp:AttributeRule attributeID="uid"></div>
<div style="color: rgb(0, 0, 0);"> <afp:PermitValueRule xsi:type="basic:ANY"/> </div>
<div style="color: rgb(0, 0, 0);"> </afp:AttributeRule></div>
<div style="color: rgb(0, 0, 0);"> </afp:AttributeFilterPolicy></div>
<div style="color: rgb(0, 0, 0);"> </div>
<div style="color: rgb(0, 0, 0);"><span style="font-size: 14pt;">4) </span><span style="font-size: 14pt;"></span><font color="#006fc9" style="font-size: 14pt;">attribute-resolver.xml has:</font><br>
</div>
</div>
<p style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
</p>
<p style="font-family: 'Times New Roman', Times, serif; font-size: 14pt;"><span style="font-size: 14pt;"> </span><span style="font-size: 14pt;"> <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid" sourceAttributeID="uid"></span><span style="font-size: 14pt;"></span></p>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<resolver:Dependency ref="myLDAP" /></div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" /> </div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" /></div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
</resolver:AttributeDefinition></div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<br>
</div>
<div style="color: rgb(33, 33, 33); font-size: 15px;"><font color="#ff0000" face="Times New Roman, Times, serif">Independently,</font><font color="#ff0000"><font face="Times New Roman, Times, serif"><span style="font-size: 14pt;"> Remote or Local LDAP works
fine after commenting out, one at a time, the </span>configuration<span style="font-size: 14pt;"> in login.config and attribute-resolver.xml files</span><span style="font-size: 14pt;">. However, when I enable both Remote and Local LDAP configrations as shown
above, I can </span>authenticate<span style="font-size: 14pt;"> to LocalLDAP if UID exist in </span><span style="font-size: 14pt;">LocalLDAP. When I try with UID that exist in RemoteLDAP but not in LocalLDAP, I get the usual login failed error message. For
RemoteLDAP UID, the search stops at LocalLDAP and then genrates login failed error message. There is no error in idp-process.log file when tomcat6 starts</span></font></font><span style="font-size: 14pt; font-family: 'Times New Roman', Times, serif; color: rgb(255, 0, 0);">.
Both LocalLDAP and RemoteLDAP binds fine, loads data connectors and attribute definitions. see the snippet below from idp-process.log file.</span></div>
<div style="color: rgb(33, 33, 33); font-size: 15px;"><span style="font-size: 14pt; font-family: 'Times New Roman', Times, serif; color: rgb(255, 0, 0);"><br>
</span></div>
<div style="color: rgb(33, 33, 33); font-size: 15px;"><span style="font-size: 14pt; font-family: 'Times New Roman', Times, serif; color: rgb(255, 0, 0);">
<div>0:48:06.554 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:511] - Loading 2 data connectors</div>
<div>10:48:06.554 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:521] - Loading 2 attribute definitio<span style="font-size: 14pt;">ns</span></div>
<div><br>
</div>
</span></div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<br>
</div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
What I want is to check UID first in LocalLDAP. If UID is in LocalLDAP, the way how it works now is fine(able to access SP). However, If UID does not exist in LocalLDAP, search should go to RemoteLDAP to check UID</div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
and allow access to SP if UID exist. Otherwise, UID doesn't exist in Local or Remote LDAP, then it should display<span style="font-size: 14pt;"> login fail error.</span></div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<span style="font-size: 14pt;"> </span></div>
<div style="color: rgb(33, 33, 33); font-family: 'Times New Roman', Times, serif; font-size: 14pt;">
<span style="font-size: 14pt;">What am I missing on the above Shibboleth LDAPs configurations? Can someone help?</span></div>
<br>
<p></p>
</div>
</body>
</html>