<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:14pt;color:#000000;background-color:#FFFFFF;font-family:'Times New Roman', Times, serif;">
<p>Hi Daniel,</p>
<p><br>
</p>
<p>In my IdP 2.x I have the following Remote and Local configurations. Depending the user uid either remote or local ldap authentication is established. Off course one of them will return an error message in idp-process.log file because uid does not</p>
<p>exit; which is fine. uid is not duplicated and the two ldaps are unique. not a fail back. This is what I have on 2.x and it works perfectly. Right now, I am just trying to make it to work IdP 3.2.1 with the remote Ldap and come back to add local ldap.</p>
<p><br>
</p>
<p><font color="#ff0000">attribute-resolver.xml file:</font><br>
</p>
<p><br>
</p>
<p></p>
<div> <!-- Local Open Source LDAP Connector --> </div>
<div> </div>
<div> <resolver:DataConnector id="myLocalLDAP" xsi:type="dc:LDAPDirectory"</div>
<div> xmlns="urn:mace:shibboleth:2.0:resolver:dc"</div>
<div> ldapURL="ldap://x.y.wayne.edu:389" </div>
<div> baseDN="dc=x,dc=y,dc=wayne,dc=edu" </div>
<div> principal="cn=admin,dc=x,dc=y,dc=wayne,dc=edu"</div>
<div> principalCredential="password"</div>
<div> connectionStrategy="ACTIVE_PASSIVE"</div>
<div> lowercaseAttributeNames="true"></div>
<div> <dc:FilterTemplate></div>
<div> <![CDATA[</div>
<div> (uid=$requestContext.principalName)</div>
<div> ]]></div>
<div> </dc:FilterTemplate></div>
<div> <dc:ReturnAttributes>uid</dc:ReturnAttributes></div>
<div> <ConnectionPool minPoolSize="3"/></div>
<div> </resolver:DataConnector></div>
<div> </div>
<div> </div>
<div> <!-- Remote LDAP Connector --> </div>
<div> </div>
<div> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"</div>
<div> xmlns="urn:mace:shibboleth:2.0:resolver:dc"</div>
<div> ldapURL="ldaps://A.wayne.edu:636"</div>
<div> principal="cn=remote-cn-name,ou=system groups,ou=groups,dc=wayne,dc=edu"</div>
<div> principalCredential="password"</div>
<div> lowercaseAttributeNames="true"></div>
<div> <dc:FilterTemplate></div>
<div> <![CDATA[</div>
<div> (uid=$requestContext.principalName)</div>
<div> ]]></div>
<div> </dc:FilterTemplate></div>
<div> <dc:ReturnAttributes>uid</dc:ReturnAttributes></div>
<div> <ConnectionPool minPoolSize="3"/></div>
<div> </resolver:DataConnector></div>
<div> </div>
<div><font color="#ff0000"> In login.config file:</font></div>
<div> </div>
<div><!-- Local --><br>
<div> edu.vt.middleware.ldap.jaas.LdapLoginModule Sufficient</div>
<div> ldapUrl="ldap://x.y.wayne.edu:389"</div>
<div> baseDn="<span style="font-family: 'Times New Roman', Times, serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols; font-size: 18.6667px;">cn=Employee,</span><span style="font-family: 'Times New Roman', Times, serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols; font-size: 18.6667px;">ou=OrganizationalStatus,</span>dc=x,dc=y,dc=wayne,dc=edu"</div>
<div> bindDn="cn=local-group-admin,dc=x,dc=y,dc=wayne,dc=edu"</div>
<div> bindCredential="password"</div>
<div> ssl="false"</div>
<div> userFilter="uid={0}";</div>
<div> <span style="font-size: 14pt;"> </span><span style="font-size: 14pt;"> </span></div>
<div><span style="font-size: 14pt;"><!-- Remote --></span></div>
<div>
<div>edu.vt.middleware.ldap.jaas.LdapLoginModule Sufficient </div>
<div> ldapUrl="ldaps://A.wayne.edu:636"</div>
<div> bindDn="cn=remote-group-admin,ou=system groups,ou=groups,dc=wayne,dc=edu"</div>
<div> bindCredential="password"</div>
<div> ssl="true"</div>
<div> userFilter="uid={0}";</div>
<div><br>
</div>
</div>
<div></div>
<div>The return baseDN for local Ldap is <span style="font-size: 14pt;">dn = <span style="font-family: 'Times New Roman', Times, serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols; font-size: 18.6667px;">
cn=Employee,</span><span style="font-family: 'Times New Roman', Times, serif, 'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols; font-size: 18.6667px;">ou=OrganizationalStatus,</span>dc=x,dc=y,dc=wayne,dc=edu.
Since I couldn't make it to work remote ldap with baseDN, I am fine with that. Nothing for remote Ldap since no baseDN was configured.</span>
<div><br>
</div>
</div>
</div>
<p></p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr style="display:inline-block; width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Daniel Fisher <dfisher@vt.edu><br>
<b>Sent:</b> Wednesday, February 3, 2016 2:12 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: IdP 3.2.1 Ldap problem</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">On Wed, Feb 3, 2016 at 12:44 PM, Negib A. Sherif <span dir="ltr">
<<a href="mailto:aa8288@wayne.edu" target="_blank">aa8288@wayne.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
Indeed I was missing idp.attribute.resolver.LDAP.returnAttributes. Now, I do see IdP login page and get the following error when trying to login.<br>
the error is about baseDN. Ldap is in remote site and don't have access to it. baseDN never worked even in my 2.x IdP. In my IdP 2.x, I have local OpenLdap<br>
and remote Ldap. baseDN for my local OpenLdap works fine. I don't want to disable baseDN because I needed for my local OpenLdap. Can some one help?<br>
Can wild card * be assigned for the value of baseDN in IdP 3.2.1?<br>
</blockquote>
<div><br>
</div>
<div>Can you elaborate on how you expect DN resolution to occur on the remote LDAP? Typically, if you're not searching on a branch it's because you can derive the DN entirely from the username. Is that the use case you have?</div>
<div><br>
</div>
<div>--Daniel Fisher</div>
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>