<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Fri, Feb 12, 2016 at 11:01 AM, Michael Richter <span dir="ltr"><<a href="mailto:mrichter@coastal.edu" target="_blank">mrichter@coastal.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-US" link="#0563C1" vlink="#954F72"><p>Druing Attribute resolution this is the result I get.  As you see, no attributes are returned even though I’m using the same search query .</p></div></blockquote><div>The attributes you're getting with the authentication flow are read as the authenticated user, not the bindDn credential used to resolve the DN. (Although you can change that behavior.)</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-US" link="#0563C1" vlink="#954F72"><p style="margin-left:0.5in">10:32:20,017 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response@1430069391::result=[org.ldaptive.SearchResult@-882078420::entries=[[dn=CN=mrichter,DC=coastal, DC=edu[],</p></div></blockquote><div>You found the entry, but got no attributes.</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-US" link="#0563C1" vlink="#954F72"><p style="margin-left:0.5in">baseDn=DC=coastal, DC=edu, searchFilter=[org.ldaptive.SearchFilter@-523314116::filter<span style="background:yellow">=(sAMAccountName=mrichter</span>), parameters={}], returnAttributes=[cn,sn,displayName,mail,sAMAccountName], searchScope=SUBTREE,</p></div></blockquote><div><br></div><div>You definitely requested some attributes.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-US" link="#0563C1" vlink="#954F72"><p style="margin-left:0.5in">bindDn=<a href="mailto:shibdir@coastal.edu" target="_blank">shibdir@coastal.edu</a>, bindSaslConfig=null, bindControls=null]],</p></div></blockquote><div><br></div><div>Is this user authorized to read the requested attributes?</div><div>It's generally easier to test this stuff using a command line tool like ldapsearch rather than exercising the IDP.</div><div><br></div>ldapsearch -H ldap://<a href="http://s12dc3.coastal.edu:389">s12dc3.coastal.edu:389</a> -Z -x \\<br>-b 'DC=coastal,DC=edu' \\<br>-D '<a href="mailto:shibdir@coastal.edu">shibdir@coastal.edu</a>' -W \\<br>'(sAMAccountName=mrichter)'<div><br></div><div>--Daniel Fisher</div><div><br></div></div></div></div>