<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoPlainText>Thanks again for all the help!! I'm almost there. I changed uid to sAMAccountName and got some positive results. During the authentication process I'm able to pull attributes using the search filter (sAMAccountName=mrichter) This is the response I get.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText style='margin-left:.5in'>2016-02-12 10:32:19,782 - DEBUG [<span style='background:yellow;mso-highlight:yellow'>org.ldaptive.auth.SearchEntryResolver</span>:418] - resolved result=[org.ldaptive.SearchResult@1957674479::entries<span style='background:yellow;mso-highlight:yellow'>=[[dn=CN=mrichter,DC=coastal, DC=edu[[mail[mrichter@coastal.edu]], [displayName[Michael Richter]], [sn[Richter]], [cn[mrichter]], [sAMAccountName[mrichter]]], responseControls=null, messageId=-1]],</span> references=[]] for criteria=[org.ldaptive.auth.AuthenticationCriteria@1236430277::dn=CN=mrichter,DC=coastal, DC=edu, authenticationRequest=[org.ldaptive.auth.AuthenticationRequest@810872251::user=mrichter, retAttrs=[cn, sn, displayName, mail, sAMAccountName]]]<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Druing Attribute resolution this is the result I get. As you see, no attributes are returned even though I’m using the same search query . All the connection info should be the same. Not sure why I’m getting Server down errors as well. Below the response, I’ve included my DataConnector below. Thanks<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText style='margin-left:.5in'>10:32:20,017 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response@1430069391::result=[org.ldaptive.SearchResult@-882078420::entries=[[dn=CN=mrichter,DC=coastal, DC=edu[], responseControls=null, messageId=-1]], references=[]], resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=[ldap://DomainDnsZones.coastal.edu/DC=DomainDnsZones,DC=coastal,DC=edu, ldap://ForestDnsZones.coastal.edu/DC=ForestDnsZones,DC=coastal,DC=edu, ldap://coastal.edu/CN=Configuration,DC=coastal,DC=edu], messageId=-1] for request=[org.ldaptive.SearchRequest@-1505036113::baseDn=DC=coastal, DC=edu, searchFilter=[org.ldaptive.SearchFilter@-523314116::filter<span style='background:yellow;mso-highlight:yellow'>=(sAMAccountName=mrichter</span>), parameters={}], returnAttributes=[cn,sn,displayName,mail,sAMAccountName], searchScope=SUBTREE, timeLimit=3000, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=[], searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@1893214953::config=[org.ldaptive.ConnectionConfig@1638631856::ldapUrl=ldap://s12dc3.coastal.edu:389, connectTimeout=-1, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@1417203230::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2@5edc70ed, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=true, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1125614861::bindDn=shibdir@coastal.edu, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory@322222445::metadata=[ldapUrl=ldap://s12dc3.coastal.edu:389, count=1], environment={java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@505635448::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiveConnectionStrategy@44fff386, controlProcessor=org.ldaptive.provider.ControlProcessor@1fc713c9, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null], sslSocketFactory=[org.ldaptive.ssl.TLSSocketFactory@641214615::factory=sun.security.ssl.SSLSocketFactoryImpl@7fd6a37b, sslConfig=[org.ldaptive.ssl.SslConfig@1417203230::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2@5edc70ed, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null]], hostnameVerifier=null], providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection@4e68410a]<o:p></o:p></p><p class=MsoPlainText style='margin-left:.5in'>2016-02-12 10:32:20,017 - INFO [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:191] - Resolver plugin 'coastal' produced no value.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><span style='background:yellow;mso-highlight:yellow'>Data Connector</span><o:p></o:p></p><p class=MsoPlainText><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<o:p></o:p></p><p class=MsoPlainText> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<o:p></o:p></p><p class=MsoPlainText> baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <o:p></o:p></p><p class=MsoPlainText> principal="%{idp.attribute.resolver.LDAP.bindDN}"<o:p></o:p></p><p class=MsoPlainText> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<o:p></o:p></p><p class=MsoPlainText> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"<o:p></o:p></p><p class=MsoPlainText> ><o:p></o:p></p><p class=MsoPlainText> <dc:FilterTemplate><o:p></o:p></p><p class=MsoPlainText> <![CDATA[<o:p></o:p></p><p class=MsoPlainText> %{idp.attribute.resolver.LDAP.searchFilter}<o:p></o:p></p><p class=MsoPlainText> ]]><o:p></o:p></p><p class=MsoPlainText> </dc:FilterTemplate><o:p></o:p></p><p class=MsoPlainText> <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked"><o:p></o:p></p><p class=MsoPlainText> <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate><o:p></o:p></p><p class=MsoPlainText> </dc:StartTLSTrustCredential><o:p></o:p></p><p class=MsoPlainText> </resolver:DataConnector><o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>-----Original Message-----<br>From: users [mailto:users-bounces@shibboleth.net] On Behalf Of Douglas E Engert<br>Sent: Friday, February 12, 2016 9:11 AM<br>To: users@shibboleth.net<br>Subject: Re: Attributes not being release from AD</p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>The uid attribute can be defined in AD, but requires your windows admins to populate it. It may not be set in your domain.<o:p></o:p></p><p class=MsoPlainText>I don't have access to AD since I retired when we were using IDP 2, but you may want to look at AD using some windows tools such as these:<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> <a href="https://technet.microsoft.com/en-us/sysinternals/adexplorer.aspx"><span style='color:windowtext;text-decoration:none'>https://technet.microsoft.com/en-us/sysinternals/adexplorer.aspx</span></a><o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> <a href="https://support.microsoft.com/en-us/kb/224543"><span style='color:windowtext;text-decoration:none'>https://support.microsoft.com/en-us/kb/224543</span></a><o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Using ldapsearch from unix might also give you some insight into what attributes are in your AD and what your AD admins have done to keep the data clean. Its also a good way to understand LDAP searching and filters.<o:p></o:p></p><p class=MsoPlainText>For example write some filters to look around for user entries that don't have attributes set as you might expect.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>You AD admins may have users located locations other then CN=users,DC=coastal,DC=edu.<o:p></o:p></p><p class=MsoPlainText>If you have a forest users may be in the forest domains. You did get some referrals, these may be for the sub domains.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>with IDP 2 the basic filter we used was:<o:p></o:p></p><p class=MsoPlainText>(&(objectClass=user)(sAMAccountName=$instancePrincipalName.get(0))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>AD has some special filters to look at the bits is userAccountControl, 2 was the account is locked.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> <a href="https://support.microsoft.com/en-us/kb/269181"><span style='color:windowtext;text-decoration:none'>https://support.microsoft.com/en-us/kb/269181</span></a><o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>If all the attributes you need are in the Global catalog which is a collections of some attributes from the forest, you can search the GC.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Work with you AD adminms so you use attributes they maintain.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>On 2/11/2016 10:11 PM, Daniel Fisher wrote:<o:p></o:p></p><p class=MsoPlainText>> On Thu, Feb 11, 2016 at 5:03 PM, Michael Richter <<a href="mailto:mrichter@coastal.edu%20%3cmailto:mrichter@coastal.edu"><span style='color:windowtext;text-decoration:none'>mrichter@coastal.edu <mailto:mrichter@coastal.edu</span></a>>> wrote:<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> 2016-02-11 16:58:52,577 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response@364560346::result=[org.ldaptive.SearchResult@4303153::entries=[], references=[]],<o:p></o:p></p><p class=MsoPlainText>> resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=[ldap://DomainDnsZones.coastal.edu/DC=DomainDnsZones,DC=coastal,DC=edu<o:p></o:p></p><p class=MsoPlainText>> <<a href="http://DomainDnsZones.coastal.edu/DC=DomainDnsZones,DC=coastal,DC=edu"><span style='color:windowtext;text-decoration:none'>http://DomainDnsZones.coastal.edu/DC=DomainDnsZones,DC=coastal,DC=edu</span></a>>, ldap://ForestDnsZones.coastal.edu/DC=ForestDnsZones,DC=coastal,DC=edu<o:p></o:p></p><p class=MsoPlainText>> <o:p></o:p></p><p class=MsoPlainText>> <http://ForestDnsZones.coastal.edu/DC=ForestDnsZones,DC=coastal,DC=edu<o:p></o:p></p><p class=MsoPlainText>> >, ldap://coastal.edu/CN=Configuration,DC=coastal,DC=edu <o:p></o:p></p><p class=MsoPlainText>> <<a href="http://coastal.edu/CN=Configuration,DC=coastal,DC=edu"><span style='color:windowtext;text-decoration:none'>http://coastal.edu/CN=Configuration,DC=coastal,DC=edu</span></a>>], <o:p></o:p></p><p class=MsoPlainText>> messageId=-1]<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> Your search produced no entries, but you did get some referrals.<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> for <o:p></o:p></p><p class=MsoPlainText>> request=[org.ldaptive.SearchRequest@1651751780::baseDn=DC=coastal, <o:p></o:p></p><p class=MsoPlainText>> DC=edu, <o:p></o:p></p><p class=MsoPlainText>> searchFilter=[org.ldaptive.SearchFilter@311971475::filter=(uid=mrichte<o:p></o:p></p><p class=MsoPlainText>> r),<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> Confirm that baseDn and search filter are correct. Doesn't active directory store users under a branch like CN=users,DC=coastal,DC=edu?<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>> --Daniel Fisher<o:p></o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText>><o:p> </o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>-- <o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> Douglas E. Engert <<a href="mailto:DEEngert@gmail.com"><span style='color:windowtext;text-decoration:none'>DEEngert@gmail.com</span></a>><o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>--<o:p></o:p></p><p class=MsoPlainText>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net"><span style='color:windowtext;text-decoration:none'>users-unsubscribe@shibboleth.net</span></a><o:p></o:p></p></div></body></html>