<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi, <br>
<br>
Im trying to configure shibboleth IDP 3.2.1 and having some probs
authenticating against our AD....<br>
<br>
We have multiple ou's with no account overlap:<br>
ou=Staff<br>
ou=Students<br>
ou=Faculty<br>
<br>
The doc for <a
href="https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration">LDAPAuthnConfiguration</a>
says that you can have <span class="s1">idp.authn.LDAP.userFilter=</span><br>
<span style="color: rgb(34,34,34);">(&(|(ou:dn:=people)(ou:dn:=</span><span
style="color: rgb(34,34,34);">guests))(uid={user})) and have it
search multiple OU's.<br>
<br>
This works for me with just 1 ou in ldap.properties:<br>
idp.authn.LDAP.baseDN =
ou=Staff,DC=umb,DC=edu<br>
idp.authn.LDAP.userFilter = (mail={user})<br>
<br>
But when I try to use what the docs suggest to use 2 OU's it
doesnt work:</span><br>
<span style="color: rgb(34,34,34);">idp.authn.LDAP.baseDN
= DC=umb,DC=edu<br>
idp.authn.LDAP.userFilter =
(&(|(ou:dn:=Staff)(ou:dn=Students))(mail={user}))<br>
<br>
I noticed it says "</span>Active Directory does not fully support
extensible match rules" and im im assuming thats why it doesnt work.
<br>
<br>
Does someone have a config that they use to connect to 2 or more
OU's in AD that they could share???? <br>
<br>
Thanks!!<br>
Dan<br>
</body>
</html>