<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Thanks Dave, but unfortunatly all the OU's are top level, theres
nothing above them. And we also some OU's we want to avoid checking
so we dont we dont do subtree searches. <br>
<br>
Dan<br>
<br>
<div class="moz-cite-prefix">On 08/16/2016 04:53 AM, Dave Perry
wrote:<br>
</div>
<blockquote
cite="mid:33299E3AD0404D4399856B9C1A828CF2016AB006EA@QGEXDB2.HCUK.local"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]-->
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.s1
{mso-style-name:s1;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">(should
have noted, that goes in ldap.properties)<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">_________________________________________________<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">Dave
Perry<br>
eLearning Technologist, Hull College Group<br>
<br>
Room L34 - Queens Gardens Library<br>
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG<br>
Extension 2230 / Direct Dial 01482 381930<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">*
Need a fast reply? Try
<a moz-do-not-send="true"
href="mailto:elearning@hull-college.ac.uk"><span
style="color:blue">elearning@hull-college.ac.uk</span></a>
*<o:p></o:p></span></b></p>
</div>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:36.0pt"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"
lang="EN-US">From:</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"
lang="EN-US"> users
[<a class="moz-txt-link-freetext" href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>] <b>On Behalf Of </b>Dave
Perry<br>
<b>Sent:</b> 16 August 2016 09:48<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> RE: Shib v3 IDP with multiple OU's<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Just
use something like this:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">idp.authn.LDAP.baseDN
= ou=accounts,dc=domain,dc=local
(so dc=umb,dc=edu for you)<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">idp.authn.LDAP.subtreeSearch
= true<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">idp.authn.LDAP.userFilter
= (samaccountname={user})<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Under
Accounts, we have Staff and Students also. Then sites, then
departments… etc. And the above works fine.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">HTH,<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Dave<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">_________________________________________________<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">Dave
Perry<br>
eLearning Technologist, Hull College Group<br>
<br>
Room L34 - Queens Gardens Library<br>
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG<br>
Extension 2230 / Direct Dial 01482 381930<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#1F497D">*
Need a fast reply? Try
<a moz-do-not-send="true"
href="mailto:elearning@hull-college.ac.uk">elearning@hull-college.ac.uk</a>
*<o:p></o:p></span></b></p>
</div>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:72.0pt"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"
lang="EN-US">From:</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"
lang="EN-US"> users [<a moz-do-not-send="true"
href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Daniel McDonald<br>
<b>Sent:</b> 15 August 2016 22:53<br>
<b>To:</b> <a moz-do-not-send="true"
href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<b>Subject:</b> Shib v3 IDP with multiple OU's<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:72.0pt"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:72.0pt">Hi, <br>
<br>
Im trying to configure shibboleth IDP 3.2.1 and having some
probs authenticating against our AD....<br>
<br>
We have multiple ou's with no account overlap:<br>
ou=Staff<br>
ou=Students<br>
ou=Faculty<br>
<br>
The doc for <a moz-do-not-send="true"
href="https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration">LDAPAuthnConfiguration</a>
says that you can have <span class="s1">idp.authn.LDAP.userFilter=</span><br>
<span style="color:#222222">(&(|(ou:dn:=people)(ou:dn:=guests))(uid={user}))
and have it search multiple OU's.<br>
<br>
This works for me with just 1 ou in ldap.properties:<br>
idp.authn.LDAP.baseDN =
ou=Staff,DC=umb,DC=edu<br>
idp.authn.LDAP.userFilter =
(mail={user})<br>
<br>
But when I try to use what the docs suggest to use 2 OU's it
doesnt work:</span><br>
<span style="color:#222222">idp.authn.LDAP.baseDN
= DC=umb,DC=edu<br>
idp.authn.LDAP.userFilter =
(&(|(ou:dn:=Staff)(ou:dn=Students))(mail={user}))<br>
<br>
I noticed it says "</span>Active Directory does not fully
support extensible match rules" and im im assuming thats why
it doesnt work.
<br>
<br>
Does someone have a config that they use to connect to 2 or
more OU's in AD that they could share????
<br>
<br>
Thanks!!<br>
Dan<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999"><a
moz-do-not-send="true"
href="http://www.hull-college.ac.uk/about-us/stakeholders-newsletter">The
Review Newsletter</a></span><span
style="font-size:10.0pt;color:#999999"> </span><span
style="color:windowtext"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:10.0pt;color:#999999"><br>
</span><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">This
message is sent in confidence for the addressee </span><span
style="font-size:10.0pt;color:#999999">
</span><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">only.
It may contain confidential or sensitive </span><span
style="font-size:10.0pt;color:#999999">
</span><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">information.
The contents are not to be disclosed </span><span
style="font-size:10.0pt;color:#999999">
</span><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">to
anyone other than the addressee. Unauthorised </span><span
style="font-size:10.0pt;color:#999999">
</span><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">recipients
are requested to preserve this </span><span
style="font-size:10.0pt;color:#999999">
</span><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">confidentiality
and to advise us of any errors in </span><span
style="font-size:10.0pt;color:#999999">
</span><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">transmission.
Any views expressed in this message </span><span
style="font-size:10.0pt;color:#999999">
</span><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">are
solely the views of the individual and do not </span><span
style="font-size:10.0pt;color:#999999">
</span><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">represent
the views of the College. Nothing in this </span><span
style="font-size:10.0pt;color:#999999">
</span><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">message
should be construed as creating a contract.</span><span
style="font-size:10.0pt;color:#999999">
</span><span style="color:windowtext"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="color:windowtext"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#999999">Hull
College Group owns the email infrastructure, including the
contents.</span><span style="color:windowtext">
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="color:windowtext"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36.0pt"><span
style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#00CC33">Hull
College Group is committed to sustainability, please
reflect before printing this email.</span><span
style="color:windowtext">
<o:p></o:p></span></p>
</div>
<div>
<div class="MsoNormal"
style="margin-left:36.0pt;text-align:center" align="center">
<span style="color:windowtext">
<hr size="2" width="100%" align="center">
</span></div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>