<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} p
{margin-top:0;
margin-bottom:0}--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi,</p>
<p><br>
</p>
<p>I am having trouble releasing Attributes with my IdP.</p>
<p>I am trying to release Attributes with a LDAP data connector. I am using openldap and Shibboleth IdP Version 3.2.1.</p>
<p><br>
</p>
<p>I am trying to release the Attributes uid and sn from LDAP. I think in the logs the IdP says that it found these attributes (see below) and that the authentification succeeded. What else is necessary for the IdP to release the Attributes?
</p>
<p>If the attributes gets correctly released I will get an prompt to accept the attributes after my login don't I?</p>
<p><br>
</p>
<p>What about the last line of the log: "invoking getAcceptedIssuers invoked" ? Is it an error and if so: What is wrong?<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>thanks for your time,</p>
<p><br>
</p>
<p>Sebastian </p>
<p><br>
</p>
parts of my log:
<p><br>
</p>
2017-08-08 22:19:14,564 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response@2083676124::result=[org.ldaptive.SearchResult@165963062::entries=[[dn=uid=sriebeling,ou=People,dc=imib,dc=rwth-aachen,dc=de[<strong style="color: rgb(255, 0, 0);"><span style="color: rgb(255, 0, 0);">[uid[sriebeling]],
[sn[Riebeling]</span></strong>]], responseControls=null, messageId=-1]], references=[]], resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1] for request=[org.ldaptive.SearchRequest@1058963531::baseDn=uid=sriebeling,ou=People,dc=imib,dc=rwth-aachen,dc=de,
searchFilter=[org.ldaptive.SearchFilter@1642584434::filter=(objectClass=*), parameters={}], returnAttributes=[uid, sn], searchScope=OBJECT, timeLimit=0, sizeLimit=0, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null,
searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@1499402788::config=[org.ldaptive.ConnectionConfig@1096617956::ldapUrl=ldap://sso-med.imib.rwth-aachen.de,
connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@1357220224::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@3f006a4c, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null],
useSSL=false, useStartTLS=true, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory@393331654::metadata=[ldapUrl=ldap://sso-med.imib.rwth-aachen.de, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000,
java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1233208020::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@132edfd8,
controlProcessor=org.ldaptive.provider.ControlProcessor@4ba1b395, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null], sslSocketFactory=[org.ldaptive.ssl.TLSSocketFactory@864542371::factory=sun.security.ssl.SSLSocketFactoryImpl@2a7144e6,
sslConfig=[org.ldaptive.ssl.SslConfig@1357220224::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@3f006a4c, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null]], hostnameVerifier=null],
providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection@6925249e]<br>
2017-08-08 22:19:14,572 - DEBUG [org.ldaptive.auth.SearchEntryResolver:418] - resolved result=[org.ldaptive.SearchResult@165963062::entries=[[dn=uid=sriebeling,ou=People,dc=imib,dc=rwth-aachen,dc=de[<strong style="color: rgb(255, 0, 0);"><span style="color: rgb(255, 0, 0);">[uid[sriebeling]],
[sn[Riebeling]]</span></strong>], responseControls=null, messageId=-1]], references=[]] for criteria=[org.ldaptive.auth.AuthenticationCriteria@985076411::dn=uid=sriebeling,ou=People,dc=imib,dc=rwth-aachen,dc=de, authenticationRequest=[org.ldaptive.auth.AuthenticationRequest@2130978129::user=sriebeling,
retAttrs=[uid, sn]]]<br>
2017-08-08 22:19:14,572 - INFO [org.ldaptive.auth.Authenticator:259] - Authentication succeeded for dn: uid=sriebeling,ou=People,dc=imib,dc=rwth-aachen,dc=de<br>
2017-08-08 22:19:14,582 - DEBUG [org.ldaptive.auth.Authenticator:284] - authenticate response=[org.ldaptive.auth.AuthenticationHandlerResponse@581021354::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@1499402788::config=[org.ldaptive.ConnectionConfig@1096617956::ldapUrl=ldap://sso-med.imib.rwth-aachen.de,
connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@1357220224::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@3f006a4c, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null],
useSSL=false, useStartTLS=true, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory@393331654::metadata=[ldapUrl=ldap://sso-med.imib.rwth-aachen.de, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000,
java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1233208020::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@132edfd8,
controlProcessor=org.ldaptive.provider.ControlProcessor@4ba1b395, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null], sslSocketFactory=[org.ldaptive.ssl.TLSSocketFactory@864542371::factory=sun.security.ssl.SSLSocketFactoryImpl@2a7144e6,
sslConfig=[org.ldaptive.ssl.SslConfig@1357220224::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@3f006a4c, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null]], hostnameVerifier=null],
providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection@6925249e], result=true, resultCode=SUCCESS, message=null, controls=null] for dn=uid=sriebeling,ou=People,dc=imib,dc=rwth-aachen,dc=de with request=[org.ldaptive.auth.AuthenticationRequest@2130978129::user=sriebeling,
retAttrs=[uid, sn]]<br>
2017-08-08 22:19:14,587 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:139] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'sriebeling' succeeded<br>
2017-08-08 22:19:15,984 - DEBUG [org.ldaptive.ssl.AggregateTrustManager:129] - checkServerTrusted for sun.security.ssl.X509TrustManagerImpl@6be04c2f succeeded<br>
2017-08-08 22:19:15,984 - DEBUG [org.ldaptive.ssl.AggregateTrustManager:157] - invoking getAcceptedIssuers invoked for sun.security.ssl.X509TrustManagerImpl@6be04c2f
<p><br>
</p>
<p><br>
</p>
<p>My <strong>ldap.properties:</strong></p>
<p>## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator<br>
idp.authn.LDAP.authenticator = anonSearchAuthenticator<br>
<br>
## Connection properties ##<br>
idp.authn.LDAP.ldapURL = ldap://sso-med.imib.rwth-aachen.de<br>
idp.authn.LDAP.useStartTLS = true<br>
idp.authn.LDAP.useSSL = false<br>
#idp.authn.LDAP.connectTimeout = 3000<br>
<br>
## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust<br>
idp.authn.LDAP.sslConfig = certificateTrust<br>
## If using certificateTrust above, set to the trusted certificate's path<br>
idp.authn.LDAP.trustCertificates = /etc/ssl/private/sso-med-zert.pem<br>
#idp.authn.LDAP.trustCertificates = /home/sriebeling/ldap/ssl/sso-med1-zert.pem<br>
## If using keyStoreTrust above, set to the truststore path<br>
#idp.authn.LDAP.trustStore = %{idp.home}/credentials/ldap-server.truststore<br>
<br>
## Return attributes during authentication<br>
## NOTE: there is a separate property used for attribute resolution<br>
#idp.authn.LDAP.returnAttributes = passwordExpirationTime,loginGraceRemaining<br>
idp.authn.LDAP.returnAttributes = uid,sn<br>
<br>
<br>
## DN resolution properties ##<br>
<br>
# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator<br>
# for AD: CN=Users,DC=example,DC=org<br>
idp.authn.LDAP.baseDN = ou=People,dc=imib,dc=rwth-aachen,dc=de<br>
idp.authn.LDAP.subtreeSearch = true<br>
idp.authn.LDAP.userFilter = (uid={user})<br>
# bind search configuration<br>
# for AD: idp.authn.LDAP.bindDN=adminuser@domain.com<br>
idp.authn.LDAP.bindDN = cn=admin,dc=imib,dc=rwth-aachen,dc=de<br>
idp.authn.LDAP.bindDNCredential = secret<br>
<br>
# Format DN resolution, used by directAuthenticator, adAuthenticator<br>
# for AD use idp.authn.LDAP.dnFormat=%s@domain.com<br>
idp.authn.LDAP.dnFormat = uid=%s,ou=people,dc=example,dc=org<br>
<br>
# LDAP attribute configuration, see attribute-resolver.xml<br>
# Note, this likely won't apply to the use of legacy V2 resolver configurations<br>
idp.attribute.resolver.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL}<br>
idp.attribute.resolver.LDAP.baseDN = %{idp.authn.LDAP.baseDN:undefined}<br>
idp.attribute.resolver.LDAP.bindDN = %{idp.authn.LDAP.bindDN:undefined}<br>
idp.attribute.resolver.LDAP.bindDNCredential = %{idp.authn.LDAP.bindDNCredential:undefined}<br>
idp.attribute.resolver.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true}<br>
idp.attribute.resolver.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates:undefined}<br>
idp.attribute.resolver.LDAP.searchFilter = (uid=$resolutionContext.principal)<br>
idp.attribute.resolver.LDAP.returnAttributes = *+<br>
<br>
</p>
<p><br>
</p>
<p>My <strong>attribute-filter</strong>:</p>
<p><AttributeFilterPolicy id="SSOMED"><br>
<PolicyRequirementRule xsi:type="Requester" value="https://sso-med1.imib.rwth-aachen.de/shibboleth" /><br>
<br>
<AttributeRule attributeID="uid"><br>
<PermitValueRule xsi:type="ANY" /><br>
</AttributeRule></p>
<p><br>
</p>
<p><br>
<AttributeRule attributeID="sn"><br>
<PermitValueRule xsi:type="ANY" /><br>
</AttributeRule><br>
</AttributeFilterPolicy><br>
<br>
</p>
<p><br>
</p>
<p>parts of my <strong>attribute-resolver</strong>:</p>
<p><br>
</p>
<p> <resolver:AttributeDefinition id="uid" xsi:type="ad:Simple" sourceAttributeID="uid"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" encodeType="false" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" encodeType="false" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="sn" sourceAttributeID="sn"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:sn" encodeType="false" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" encodeType="false" /><br>
</resolver:AttributeDefinition><br>
<br>
</p>
<p><br>
</p>
<p><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br>
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br>
baseDN="baseDN="%{idp.attribute.resolver.LDAP.baseDN}"<br>
principal="%{idp.attribute.resolver.LDAP.bindDN}"<br>
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br>
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"><br>
<dc:FilterTemplate><br>
<![CDATA[<br>
%{idp.attribute.resolver.LDAP.searchFilter}<br>
]]><br>
</dc:FilterTemplate><br>
<dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes><br>
<dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked"><br>
<sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate><br>
</dc:StartTLSTrustCredential><br>
</resolver:DataConnector><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
</body>
</html>