<div dir="ltr"> Thanks.my error is solved but still i am not able to still login with valid username and <a href="http://password.it" target="_blank">password .it</a> shows wrong password for entered for valid user and password.<div><div><br></div><div><b>idp-process.log</b> contains :</div><div> <b>[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:166] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by '****' failed</b></div><div><br></div><br>please refer this ldap.properties mainly dnFormat:<br>idp.authn.LDAP.authenticator <wbr> = adAuthenticator<br><br>## Connection properties ##<br>idp.authn.LDAP.ldapURL <wbr> = ldap://<a href="http://172.16.0.2:389" target="_blank">172.16.0.2:389</a><br>idp.authn.LDAP.useStartTLS <wbr> = false<br>idp.authn.LDAP.useSSL <wbr> = false<br># Time in milliseconds that connects will block<br>idp.authn.LDAP.connectTimeout <wbr> = PT5M<br># Time in milliseconds to wait for responses<br>#idp.authn.LDAP.responseTimeou<wbr>t = PT5M<br>## Return attributes during authentication<br>idp.authn.LDAP.returnAttribute<wbr>s = passwordExpirationTime,loginGr<wbr>aceRemaining<br><br>## DN resolution properties ##<br><br># Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator<br># for AD: CN=Users,OU=Faculty,DC=****,DC<wbr>=local<br>idp.authn.LDAP.baseDN <wbr> = ou=Faculty,dc=***,dc=local<br>#idp.authn.LDAP.subtreeSearch <wbr> = false<br>idp.authn.LDAP.userFilter <wbr> = (sAMAccountName={user})<br># bind search configuration<br># for AD: idp.authn.LDAP.bindDN=<a href="mailto:adminuser@domain.com" target="_blank">adminuse<wbr>r@domain.com</a><br>idp.authn.LDAP.bindDN <wbr> = ****@Faculty.***local<br>idp.authn.LDAP.bindDNCredentia<wbr>l = *****<br><br># Format DN resolution, used by directAuthenticator, adAuthenticator<br># for AD use idp.authn.LDAP.dnFormat=%<a href="mailto:s@domain.com" target="_blank">s@dom<wbr>ain.com</a><br>idp.authn.LDAP.dnFormat <wbr> =%s@Faculty.****.local<br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 11, 2017 at 5:20 PM, <span dir="ltr"><<a href="mailto:users-request@shibboleth.net" target="_blank">users-request@shibboleth.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send users mailing list submissions to<br>
<a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://shibboleth.net/mailman/listinfo/users" rel="noreferrer" target="_blank">http://shibboleth.net/mailman/<wbr>listinfo/users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:users-request@shibboleth.net">users-request@shibboleth.net</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:users-owner@shibboleth.net">users-owner@shibboleth.net</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. shibboleth IdP configuration with active directory<br>
(vaishali prajapati)<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Mon, 11 Sep 2017 17:20:11 +0530<br>
From: vaishali prajapati <<a href="mailto:vbprajapati39@gmail.com">vbprajapati39@gmail.com</a>><br>
To: <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
Subject: shibboleth IdP configuration with active directory<br>
Message-ID:<br>
<CAMPeQxGMpQ4tdUe90s4Jk5nkn-<wbr>7Dm-YR-yZO=<a href="mailto:irK-iER%2BYFHCQ@mail.gmail.com">irK-iER+YFHCQ@mail.<wbr>gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
## Authenticator strategy, either anonSearchAuthenticator,<br>
bindSearchAuthenticator, directAuthenticator, adAuthenticator<br>
#idp.authn.LDAP.authenticator =bindSearchAuthenticator<br>
<br>
## Connection properties ##<br>
idp.authn.LDAP.ldapURL = ldap://<a href="http://172.16.0.2:389" rel="noreferrer" target="_blank">172.16.0.2:389</a><br>
#idp.authn.LDAP.useStartTLS = false<br>
#idp.authn.LDAP.useSSL = false<br>
# Time in milliseconds that connects will block<br>
#idp.authn.LDAP.connectTimeout = TS3M<br>
# Time in milliseconds to wait for responses<br>
#idp.authn.LDAP.<wbr>responseTimeout = TS3M<br>
## Return attributes during authentication<br>
idp.authn.LDAP.<wbr>returnAttributes = passwordExpirationTime,<br>
loginGraceRemaining<br>
<br>
## DN resolution properties ##<br>
<br>
# Search DN resolution, used by anonSearchAuthenticator,<br>
bindSearchAuthenticator<br>
# for AD:DN:Users,OU=***,DC=***,DC=*<wbr>**<br>
idp.authn.LDAP.baseDN = ou=***,dc=***,dc=***<br>
#idp.authn.LDAP.subtreeSearch = false<br>
idp.authn.LDAP.userFilter =(sAMAccountName={uid})<br>
# bind search configuration<br>
<br>
idp.authn.LDAP.bindDN<br>
=uid=****,ou=***,dc=***,dc=***<br>
idp.attribute.resolver.LDAP.<wbr>bindDNCredential =****<br>
# Format DN resolution, used by directAuthenticator, adAuthenticator<br>
<br>
idp.authn.LDAP.dnFormat = ou=***,dc=***,dc=***<br>
idp.attribute.resolver.LDAP.<wbr>returnAttributes =<br>
eduPersonPrincipalName,uid,<wbr>sAMAccountName<br>
# LDAP attribute configuration, see attribute-resolver.xml<br>
# Note, this likely won't apply to the use of legacy V2 resolver<br>
configurations<br>
idp.attribute.resolver.LDAP.<wbr>ldapURL = %{idp.authn.LDAP.ldapURL}<br>
idp.attribute.resolver.LDAP.<wbr>connectTimeout = %{idp.authn.LDAP.<br>
connectTimeout:300}<br>
idp.attribute.resolver.LDAP.<wbr>responseTimeout = %{idp.authn.LDAP.<br>
responseTimeout:300}<br>
idp.attribute.resolver.LDAP.<wbr>baseDN = %{idp.authn.LDAP.baseDN:<br>
undefined}<br>
idp.attribute.resolver.LDAP.<wbr>bindDN = %{idp.authn.LDAP.bindDN:<br>
undefined}<br>
idp.attribute.resolver.LDAP.<wbr>bindDNCredential = %{idp.authn.LDAP.<br>
bindDNCredential:undefined}<br>
idp.attribute.resolver.LDAP.<wbr>useStartTLS =<br>
%{idp.authn.LDAP.useStartTLS:<wbr>true}<br>
idp.attribute.resolver.LDAP.<wbr>trustCertificates = %{idp.authn.LDAP.<br>
trustCertificates:undefined}<br>
idp.attribute.resolver.LDAP.<wbr>searchFilter = (uid=$resolutionContext.<br>
principal)<br>
<br>
# LDAP pool configuration, used for both authn and DN resolution<br>
#idp.pool.LDAP.minSize = 0<br>
#idp.pool.LDAP.maxSize = 10<br>
#idp.pool.LDAP.<wbr>validateOnCheckout = false<br>
#idp.pool.LDAP.<wbr>validatePeriodically = true<br>
#idp.pool.LDAP.validatePeriod = TS5M<br>
#idp.pool.LDAP.prunePeriod = 600<br>
#idp.pool.LDAP.idleTime = 600<br>
<br>
Attribute-resolver.xml contains:<br>
<br>
<?xml version="1.0" encoding="UTF-8"?><br>
<br>
<AttributeResolver<br>
xmlns="urn:mace:shibboleth:2.<wbr>0:resolver"<br>
xmlns:sec="urn:mace:<wbr>shibboleth:2.0:security"<br>
xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" rel="noreferrer" target="_blank">http://www.w3.org/<wbr>2001/XMLSchema-instance</a>"<br>
xsi:schemaLocation="urn:mace:<wbr>shibboleth:2.0:resolver http:/<br>
/<a href="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd" rel="noreferrer" target="_blank">shibboleth.net/schema/idp/<wbr>shibboleth-attribute-resolver.<wbr>xsd</a><br>
urn:mace:shibboleth:2.0:<wbr>security<br>
<a href="http://shibboleth.net/schema/idp/shibboleth-security.xsd" rel="noreferrer" target="_blank">http://shibboleth.net/schema/<wbr>idp/shibboleth-security.xsd</a>"><br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<AttributeDefinition xsi:type="Simple" id="uid" sourceAttributeID="<br>
sAMAccountName"><br>
<Dependency ref="myLDAP" /><br>
<AttributeEncoder xsi:type="SAML1String"<br>
name="urn:mace:dir:attribute-<wbr>def:uid" encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2String"<br>
name="urn:oid:0.9.2342.<wbr>19200300.100.1.1"<br>
friendlyName="uid" encodeType="false" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple" id="mail"<br>
sourceAttributeID="mail"><br>
<Dependency ref="myLDAP" /><br>
<AttributeEncoder xsi:type="SAML1String"<br>
name="urn:mace:dir:attribute-<wbr>def:mail" encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2String"<br>
name="urn:oid:0.9.2342.<wbr>19200300.100.1.3"<br>
friendlyName="mail" encodeType="false" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple" id="organizationalUnit"<br>
sourceAttributeID="ou"><br>
<Dependency ref="myLDAP" /><br>
<AttributeEncoder xsi:type="SAML1String"<br>
name="urn:mace:dir:attribute-<wbr>def:ou" encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.11"<br>
friendlyName="ou" encodeType="false" /><br>
</AttributeDefinition><br>
<br>
<br>
<AttributeDefinition xsi:type="Simple" id="eduPersonAffiliation"<br>
sourceAttributeID="<wbr>eduPersonAffiliation"><br>
<Dependency ref="myLDAP" /><br>
<AttributeEncoder xsi:type="SAML1String"<br>
name="urn:mace:dir:attribute-<wbr>def:eduPersonAffiliation" encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2String"<br>
name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.1"<br>
friendlyName="<wbr>eduPersonAffiliation" encodeType="false" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Simple" id="eduPersonEntitlement"<br>
sourceAttributeID="<wbr>eduPersonEntitlement"><br>
<Dependency ref="myLDAP" /><br>
<AttributeEncoder xsi:type="SAML1String"<br>
name="urn:mace:dir:attribute-<wbr>def:eduPersonEntitlement" encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2String"<br>
name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.7"<br>
friendlyName="<wbr>eduPersonEntitlement" encodeType="false" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Scoped" id="eduPersonUniqueId"<br>
scope="%{idp.scope}" sourceAttributeID="<wbr>localUniqueId"><br>
<Dependency ref="myLDAP" /><br>
<AttributeEncoder xsi:type="SAML1ScopedString"<br>
name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.13" encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2ScopedString"<br>
name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.13" friendlyName="<wbr>eduPersonUniqueId"<br>
encodeType="false" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Prescoped" id="eduPersonPrincipalName"<br>
sourceAttributeID="<wbr>eduPersonPrincipalName"><br>
<Dependency ref="myLDAP" /><br>
<AttributeEncoder xsi:type="SAML1ScopedString"<br>
name="urn:mace:dir:attribute-<wbr>def:eduPersonPrincipalName" encodeType="false"<br>
/><br>
<AttributeEncoder xsi:type="SAML2ScopedString"<br>
name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.6" friendlyName="<wbr>eduPersonPrincipalName"<br>
encodeType="false" /><br>
</AttributeDefinition><br>
<br>
<AttributeDefinition xsi:type="Scoped" id="<wbr>eduPersonScopedAffiliation"<br>
scope="%{idp.scope}" sourceAttributeID="<wbr>eduPersonAffiliation"><br>
<Dependency ref="myLDAP" /><br>
<AttributeEncoder xsi:type="SAML1ScopedString"<br>
name="urn:mace:dir:attribute-<wbr>def:<wbr>eduPersonScopedAffiliation"<br>
encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2ScopedString"<br>
name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.9"<br>
friendlyName="<wbr>eduPersonScopedAffiliation"<br>
encodeType="false" /><br>
</AttributeDefinition><br>
<br>
<br>
<br>
<DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br>
ldapURL="%{idp.attribute.<wbr>resolver.LDAP.ldapURL}"<br>
baseDN="%{idp.attribute.<wbr>resolver.LDAP.baseDN}"<br>
principal="%{idp.attribute.<wbr>resolver.LDAP.bindDN}"<br>
principalCredential="%{idp.<wbr>attribute.resolver.LDAP.<br>
bindDNCredential}"<br>
useStartTLS="%{idp.attribute.<wbr>resolver.LDAP.useStartTLS:<wbr>false}"<br>
connectTimeout="%{idp.<wbr>attribute.resolver.LDAP.<wbr>connectTimeout}"<br>
responseTimeout="%{idp.<wbr>attribute.resolver.LDAP.<wbr>responseTimeout}"><br>
<FilterTemplate><br>
<br>
<br>
<![CDATA[<br>
%{idp.attribute.resolver.LDAP.<wbr>searchFilter}<br>
]]><br>
<br>
<br>
</FilterTemplate><br>
<br>
</DataConnector><br>
<br>
<br>
</AttributeResolver><br>
<br>
Error generated during login:[net.shibboleth.idp.<wbr>authn.impl.<br>
ValidateUsernamePasswordAgains<wbr>tLDAP:192] - Profile Action<br>
ValidateUsernamePasswordAgains<wbr>tLDAP: Login by shibboleth produced exception<br>
org.ldaptive.LdapException: javax.naming.NamingException: [LDAP: error code<br>
1 - 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this<br>
operation a successful bind must be completed on the connection., data 0,<br>
v1db1^@]; remaining name 'ou=***,dc=***,dc=***'<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://shibboleth.net/pipermail/users/attachments/20170911/72101968/attachment.html" rel="noreferrer" target="_blank">http://shibboleth.net/<wbr>pipermail/users/attachments/<wbr>20170911/72101968/attachment.<wbr>html</a>><br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
<br>
------------------------------<br>
<br>
End of users Digest, Vol 75, Issue 26<br>
******************************<wbr>*******<br>
</blockquote></div><br></div></div>