<div dir="ltr"><div>Earlier error:<br>org.ldaptive.LdapException: javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials] at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)<br>Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials] at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3136)<br>2017-09-16 12:44:57,470 - WARN [org.ldaptive.pool.BlockingConnectionPool:600] - unable to create active connection2017-09-16 12:44:57,470 - ERROR [org.ldaptive.pool.BlockingConnectionPool:197] - Could not service check out request<br>2017-09-16 12:44:57,472 - ERROR [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.ConnectionFactoryValidator:152] - Connection factory validation failed<br>org.ldaptive.pool.PoolExhaustedException: Pool is empty and connection creation failed at org.ldaptive.pool.BlockingConnectionPool.getConnection(BlockingConnectionPool.java:198)<br>2017-09-16 12:44:57,473 - ERROR [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector:145] - Data Connector 'myLDAP': Invalid connector configuration<br><br><br></div>attribute-resolver.xml like this:<br><br><div><?xml version="1.0" encoding="UTF-8"?><br><AttributeResolver<br> xmlns="urn:mace:shibboleth:2.0:resolver"<br> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" <br> xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver <a href="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd</a>"><br> <AttributeDefinition id="eduPersonPrincipalName" xsi:type="Prescoped" sourceAttributeID="eduPersonPrincipalName"><br> <Dependency ref="myLDAP" /><br> <AttributeEncoder xsi:type="SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" encodeType="false" /><br> </AttributeDefinition><br> <AttributeDefinition id="uid" xsi:type="Simple" sourceAttributeID="uid"><br> <Dependency ref="myLDAP" /><br> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:uid" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" encodeType="false" /><br> </AttributeDefinition><br> <AttributeDefinition id="mail" xsi:type="Simple" sourceAttributeID="mail"><br> <Dependency ref="myLDAP" /><br> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" /><br> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" /><br> </AttributeDefinition> <br> <DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:false}"<br> connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"<br> responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"><br> <FilterTemplate><br> <![CDATA[<br> %{idp.attribute.resolver.LDAP.searchFilter}<br> ]]><br> </FilterTemplate><br> <ConnectionPool<br> minPoolSize="%{idp.pool.LDAP.minSize:0}"<br> maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<br> blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<br> validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<br> validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT3S}"<br> expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"<br> failFastInitialize="%{idp.pool.LDAP.failFastInitialize:false}" /><br> </DataConnector><br></AttributeResolver><br><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Sep 16, 2017 at 9:30 PM, <span dir="ltr"><<a href="mailto:users-request@shibboleth.net" target="_blank">users-request@shibboleth.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Send users mailing list submissions to<br>
<a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="http://shibboleth.net/mailman/listinfo/users" rel="noreferrer" target="_blank">http://shibboleth.net/mailman/<wbr>listinfo/users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:users-request@shibboleth.net">users-request@shibboleth.net</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:users-owner@shibboleth.net">users-owner@shibboleth.net</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. LDAP configuration with shibboleth Idp (Selin R)<br>
2. RE: LDAP configuration with shibboleth Idp (Rod Widdowson)<br>
3. Re: LDAP Integration Error (Peter Schober)<br>
<br>
<br>
------------------------------<wbr>------------------------------<wbr>----------<br>
<br>
Message: 1<br>
Date: Sat, 16 Sep 2017 20:03:24 +0530<br>
From: Selin R <<a href="mailto:selinr9982@gmail.com">selinr9982@gmail.com</a>><br>
To: <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
Subject: LDAP configuration with shibboleth Idp<br>
Message-ID:<br>
<<a href="mailto:CAMN5t_cJEM2UnmfgULgeaYDt3JHy2F-PaA8Pd0q7irZX1s097A@mail.gmail.com">CAMN5t_<wbr>cJEM2UnmfgULgeaYDt3JHy2F-<wbr>PaA8Pd0q7irZX1s097A@mail.<wbr>gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
I got following error while integrate LDAP with Shibboleth:<br>
<br>
<br>
*net.shibboleth.utilities.<wbr>java.support.service.<wbr>ServiceException:<br>
org.springframework.beans.<wbr>factory.BeanCreationException: Error creating<br>
bean with name 'myLDAP': Invocation of init method failed; nested exception<br>
is<br>
net.shibboleth.utilities.java.<wbr>support.component.<wbr>ComponentInitializationExcepti<wbr>on:<br>
Data Connector 'myLDAP': Invalid connector configuration<br>
org.springframework.beans.<wbr>factory.BeanCreationException: Error creating<br>
bean with name 'shibboleth.metrics.<wbr>RegisterMetricSets$child#0' defined in<br>
file [/opt/shibboleth-idp/system/<wbr>conf/../../conf/admin/metrics.<wbr>xml]: Cannot<br>
resolve reference to bean 'shibboleth.metrics.<wbr>AttributeResolverGaugeSet'<br>
while setting bean property 'arguments' with key [7]; nested exception is<br>
org.springframework.beans.<wbr>factory.BeanCreationException: Error creating<br>
bean with name 'shibboleth.metrics.<wbr>AttributeResolverGaugeSet' defined in<br>
file [/opt/shibboleth-idp/system/<wbr>conf/general-admin-system.xml]<wbr>: Invocation<br>
of init method failed; nested exception is<br>
net.shibboleth.utilities.java.<wbr>support.component.<wbr>ComponentInitializationExcepti<wbr>on:<br>
Injected service was null or not an AttributeResolver *<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
*attribute-resolver.xml<?xml version="1.0" encoding="UTF-8"?><br>
<AttributeResolver xmlns="urn:mace:shibboleth:2.<wbr>0:resolver"<br>
xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" rel="noreferrer" target="_blank">http://www.w3.org/<wbr>2001/XMLSchema-instance</a>"<br>
<<a href="http://www.w3.org/2001/XMLSchema-instance%22" rel="noreferrer" target="_blank">http://www.w3.org/2001/<wbr>XMLSchema-instance%22</a>><br>
xsi:schemaLocation="urn:mace:<wbr>shibboleth:2.0:resolver<br>
<a href="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd" rel="noreferrer" target="_blank">http://shibboleth.net/schema/<wbr>idp/shibboleth-attribute-<wbr>resolver.xsd</a>"><br>
<<a href="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd%22%3E" rel="noreferrer" target="_blank">http://shibboleth.net/schema/<wbr>idp/shibboleth-attribute-<wbr>resolver.xsd%22%3E</a>><?xml<br>
version="1.0" encoding="UTF-8"?> <AttributeResolver<br>
xmlns="urn:mace:shibboleth:2.<wbr>0:resolver"<br>
xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" rel="noreferrer" target="_blank">http://www.w3.org/<wbr>2001/XMLSchema-instance</a>"<br>
<<a href="http://www.w3.org/2001/XMLSchema-instance%22" rel="noreferrer" target="_blank">http://www.w3.org/2001/<wbr>XMLSchema-instance%22</a>><br>
xsi:schemaLocation="urn:mace:<wbr>shibboleth:2.0:resolver<br>
<a href="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd" rel="noreferrer" target="_blank">http://shibboleth.net/schema/<wbr>idp/shibboleth-attribute-<wbr>resolver.xsd</a>"><br>
<<a href="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd%22%3E" rel="noreferrer" target="_blank">http://shibboleth.net/schema/<wbr>idp/shibboleth-attribute-<wbr>resolver.xsd%22%3E</a>><br>
<AttributeDefinition id="eduPersonPrincipalName" xsi:type="Prescoped"<br>
sourceAttributeID="<wbr>eduPersonPrincipalName"> <Dependency ref="myLDAP"<br>
/> <AttributeEncoder xsi:type="SAML1ScopedString"<br>
name="urn:mace:dir:attribute-<wbr>def:eduPersonPrincipalName" encodeType="false"<br>
/> <AttributeEncoder xsi:type="SAML2ScopedString"<br>
name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.6"<br>
friendlyName="<wbr>eduPersonPrincipalName" encodeType="false" /><br>
</AttributeDefinition> <AttributeDefinition id="uid" xsi:type="Simple"<br>
sourceAttributeID="uid"> <Dependency ref="myLDAP" /><br>
<AttributeEncoder xsi:type="SAML1String"<br>
name="urn:mace:dir:attribute-<wbr>def:uid" encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2String"<br>
name="urn:oid:0.9.2342.<wbr>19200300.100.1.1" friendlyName="uid"<br>
encodeType="false" /> </AttributeDefinition> <AttributeDefinition<br>
id="mail" xsi:type="Simple" sourceAttributeID="mail"> <Dependency<br>
ref="myLDAP" /> <AttributeEncoder xsi:type="SAML1String"<br>
name="urn:mace:dir:attribute-<wbr>def:mail" encodeType="false" /><br>
<AttributeEncoder xsi:type="SAML2String"<br>
name="urn:oid:0.9.2342.<wbr>19200300.100.1.3" friendlyName="mail"<br>
encodeType="false" /> </AttributeDefinition> <DataConnector<br>
id="myLDAP" xsi:type="LDAPDirectory"<br>
ldapURL="%{idp.attribute.<wbr>resolver.LDAP.ldapURL}"<br>
baseDN="%{idp.attribute.<wbr>resolver.LDAP.baseDN}"<br>
principal="%{idp.attribute.<wbr>resolver.LDAP.bindDN}"<br>
principalCredential="%{idp.<wbr>attribute.resolver.LDAP.<wbr>bindDNCredential}"<br>
useStartTLS="%{idp.attribute.<wbr>resolver.LDAP.useStartTLS:<wbr>false}"<br>
connectTimeout="%{idp.<wbr>attribute.resolver.LDAP.<wbr>connectTimeout}"<br>
responseTimeout="%{idp.<wbr>attribute.resolver.LDAP.<wbr>responseTimeout}"><br>
<FilterTemplate> *<br>
<br>
<![CDATA[<br>
%{idp.attribute.resolver.LDAP.<wbr>searchFilter}<br>
]]><br>
<br>
<br>
</FilterTemplate><br>
<ConnectionPool<br>
minPoolSize="%{idp.pool.LDAP.<wbr>minSize:0}"<br>
maxPoolSize="%{idp.pool.LDAP.<wbr>maxSize:10}"<br>
blockWaitTime="%{idp.pool.<wbr>LDAP.blockWaitTime:PT3S}"<br>
validatePeriodically="%{idp.<wbr>pool.LDAP.<wbr>validatePeriodically:true}"<br>
<br>
validateTimerPeriod="%{idp.<wbr>pool.LDAP.validatePeriod:PT3S}<wbr>"<br>
expirationTime="%{idp.pool.<wbr>LDAP.idleTime:PT10M}"<br>
failFastInitialize="%{idp.<wbr>pool.LDAP.failFastInitialize:<wbr>false}"<br>
/><br>
</DataConnector><br>
</AttributeResolver><br>
<br>
*ldap.properties*<br>
idp.authn.LDAP.authenticator = anonSearchAuthenticator<br>
idp.authn.LDAP.ldapURL = ldap://localhost:389<br>
<br>
idp.authn.LDAP.useStartTLS = false<br>
idp.authn.LDAP.useSSL = false<br>
<br>
<br>
idp.authn.LDAP.<wbr>returnAttributes =<br>
passwordExpirationTime,<wbr>loginGraceRemaining<br>
<br>
<br>
<br>
idp.authn.LDAP.baseDN = ou=Staff,dc=##,dc=#,dc=#<br>
#idp.authn.LDAP.subtreeSearch = false<br>
idp.authn.LDAP.userFilter = (uid={user})<br>
# for AD: idp.authn.LDAP.bindDN=<a href="mailto:adminuser@domain.com">adminuse<wbr>r@domain.com</a><br>
idp.authn.LDAP.bindDN = uid=#,ou=Staff<br>
idp.authn.LDAP.<wbr>bindDNCredential = #<br>
<br>
idp.authn.LDAP.dnFormat =<br>
cn=%s,ou=Staff,dc=#,dc=#,dc=#<br>
idp.attribute.resolver.LDAP.<wbr>returnAttributes = uid,mail<br>
<br>
idp.attribute.resolver.LDAP.<wbr>ldapURL = %{idp.authn.LDAP.ldapURL}<br>
idp.attribute.resolver.LDAP.<wbr>baseDN =<br>
%{idp.authn.LDAP.baseDN:<wbr>undefined}<br>
<br>
idp.attribute.resolver.LDAP.<wbr>bindDN =<br>
%{idp.authn.LDAP.bindDN:<wbr>undefined}<br>
<br>
idp.attribute.resolver.LDAP.<wbr>bindDNCredential =<br>
%{idp.authn.LDAP.<wbr>bindDNCredential:undefined}<br>
<br>
idp.attribute.resolver.LDAP.<wbr>useStartTLS =<br>
%{idp.authn.LDAP.useStartTLS:<wbr>false}<br>
idp.attribute.resolver.LDAP.<wbr>searchFilter =<br>
(uid=$requestContext.<wbr>principal)<br>
<br>
idp.attribute.resolver.LDAP.<wbr>responseTimeout = 30000<br>
idp.attribute.resolver.LDAP.<wbr>connectTimeout = 30000<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://shibboleth.net/pipermail/users/attachments/20170916/cc0e0f84/attachment-0001.html" rel="noreferrer" target="_blank">http://shibboleth.net/<wbr>pipermail/users/attachments/<wbr>20170916/cc0e0f84/attachment-<wbr>0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Sat, 16 Sep 2017 16:20:53 +0100<br>
From: "Rod Widdowson" <<a href="mailto:rdw@steadingsoftware.com">rdw@steadingsoftware.com</a>><br>
To: "'Shib Users'" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
Subject: RE: LDAP configuration with shibboleth Idp<br>
Message-ID: <00b801d32eff$63758260$<wbr>2a608720$@<a href="http://steadingsoftware.com" rel="noreferrer" target="_blank">steadingsoftware.com</a><wbr>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
> I got following error while integrate LDAP with Shibboleth:<br>
<br>
We heard (!).<br>
<br>
> Error creating bean with name 'shibboleth.metrics.<wbr>AttributeResolverGaugeSet' defined in file [/opt/shibboleth-idp/system/<wbr>conf/general-admin-system.xml]<wbr>: Invocation of init<br>
<br>
There is a syntax error in your attribute resolver file and it failed to load. What you have reported is the damage down stream when the IdP tries to wire up a non-existant resolver configuration.<br>
<br>
Look for the (explicit) error further up the log file you'll see the error.<br>
<br>
I am having problems with your HTML but do you _really_ have two <AttributeResolver> lines in your file and two <?xml version blablabla> lines?<br>
<br>
R<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Sat, 16 Sep 2017 17:21:08 +0200<br>
From: Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>><br>
To: <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
Subject: Re: LDAP Integration Error<br>
Message-ID: <<a href="mailto:20170916152108.7domfkfz7usgb2vo@aco.net">20170916152108.<wbr>7domfkfz7usgb2vo@aco.net</a>><br>
Content-Type: text/plain; charset=us-ascii<br>
<br>
* Selin R <<a href="mailto:selinr9982@gmail.com">selinr9982@gmail.com</a>> [2017-09-16 16:33]:<br>
> net.shibboleth.utilities.java.<wbr>support.component.<wbr>ComponentInitializationExcepti<wbr>on:<br>
> Data Connector 'myLDAP': Invalid connector configuration<br>
> org.springframework.beans.<wbr>factory.BeanCreationException: Error creating<br>
> bean with name 'shibboleth.metrics.<wbr>RegisterMetricSets$child#0'<br>
<br>
Any error about the metrics subsystem usually is a side-effect of an<br>
ealier (unrelated to metrics, but related to your) error.<br>
So just look at earlier errors in the log. If you don't care about the<br>
content of your logs (i.e., this is not a production system) you can<br>
truncate your log and restart the IDP. Then look at the first WARN and<br>
ERROR you find there, fix, rinse and repeat.<br>
-peter<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
<br>
------------------------------<br>
<br>
End of users Digest, Vol 75, Issue 60<br>
******************************<wbr>*******<br>
</blockquote></div><br></div>