<div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi Daniel:</div><div><br></div><div>Thank you for your help.<br></div><div><br></div><div><span class="gmail-im"><div>>Did you wire the authentication response handler to the authenticator?</div></span></div><div>I hadn't, I am not 100% where to do so. <br></div><div><br></div><div>Can there be 2 of these?<br></div><div> <bean id="authHandler"
class="org.ldaptive.auth.PooledBindAuthenticationHandler"
p:connectionFactory-ref="bindPooledConnectionFactory" /></div><div><br></div><div>The below is my 'ldap-authn-config.xml' -- <br></div><div><br></div><div><?xml version="1.0" encoding="UTF-8"?><br><beans xmlns="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a>" xmlns:context="<a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a>"<br> xmlns:util="<a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a>" xmlns:p="<a href="http://www.springframework.org/schema/p">http://www.springframework.org/schema/p</a>" xmlns:c="<a href="http://www.springframework.org/schema/c">http://www.springframework.org/schema/c</a>"<br> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<br> xsi:schemaLocation="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a> <a href="http://www.springframework.org/schema/beans/spring-beans.xsd">http://www.springframework.org/schema/beans/spring-beans.xsd</a><br> <a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a> <a href="http://www.springframework.org/schema/context/spring-context.xsd">http://www.springframework.org/schema/context/spring-context.xsd</a><br> <a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a> <a href="http://www.springframework.org/schema/util/spring-util.xsd">http://www.springframework.org/schema/util/spring-util.xsd</a>"<br><br> default-init-method="initialize"<br> default-destroy-method="destroy"<br> default-lazy-init="true"><br><br> <alias name="%{idp.authn.LDAP.authenticator:anonSearchAuthenticator}" alias="shibboleth.authn.LDAP.authenticator" /><br> <bean id="shibboleth.authn.LDAP.returnAttributes" parent="shibboleth.CommaDelimStringArray"><br> <constructor-arg type="java.lang.String" value="%{idp.authn.LDAP.returnAttributes:1.1}" /><br> </bean><br><br> <alias name="ValidateUsernamePasswordAgainstLDAP" alias="ValidateUsernamePassword" /><br><br> <!-- Connection Configuration --><br> <bean id="connectionConfig" class="org.ldaptive.ConnectionConfig" abstract="true" p:ldapUrl="%{idp.authn.LDAP.ldapURL}"<br> p:useStartTLS="%{idp.authn.LDAP.useStartTLS:true}"<br> p:useSSL="%{idp.authn.LDAP.useSSL:false}"<br> p:connectTimeoutDuration="%{idp.authn.LDAP.connectTimeout:PT3S}"<br> p:responseTimeoutDuration="%{idp.authn.LDAP.responseTimeout:PT3S}"<br> p:sslConfig-ref="sslConfig" /><br><br> <alias name="%{idp.authn.LDAP.sslConfig:certificateTrust}" alias="sslConfig" /><br><br> <bean id="jvmTrust" class="org.ldaptive.ssl.SslConfig" /><br> <bean id="certificateTrust" class="org.ldaptive.ssl.SslConfig"><br> <property name="credentialConfig"><br> <bean parent="shibboleth.X509ResourceCredentialConfig" p:trustCertificates="%{idp.authn.LDAP.trustCertificates:undefined}" /> <br> </property><br> </bean><br> <bean id="keyStoreTrust" class="org.ldaptive.ssl.SslConfig"><br> <property name="credentialConfig"><br> <bean parent="shibboleth.KeystoreResourceCredentialConfig" p:truststore="%{idp.authn.LDAP.trustStore:undefined}" /> <br> </property><br> </bean><br><br> <!-- Authentication handler --><br> <bean id="authHandler" class="org.ldaptive.auth.PooledBindAuthenticationHandler" p:connectionFactory-ref="bindPooledConnectionFactory" /><br> <bean id="bindPooledConnectionFactory" class="org.ldaptive.pool.PooledConnectionFactory" p:connectionPool-ref="bindConnectionPool" /><br> <bean id="bindConnectionPool" class="org.ldaptive.pool.BlockingConnectionPool" parent="connectionPool"<br> p:connectionFactory-ref="bindConnectionFactory" p:name="bind-pool" /><br> <bean id="bindConnectionFactory" class="org.ldaptive.DefaultConnectionFactory" p:connectionConfig-ref="bindConnectionConfig" /><br> <bean id="bindConnectionConfig" parent="connectionConfig" /><br><br> <!-- Format DN resolution --><br> <bean id="formatDnResolver" class="org.ldaptive.auth.FormatDnResolver" p:format="%{idp.authn.LDAP.dnFormat:undefined}" /><br><br> <!-- Pool Configuration --><br> <bean id="connectionPool" class="org.ldaptive.pool.BlockingConnectionPool" abstract="true"<br> p:blockWaitTimeDuration="%{idp.pool.LDAP.blockWaitTime:PT3S}"<br> p:poolConfig-ref="poolConfig"<br> p:pruneStrategy-ref="pruneStrategy"<br> p:validator-ref="searchValidator"<br> p:failFastInitialize="%{idp.pool.LDAP.failFastInitialize:false}" /><br> <bean id="poolConfig" class="org.ldaptive.pool.PoolConfig"<br> p:minPoolSize="%{idp.pool.LDAP.minSize:3}"<br> p:maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<br> p:validateOnCheckOut="%{idp.pool.LDAP.validateOnCheckout:false}"<br> p:validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<br> p:validatePeriodDuration="%{idp.pool.LDAP.validatePeriod:PT5M}" /><br> <bean id="pruneStrategy" class="org.ldaptive.pool.IdlePruneStrategy"<br> p:prunePeriodDuration="%{idp.pool.LDAP.prunePeriod:PT5M}"<br> p:idleTimeDuration="%{idp.pool.LDAP.idleTime:PT10M}" /><br> <bean id="searchValidator" class="org.ldaptive.pool.SearchValidator" /><br><br> <!-- Anonymous Search Configuration --><br> <bean name="anonSearchAuthenticator" class="org.ldaptive.auth.Authenticator" p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}"><br> <constructor-arg index="0" ref="anonSearchDnResolver" /><br> <constructor-arg index="1" ref="authHandler" /><br> </bean><br> <bean id="anonSearchDnResolver" class="net.shibboleth.idp.authn.PooledTemplateSearchDnResolver"<br> p:baseDn="#{'%{idp.authn.LDAP.baseDN:undefined}'.trim()}"<br> p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}"<br> p:connectionFactory-ref="anonSearchPooledConnectionFactory" ><br> <constructor-arg index="0" ref="shibboleth.VelocityEngine" /><br> <constructor-arg index="1" value="#{'%{idp.authn.LDAP.userFilter:undefined}'.trim()}" /><br> </bean><br> <bean id="anonSearchPooledConnectionFactory" class="org.ldaptive.pool.PooledConnectionFactory"<br> p:connectionPool-ref="anonSearchConnectionPool" /><br> <bean id="anonSearchConnectionPool" class="org.ldaptive.pool.BlockingConnectionPool" parent="connectionPool"<br> p:connectionFactory-ref="anonSearchConnectionFactory" p:name="search-pool" /><br> <bean id="anonSearchConnectionFactory" class="org.ldaptive.DefaultConnectionFactory" p:connectionConfig-ref="anonSearchConnectionConfig" /><br> <bean id="anonSearchConnectionConfig" parent="connectionConfig" /><br><br> <!-- Bind Search Configuration --><br> <bean name="bindSearchAuthenticator" class="org.ldaptive.auth.Authenticator" p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}"><br> <constructor-arg index="0" ref="bindSearchDnResolver" /><br> <constructor-arg index="1" ref="authHandler" /><br> </bean><br> <bean id="bindSearchDnResolver" class="net.shibboleth.idp.authn.PooledTemplateSearchDnResolver"<br> p:baseDn="#{'%{idp.authn.LDAP.baseDN:undefined}'.trim()}"<br> p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}"<br> p:connectionFactory-ref="bindSearchPooledConnectionFactory" ><br> <constructor-arg index="0" ref="shibboleth.VelocityEngine" /><br> <constructor-arg index="1" value="#{'%{idp.authn.LDAP.userFilter:undefined}'.trim()}" /><br> </bean><br> <bean id="bindSearchPooledConnectionFactory" class="org.ldaptive.pool.PooledConnectionFactory"<br> p:connectionPool-ref="bindSearchConnectionPool" /><br> <bean id="bindSearchConnectionPool" class="org.ldaptive.pool.BlockingConnectionPool" parent="connectionPool"<br> p:connectionFactory-ref="bindSearchConnectionFactory" p:name="search-pool" /><br> <bean id="bindSearchConnectionFactory" class="org.ldaptive.DefaultConnectionFactory" p:connectionConfig-ref="bindSearchConnectionConfig" /><br> <bean id="bindSearchConnectionConfig" parent="connectionConfig" p:connectionInitializer-ref="bindConnectionInitializer" /><br> <bean id="bindConnectionInitializer" class="org.ldaptive.BindConnectionInitializer"<br> p:bindDn="#{'%{idp.authn.LDAP.bindDN:undefined}'.trim()}"><br> <property name="bindCredential"><br> <bean class="org.ldaptive.Credential"><br> <constructor-arg value="%{idp.authn.LDAP.bindDNCredential:undefined}" /><br> </bean><br> </property><br> </bean><br><br> <!-- Direct Search Configuration --><br> <bean name="directAuthenticator" class="org.ldaptive.auth.Authenticator" p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}"><br> <constructor-arg index="0" ref="formatDnResolver" /><br> <constructor-arg index="1" ref="authHandler" /><br> </bean><br><br> <!-- Want to use ppolicy? Configure support by adding <bean id="authenticationResponseHandler" class="org.ldaptive.auth.ext.PasswordPolicyAuthenticationResponseHandler" <br> /> add p:authenticationResponseHandlers-ref="authenticationResponseHandler" to the authenticator <bean id="authenticationControl" <br> class="org.ldaptive.control.PasswordPolicyControl" /> add p:authenticationControls-ref="authenticationControl" to the authHandler --><br><br> <!-- Active Directory Configuration --><br> <bean id="adAuthenticator" class="org.ldaptive.auth.Authenticator" p:authenticationResponseHandlers-ref="authenticationResponseHandler"<br> p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}"><br> <constructor-arg index="0" ref="formatDnResolver" /><br> <constructor-arg index="1" ref="authHandler" /><br> </bean><br> <!-- <bean id="authenticationResponseHandler" class="org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler" /> --><br> <br> <bean id="authenticationResponseHandler" class="org.ldaptive.auth.ext.FreeIPAAuthenticationResponseHandler" ><br> <constructor-arg value="0" /><br> <constructor-arg value="0" /><br> <constructor-arg value="0" /><br> </bean><br><br></beans><br><br></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Nov 6, 2018 at 12:35 PM Daniel Fisher <<a href="mailto:dfisher@vt.edu">dfisher@vt.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_quote"><div dir="ltr">On Tue, Nov 6, 2018 at 3:21 PM Lille M <<a href="mailto:lillemacdoe@gmail.com" target="_blank">lillemacdoe@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Thank you Daniel and Scott.</div><div><br></div><div>I have inserted into 'ldap-authn-config.xml' and 'password-authn-config.xml' the entries below --- however, still receiving '<span class="m_-6201650270072252424gmail-m_-8907510996825278831gmail-login_error">Login Failure:
javax.naming.OperationNotSupportedException: [LDAP: error code 53 -
Account inactivated. Contact system administrator.]</span>
' messaging --- the logs are at end of email. Have I missed anything -- it would seem resultCode is '<b>UNWILLING_TO_PERFORM</b>' --- and that would trigger the 'AccountLocked' flow.<br></div></div></div></div></div></blockquote><div><br></div><div>Did you wire the authentication response handler to the authenticator?</div><div>Whichever authenticator you're using needs the following property:</div><div>p:authenticationResponseHandlers-ref="authenticationResponseHandler"</div><div><br></div><div>--Daniel Fisher</div><div><br></div></div></div></div></div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>