<div dir="ltr"><div dir="ltr"><div>Thanks Daniel!</div><div><br></div><div>Below is the ldap.properties file (scrubbed).<br></div><div><br></div><div><br>idp.authn.LDAP.authenticator                    = bindSearchAuthenticator<br>idp.authn.LDAP.ldapURL                          = ldaps://<a href="http://example.com">example.com</a> <br>idp.authn.LDAP.baseDN                           = ou=PEOPLE,dc=example,dc=com<br>idp.authn.LDAP.people.baseDN                     = ou=PEOPLE,ou=ORG,dc=id,dc=example,dc=com<br>idp.authn.LDAP.userFilter                       = (uid={user})<br>idp.authn.LDAP.dnFormat                         = uid=%s,ou=PEOPLE,ou=ORG,dc=id,dc=example,dc=com<br>idp.authn.LDAP.bindDN                           = uid=idp3,dc=example,dc=com <br>idp.authn.LDAP.bindDNCredential                 = scrubbed<br># new in IdP 3.2.x<br>#idp.attribute.resolver.LDAP.returnAttributes    = displayName,mail,uid<br># TLS false as ELDAP on SSL with recognized CA<br>idp.authn.LDAP.useStartTLS                      = false<br># As we are not setting trustCertificates/trustStore, switch the sslConfig to point to jvmTrust to avoid errors for broken references....<br>idp.authn.LDAP.sslConfig                        = jvmTrust<br><br># Time in milliseconds that connects will block<br>idp.authn.LDAP.connectTimeout                  = PT10S<br># Time in milliseconds to wait for responses<br>idp.authn.LDAP.responseTimeout                 = PT10S<br><br><br># LDAP pool configuration, used for both authn and DN resolution<br>idp.pool.LDAP.minSize                          = 3<br>idp.pool.LDAP.maxSize                          = 10<br>idp.pool.LDAP.validateOnCheckout               = false<br>idp.pool.LDAP.validatePeriodically             = true<br>idp.pool.LDAP.validatePeriod                   = PT5M<br>idp.pool.LDAP.prunePeriod                      = PT5M<br>idp.pool.LDAP.idleTime                         = PT10M<br>idp.pool.LDAP.blockWaitTime                    = PT3S<br>idp.pool.LDAP.failFastInitialize               = false<br><br><br># Translating to the attribute-resolver.XML files -- as this may be different from the auth config<br>idp.attribute.resolver.LDAP.ldapURL             = %{idp.authn.LDAP.ldapURL}<br>idp.attribute.resolver.LDAP.connectTimeout      = %{idp.authn.LDAP.connectTimeout}<br>idp.attribute.resolver.LDAP.responseTimeout     = %{idp.authn.LDAP.responseTimeout}<br>idp.attribute.resolver.LDAP.baseDN              = %{idp.authn.LDAP.baseDN:undefined}<br>idp.attribute.resolver.LDAP.people.baseDN        = %{idp.authn.LDAP.people.baseDN}<br>idp.attribute.resolver.LDAP.bindDN              = %{idp.authn.LDAP.bindDN}<br>idp.attribute.resolver.LDAP.bindDNCredential    = %{idp.authn.LDAP.bindDNCredential}<br>idp.attribute.resolver.LDAP.useStartTLS         = %{idp.authn.LDAP.useStartTLS:true}<br>idp.attribute.resolver.LDAP.trustCertificates   = %{idp.authn.LDAP.trustCertificates}<br>idp.attribute.resolver.LDAP.searchFilter        = (uid=$resolutionContext.principal)<br><br><br></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, Nov 6, 2018 at 1:31 PM Daniel Fisher <<a href="mailto:dfisher@vt.edu">dfisher@vt.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_quote"><div dir="ltr">On Tue, Nov 6, 2018 at 4:03 PM Lille M <<a href="mailto:lillemacdoe@gmail.com" target="_blank">lillemacdoe@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>>Did you wire the authentication response handler to the authenticator?<br></div><div>I hadn't,  I am not 100% where to do so. <br></div></div></div></div></blockquote><div><br></div><div>Can you share your ldap.properties file?</div><div><br></div><div>--Daniel Fisher</div><div> </div></div></div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>