<div dir="ltr"><div dir="ltr"><div dir="ltr">Hi All,<div>Error generated while configuring AD with Shibboleth IdP version 3:</div><div><div>2018-12-03 17:48:58,285 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'tanujg' succeeded</div><div>2018-12-03 17:48:58,938 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[org.ldaptive.SearchRequest@1559215280::baseDn=ou=M***,dc=m***,dc=m***,dc=n***, searchFilter=[org.ldaptive.SearchFilter@-1909578509::filter=(sAMAccountName=tanujg), parameters={}], returnAttributes=[mail, sn, cn], searchScope=SUBTREE, timeLimit=3000, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=[[org.ldaptive.handler.DnAttributeEntryHandler@-1580910376::dnAttributeName=entryDN, addIfExists=false]], searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@1998378069::config=[org.ldaptive.ConnectionConfig@1978747221::ldapUrl=ldap://localhost:389, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig@74209876::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2@4de95b72, trustManagers=null, hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@1527862708::metadata=[ldapUrl=ldap:/localhost:389, count=1], environment={java.naming.referral=follow, com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, com.sun.jndi.ldap.read.timeout=3000}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@117730519::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={java.naming.referral=follow}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiveConnectionStrategy@7959c753, controlProcessor=org.ldaptive.provider.ControlProcessor@68760a51, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@391b5e1e]</div><div>2018-12-03 17:48:58,950 - DEBUG [org.ldaptive.provider.jndi.NamingExceptionUtils:358] - naming exception class javax.naming.NamingException is ambiguous, maps to multiple result codes: [OPERATIONS_ERROR, ALIAS_PROBLEM, ALIAS_DEREFERENCING_PROBLEM, LOOP_DETECT, AFFECTS_MULTIPLE_DSAS, OTHER]</div><div>2018-12-03 17:48:58,955 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:299] - Profile Action ResolveAttributes: Error resolving attributes</div><div>net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector 'myLDAP': Unable to execute LDAP search</div><div>        at net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector.retrieveAttributes(LDAPDataConnector.java:208)</div><div>Caused by: org.ldaptive.LdapException: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C090A4C, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v3839^@]; remaining name 'ou=M***,dc=m***,dc=m***,dc=n***'</div><div>        at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)</div><div>Caused by: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C090A4C, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v3839^@]</div><div>        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3194)</div></div><div><br></div><div><br></div><div>ldap properties :</div><div><div>idp.authn.LDAP.authenticator                   = adAuthenticator</div><div>idp.authn.LDAP.ldapURL                          = ldap://localhost:389</div><div>idp.authn.LDAP.useStartTLS                      = false</div><div>idp.authn.LDAP.useSSL                           = false</div><div>idp.authn.LDAP.baseDN                           = ou=M***,dc=m***,dc=m***,dc=n***</div><div>idp.authn.LDAP.subtreeSearch                    = true</div><div>idp.authn.LDAP.userFilter                       = (sAMAccountName={user})</div><div>idp.authn.LDAP.bindDN = **@m**.m**.n**</div><div>idp.authn.LDAP.bindDNCredential                 = RJ14yd89@1</div><div>idp.authn.LDAP.dnFormat=%s@m**.m**.n**</div><div>idp.attribute.resolver.LDAP.searchFilter        = (sAMAccountName=$resolutionContext.principal)</div><div>idp.attribute.resolver.LDAP.returnAttributes    = mail,sn,cn</div><div><br></div><div>attribute-resolver dataconnector:</div><div><br></div><div> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory" </div><div>        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"</div><div>        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"></div><div>     <dc:FilterTemplate> %{idp.attribute.resolver.LDAP.searchFilter}</dc:FilterTemplate></div><div>     <dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes></div><div>     <dc:LDAPProperty name="java.naming.referral" value="follow"/></div><div>       </div><div>    </resolver:DataConnector></div></div><div><br></div><div><br></div><div><br></div></div></div></div>