<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I am setting up my LDAP DataConnector using the attribute-resolver-ldap.xml as my template.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have not edited the attribute-resolver.xml except to add the DataConnector item.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Below are the settings in my ldap.properties which I have verified work with my test SP, we just aren’t passing attributes yet:<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.authenticator =adAuthenticator<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.useSSL = true<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.useStartTLS = false<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.ldapURL = ldaps://snsudc05.nsu.edu<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.sslConfig = jvmTrust<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.returnAttributes =*<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.userFilter=(sAMAccountName={user})<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This is the DataConnector in my attribute-resolver.xml :<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><DataConnector id="myLDAP" xsi:type="LDAPDirectory"<o:p></o:p></p>
<p class="MsoNormal"> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<o:p></o:p></p>
<p class="MsoNormal"> baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <o:p>
</o:p></p>
<p class="MsoNormal"> principal="%{idp.attribute.resolver.LDAP.bindDN}"<o:p></o:p></p>
<p class="MsoNormal"> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<o:p></o:p></p>
<p class="MsoNormal"> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:false}"<o:p></o:p></p>
<p class="MsoNormal"> connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"<o:p></o:p></p>
<p class="MsoNormal"> responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"><o:p></o:p></p>
<p class="MsoNormal"> <FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> <![CDATA[<o:p></o:p></p>
<p class="MsoNormal"> %{idp.attribute.resolver.LDAP.searchFilter}<o:p></o:p></p>
<p class="MsoNormal"> ]]><o:p></o:p></p>
<p class="MsoNormal"> </FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> <ConnectionPool<o:p></o:p></p>
<p class="MsoNormal"> minPoolSize="%{idp.pool.LDAP.minSize:3}"<o:p></o:p></p>
<p class="MsoNormal"> maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<o:p></o:p></p>
<p class="MsoNormal"> blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<o:p></o:p></p>
<p class="MsoNormal"> validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<o:p></o:p></p>
<p class="MsoNormal"> validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"<o:p></o:p></p>
<p class="MsoNormal"> expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"<o:p></o:p></p>
<p class="MsoNormal"> failFastInitialize="%{idp.pool.LDAP.failFastInitialize:false}" /><o:p></o:p></p>
<p class="MsoNormal"> <LDAPProperty name="java.naming.referral" value="follow"/><o:p></o:p></p>
<p class="MsoNormal"> </DataConnector><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The issue I have right now is that on start up I am getting an LDAP Pool Error with these properties:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2019-04-10 09:18:12,636 - - ERROR [org.ldaptive.pool.BlockingConnectionPool:509] - [org.ldaptive.pool.BlockingConnectionPool@1689743775::name=resolver-pool, poolConfig=[org.ldaptive.pool.PoolConfig@1095465052::minPoolSize=3, maxPoolSize=10,
validateOnCheckIn=false, validateOnCheckOut=false, validatePeriodically=true, validatePeriod=300, validateTimeout=5000], activator=null, passivator=null, validator=[org.ldaptive.pool.SearchValidator@1340123681::searchRequest=[org.ldaptive.SearchRequest@697827740::baseDn=,
searchFilter=[org.ldaptive.SearchFilter@1642584434::filter=(objectClass=*), parameters={}], returnAttributes=[1.1], searchScope=OBJECT, timeLimit=0, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null,
searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null]] pruneStrategy=[org.ldaptive.pool.IdlePruneStrategy@946350149::prunePeriod=300, idleTime=600], connectOnCreate=true, connectionFactory=[org.ldaptive.DefaultConnectionFactory@1922251979::provider=org.ldaptive.provider.unboundid.UnboundIDProvider@730e663a,
config=[org.ldaptive.ConnectionConfig@1806329661::ldapUrl=ldaps://snsudc05.nsu.edu, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig@306910057::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2@22bd6b0a, trustManagers=null,
hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@571704265::bindDn=LDAPShibTest@nsu.edu,
bindSaslConfig=null, bindControls=null]]], initialized=true, availableCount=0, activeCount=0] unable to connect to the ldap<o:p></o:p></p>
<p class="MsoNormal">org.ldaptive.LdapException: LDAPException(resultCode=49 (invalid credentials), diagnosticMessage='80090308: LdapErr: DSID-0C0903A8, comment: AcceptSecurityContext error, data 52e, v1db1 ', ldapSDKVersion=4.0.9, revision=29290)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When I was spinning up the LDAP connection originally, I had to set my useSSL to true and startTLS to false as seen in the ldap.properties file along with the keystore to pull the certificates from.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Looking in the LDAPConnector properties of the Data Connector Cofiguration page
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/LDAPConnector">https://wiki.shibboleth.net/confluence/display/IDP30/LDAPConnector</a> there does not seem to be a way to specifiy this for the LDAP dataconnector.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What would be the correct way of going about this? <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Peter Glanville</span><span style="font-size:10.0pt;color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Enterprise Infrastructure Manager<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Office of Information Technology<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Marie V. McDemmond Center for Applied Research<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">555 Park Avenue, Suite 401<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">Norfolk, Virginia 23504<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">(757) 823-8098 (Office)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">(757) 823-2128 (Fax)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black">pcglanville@nsu.edu<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:black"><a href="http://www.nsu.edu/"><span style="color:blue">www.nsu.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>