<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi,</p>
<p>i'm about to setup a Shibboleth IdP v3.4.4 connecting to a single
local ldap server. <br>
</p>
<p>My problem is that attribute queries are executed under the login
users account (here: zimmer) instead of the designated user (ldap
read only) in the idp.authn.LDAP.bindDN variable (here: shibidp).
<br>
</p>
<p>As the user account 'zimmer' does not have sufficient rights, it
is not allowed to search in the ldap. Both accounts can
successfully login to the ldap, though. <br>
</p>
<p>So where and how can i change the user for attribute queries (or
why isn't the account shibidp used for it)?</p>
<p><br>
</p>
<p><-------------------------------start ldap.properties
----------------------------><br>
</p>
<p>idp.authn.LDAP.authenticator =
bindSearchAuthenticator</p>
<p>idp.authn.LDAP.ldapURL =
<a class="moz-txt-link-freetext" href="ldap://somewhere.bbaw.de:389">ldap://somewhere.bbaw.de:389</a><br>
idp.authn.LDAP.useStartTLS = false<br>
idp.authn.LDAP.useSSL = false</p>
<p>idp.authn.LDAP.sslConfig = jvmTrust</p>
<p>idp.authn.LDAP.trustCertificates =
/etc/ssl/certs/T-TeleSec_GlobalRoot_Class_2.pem</p>
<p>idp.authn.LDAP.trustStore =
%{idp.home}/credentials/ldap-server.truststore</p>
<p>idp.authn.LDAP.returnAttributes = mail,uid</p>
<p>idp.authn.LDAP.baseDN =
ou=extra,dc=bbaw,dc=de<br>
idp.authn.LDAP.subtreeSearch = false<br>
idp.authn.LDAP.userFilter = (uid={user})</p>
<p>idp.authn.LDAP.bindDN =
uid=shibidp,ou=tech,dc=bbaw,dc=de<br>
idp.authn.LDAP.bindDNCredential = secret<br>
</p>
<p>idp.attribute.resolver.LDAP.ldapURL =
%{idp.authn.LDAP.ldapURL}<br>
idp.attribute.resolver.LDAP.connectTimeout =
%{idp.authn.LDAP.connectTimeout:PT3S}<br>
idp.attribute.resolver.LDAP.responseTimeout =
%{idp.authn.LDAP.responseTimeout:PT3S}<br>
idp.attribute.resolver.LDAP.baseDN =
%{idp.authn.LDAP.baseDN:undefined}<br>
idp.attribute.resolver.LDAP.bindDN =
%{idp.authn.LDAP.bindDN:undefined}<br>
idp.attribute.resolver.LDAP.bindDNCredential =
%{idp.authn.LDAP.bindDNCredential:undefined}<br>
idp.attribute.resolver.LDAP.useStartTLS =
%{idp.authn.LDAP.useStartTLS:false}<br>
idp.attribute.resolver.LDAP.trustCertificates =
%{idp.authn.LDAP.trustCertificates:undefined}<br>
idp.attribute.resolver.LDAP.searchFilter =
(uid=$resolutionContext.principal)</p>
<p><-----------------------------------end
ldap.properties-----------------------------------------------></p>
<p><br>
</p>
<p><----------------------------------start
idp-process.log----------------------------------------------><br>
</p>
<p>2019-08-08 11:12:09,103 - DEBUG
[org.ldaptive.auth.Authenticator:469] - IP:194.95.188.5 - entry
resolution failed for
resolver=[org.ldaptive.auth.SearchEntryResolver@603993194::factory=null,
baseDn=, userFilter=null, userFilterParameters=null,
allowMultipleEntries=false, subtreeSearch=false,
derefAliases=null, followReferrals=false,
searchEntryHandlers=null]<br>
org.ldaptive.LdapException: javax.naming.NameNotFoundException:
[LDAP: error code 32 - No Such Object]; remaining name
'uid=zimmer,ou=extra,dc=bbaw,dc=de'<br>
at
org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)<br>
Caused by: javax.naming.NameNotFoundException: [LDAP: error code
32 - No Such Object]<br>
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3179)</p>
<p><----------------------------------------end
idp-process.log----------------------------------------------><br>
</p>
<p><br>
</p>
<p><------------------------------start ldap
logfile-----------------------></p>
<pre class="moz-quote-pre" wrap="">Aug 8 11:12:09 ldap slapd[22766]: conn=1012 op=1 SRCH base="uid=zimmer,ou=extra,dc=bbaw,dc=de" scope=0 deref=0 filter="(objectClass=*)"
Aug 8 11:12:09 ldap slapd[22766]: conn=1012 op=1 SRCH attr=email uid givenName sn o cn
Aug 8 11:12:09 ldap slapd[22766]: ==> limits_get: conn=1012 op=1 self="uid=zimmer,ou=extra,dc=bbaw,dc=de" this="uid=zimmer,ou=extra,dc=bbaw,dc=de"
Aug 8 11:12:09 ldap slapd[22766]: => mdb_search
Aug 8 11:12:09 ldap slapd[22766]: mdb_dn2entry("uid=zimmer,ou=extra,dc=bbaw,dc=de")
Aug 8 11:12:09 ldap slapd[22766]: => mdb_dn2id("uid=zimmer,ou=extra,dc=bbaw,dc=de")
Aug 8 11:12:09 ldap slapd[22766]: <= mdb_dn2id: got id=0x135
Aug 8 11:12:09 ldap slapd[22766]: => mdb_entry_decode:
Aug 8 11:12:09 ldap slapd[22766]: <= mdb_entry_decode
Aug 8 11:12:09 ldap slapd[22766]: => access_allowed: search access to "uid=zimmer,ou=extra,dc=bbaw,dc=de" "entry" requested
Aug 8 11:12:09 ldap slapd[22766]: => dn: [2]
Aug 8 11:12:09 ldap slapd[22766]: => acl_get: [3] attr entry
Aug 8 11:12:09 ldap slapd[22766]: => acl_mask: access to entry "uid=zimmer,ou=extra,dc=bbaw,dc=de", attr "entry" requested
Aug 8 11:12:09 ldap slapd[22766]: => acl_mask: to all values by "uid=zimmer,ou=extra,dc=bbaw,dc=de", (=0)
Aug 8 11:12:09 ldap slapd[22766]: <= check a_dn_pat: uid=jaecontrol,ou=tech,dc=bbaw,dc=de
Aug 8 11:12:09 ldap slapd[22766]: <= check a_dn_pat: uid=shibidp,ou=tech,dc=bbaw,dc=de
Aug 8 11:12:09 ldap slapd[22766]: <= acl_mask: no more <who> clauses, returning =0 (stop)
Aug 8 11:12:09 ldap slapd[22766]: => slap_access_allowed: <b>search access denied</b> by =0
<----------------------------end ldap logfile ------------------------------->
</pre>
<p><br>
</p>
<p>Best regards,</p>
<p>Kai<br>
</p>
</body>
</html>