<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi David & Peter,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you for the good info. I think I need to restate my question. </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
My AD admins have a brand new auditing tool and they are trying to find a way to track user authentications on the AD side. They are going to be generating all kinds of reports to management and can't fully trust their data because it doesn't show all user
activity.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Does anyone have a Shibboleth IDP running on Linux with AD authentication that creates authentication logs in AD? If so, what kind of special hoops did you have to jump through? </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
-Chris</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div id="sig"></div>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> IAM David Bantz <dabantz@alaska.edu><br>
<b>Sent:</b> Friday, October 18, 2019 1:52 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Christopher Bland <chris@fdu.edu>; Peter Schober <peter.schober@univie.ac.at><br>
<b>Subject:</b> [External]Re: AD Shibboleth Authentication</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>I use the JAAS config to AD as well.<br>
The logger <span style="font-variant-ligatures:no-common-ligatures; color:rgb(0,0,0); font-family:Menlo; font-size:11px">org.ldaptive.auth</span><span style="font-variant-ligatures:no-common-ligatures; color:rgb(0,0,0); font-family:Menlo; font-size:11px"> </span><span style="font-variant-ligatures:no-common-ligatures; color:rgb(0,0,0)"><font face="arial, sans-serif" style="">pro</font></span><span style="font-variant-ligatures:no-common-ligatures; color:rgb(0,0,0)"><font face="arial, sans-serif" style="">vides detail
about the AD responses to authN requests if set to DEBUG<br>
(including, IIRC, detail data code that indicates the reason for authN failure - 532=expired pwd, 52e=bad pwd, 701=expired acct, etc.).</font></span></div>
<div><span style="font-variant-ligatures:no-common-ligatures; color:rgb(0,0,0)"><font face="arial, sans-serif" style=""><br>
</font></span></div>
<div><span style="font-variant-ligatures:no-common-ligatures; color:rgb(0,0,0)"><font face="arial, sans-serif" style="">David Bantz</font></span></div>
<div><span style="font-variant-ligatures:no-common-ligatures; color:rgb(0,0,0)"><font face="arial, sans-serif" style="">UA OIT IAM</font></span></div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Fri, Oct 18, 2019 at 9:06 AM Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
* Christopher Bland <<a href="mailto:chris@fdu.edu" target="_blank">chris@fdu.edu</a>> [2019-10-18 18:31]:<br>
> I have a cluster of IDPs which use the JAAS config to authenticate<br>
> users against AD. My jaas.config uses bindDN with bindCredential<br>
> and works fine. My question is on the AD side. I am not seeing any<br>
> kind of log for authentication being create in AD. I am wondering<br>
> what kind of experiences other admins have with regard to tracking<br>
> user authentications in AD?<br>
<br>
No idea but with non-JAAS you have logs for those events from the IDP itself:<br>
<br>
2019-10-18 17:03:35,132 - $IPADDR - INFO<br>
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:166]<br>
- Profile Action ValidateUsernamePasswordAgainstLDAP: Login by '$USER' failed<br>
<br>
2019-10-18 17:03:40,218 - $IPADDR - INFO<br>
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152]<br>
- Profile Action ValidateUsernamePasswordAgainstLDAP: Login by '$USER' succeeded<br>
<br>
-peter<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</body>
</html>