<div dir="ltr">ShibUserPassAuth {<br><br> // userFilter enables user input to match either UA Username or UA ID#<br><br> // UA AD Auth<br> org.ldaptive.jaas.LdapLoginModule sufficient<br> ldapUrl="ldap://fbk....edu:3268 ldap://fbk....edu:3268"<br> baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"<br> bindDn="cn=u...,dc=edu"<br> bindCredential="•••••••••"<br> subtreeSearch="true"<br> credentialConfig="{trustCertificates=file:/opt/shibboleth-idp/credentials/UA_AD_CA.pem}"<br> useSSL="false"<br> useStartTLS="true"<br> userFilter="(|(&(employeeNumber=*)(uaIdentifier={user}))(sAMAccountName={user}))"<br> connectTimeout="3000"<br> resultTimeout="3000"<br> ;<br><br> // UA Authenticator proxy to AD allows some expired accounts to authenticate<br> org.ldaptive.jaas.LdapLoginModule sufficient<br> ldapUrl="ldaps://<a href="http://cas-auth.alaska.edu:6361">cas-auth.alaska.edu:6361</a>"<br> baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"<br> bindDn="cn=...,dc=edu"<br> bindCredential="••••••••••"<br> subtreeSearch="true"<br> credentialConfig="{trustCertificates=file:/opt/shibboleth-idp/credentials/UAADrootCAs-P-Q-D-T-InC.pem}"<br> useSSL="true"<br> useStartTLS="false"<br> userFilter="(|(&(employeeNumber=*)(uaIdentifier={user}))(sAMAccountName={user}))"<br> connectTimeout="3000"<br> resultTimeout="3000"<br> ;<br><br>};<br><div><br></div><div><br></div><div>If the module returns failed authentication because of an expired account or other conditions, the second module is exercised.<br>This happens many times per day.<br><br></div><div>Connection issues are uncommon so the timeout error is new this week, triggered by DoS on the ldap (AD) server.</div><div><br></div><div>David</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Oct 22, 2020 at 9:48 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">In those cases, if you have two separate login modules in *separate* JAAS configuration sections, and the IdP is configured to run both using the non-default settings to tell it which ones to use, it will run both in a "try until one succeeds" fashion in V3. I ran that way for many years, so I'm very familiar with the behavior. If it's not trying the second one, you don't in fact have it set up that way.<br>
<br>
-- Scott<br>
<br>
On 10/22/20, 1:41 PM, "users on behalf of IAM David Bantz" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>> wrote:<br>
<br>
13:22:11:543 INFO [137.229.114.251] net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:255 > Profile Action ValidateUsernamePasswordAgainstJAAS: Login by 'dberry9' via 'ShibUserPassAuth' failedjavax.security.auth.login.LoginException: Authentication failed: [org.ldaptive.auth.AuthenticationResponse@1572247851::authenticationResultCode=AUTHENTICATION_HANDLER_FAILURE, ldapEntry=[dn=CN=dberry9,OU=userAccounts,DC=ua,DC=ad,DC=alaska,DC=edu[]], accountState=null, result=false, resultCode=LDAP_TIMEOUT, message=javax.naming.NamingException: LDAP response read timed out, timeout used:3000ms., controls=null] at org.ldaptive.jaas.LdapLoginModule.login(LdapLoginModule.java:160)<br>
<br>
17:46:24:316 INFO [204.90.98.254] net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:255 > Profile Action ValidateUsernamePasswordAgainstJAAS: Login by 'mcampbell10' via 'ShibUserPassAuth' failedjavax.security.auth.login.LoginException: Authentication failed: [org.ldaptive.auth.AuthenticationResponse@1668002417::authenticationResultCode=AUTHENTICATION_HANDLER_FAILURE, ldapEntry=[dn=CN=mcampbell10,OU=userAccounts,DC=ua,DC=ad,DC=alaska,DC=edu[]], accountState=null, result=false, resultCode=LDAP_TIMEOUT, message=javax.naming.NamingException: LDAP response read timed out, timeout used:3000ms., controls=null] at org.ldaptive.jaas.LdapLoginModule.login(LdapLoginModule.java:160)<br>
<br>
<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>