<html><head></head><body><div class="ydp1c976702yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div></div>
<div><b><span style="font-size: 10pt;">I tried with uid,
sAMAccountName and mail in the search filter. none of them worked:</span><span style="font-size: 10pt;"> </span></b></div><div dir="ltr" data-setdir="false"><div>
<p class="ydpd2cb4e30MsoNormal"><span style="font-size:10.0pt;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:Times New Roman;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:Calibri;mso-bidi-theme-font:minor-latin;color:black"><i>idp.attribute.resolver.LDAP.searchFilter
= (uid=$resolutionContext.principal)</i></span></p>
<p class="ydpd2cb4e30MsoNormal"><span style="font-size:10.0pt;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:Times New Roman;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:Calibri;mso-bidi-theme-font:minor-latin;color:black"><i>idp.attribute.resolver.LDAP.searchFilter
= (sAMAccountName=$resolutionContext.principal)</i></span></p>
<p class="ydpd2cb4e30MsoNormal"><span style="font-size:10.0pt;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:Times New Roman;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:Calibri;mso-bidi-theme-font:minor-latin;color:black"><i>idp.attribute.resolver.LDAP.searchFilter
= (mail=$resolutionContext.principal)</i></span></p>
<p class="ydpd2cb4e30MsoNormal"><span style="font-size:10.0pt;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:Times New Roman;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:Calibri;mso-bidi-theme-font:minor-latin;color:black"> </span></p>
<p class="ydpd2cb4e30MsoNormal"><b><span style="font-size:10.0pt;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:Times New Roman;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:Calibri;mso-bidi-theme-font:minor-latin;color:black">from the log, the user
login succeed. only attribute did not pop in response:</span><span style="font-size: 10pt;"> </span></b></p>
<p class="ydpd2cb4e30MsoNormal"><span style="font-size:10.0pt;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:Times New Roman;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:Calibri;mso-bidi-theme-font:minor-latin;color:black"><i>2020-11-17 05:50:27,104 -
10.2.16.9 - INFO [org.ldaptive.auth.Authenticator:311] - <b>Authentication
succeeded for dn: <a href="mailto:admin@contoso.com" rel="nofollow" target="_blank">admin@contoso.com</a></b></i></span></p>
<p class="ydpd2cb4e30MsoNormal"><span style="font-size:10.0pt;mso-ascii-font-family:Calibri;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:Times New Roman;mso-hansi-font-family:Calibri;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:Calibri;mso-bidi-theme-font:minor-latin;color:black"><i>2020-11-17 05:50:27,104 -
10.2.16.9 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] -
Profile Action ValidateUsernamePasswordAgainstLDAP:<b> Login by 'admin@contoso.com'
succeeded</b></i></span></p>
<span style="font-size:10.0pt;font-family:Calibri,sans-serif;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:Times New Roman;mso-hansi-theme-font:minor-latin;mso-bidi-theme-font:minor-latin;color:black;mso-ansi-language:EN-US;mso-fareast-language:EN-US;mso-bidi-language:AR-SA"><i>2020-11-17 05:50:28,979 -
10.2.16.9 - INFO [Shibboleth-Audit.SSO:275] -
20201117T055028Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|id-4b1022bd-66cd-4aea-83cf-285cb744afae|http://fs.contoso.com/adfs/services/trust|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://idp01/idp|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_26c1d15842a551b17353cd80e3bc004a|admin@contoso.com|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||*******|_4623b9ecdf3eb1aab36a9d327119251a|true</i></span></div><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">thanks,</div><div dir="ltr" data-setdir="false">SC</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">--------------------------------------</div><div><br></div>
</div><div id="ydp7aee090yahoo_quoted_5923390555" class="ydp7aee090yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Monday, November 16, 2020, 09:36:58 PM PST, Nate Klingenstein <ndk@signet.id> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div dir="ltr">SC,<div class="ydp7aee090yqt5552756817" id="ydp7aee090yqtfd65323"><br clear="none"><br clear="none">> ldap.properties<br clear="none">> <br clear="none">> idp.authn.LDAP.authenticator <br clear="none">> = adAuthenticator<br clear="none">> <br clear="none">> idp.attribute.resolver.LDAP.searchFilter <br clear="none">> = (mail=$resolutionContext.principal)</div><br clear="none"><br clear="none">It's just a guess, but your most likely problem is that your searchFilter is looking for LDAP entries that have a "mail" attribute that matches whatever the principal name was that was typed in. Unless your users are authenticating with their email address as their username, there will be no matches, and you won't have any entry to pull mail from. You may want to change that to uid= or something similar.<br clear="none"><br clear="none">Beyond that, you would have to look at your IdP logs for more information.<br clear="none"><br clear="none">Take care,<br clear="none">Nate.<br clear="none"><br clear="none">--------<br clear="none">Signet, Inc.<br clear="none">The Art of Access ®<br clear="none"><br clear="none"><a shape="rect" href="https://www.signet.id" rel="nofollow" target="_blank">https://www.signet.id</a><div class="ydp7aee090yqt5552756817" id="ydp7aee090yqtfd55171"><br clear="none"></div></div></div>
</div>
</div></body></html>