<div dir="ltr">I did a copy/paste error in my explanation the beans in idp v3.4.3 was containing the following definition of the
ValidateUsernamePasswordAgainstLDAP
<div><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"JetBrains Mono",monospace"><span style="color:rgb(232,191,106)"><bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ValidateUsernamePasswordAgainstLDAP"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:savePasswordToCredentialSet</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') ?: false}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:removeContextAfterValidation</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RemoveAfterValidation') ?: true}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:authenticator-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.LDAP.authenticator"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:addDefaultPrincipals</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.addDefaultPrincipals') ?:<br></span><span style="color:rgb(106,135,89)"> (getObject('shibboleth.authn.Password.PrincipalOverride') == null<br></span><span style="color:rgb(106,135,89)"> or getObject('shibboleth.authn.Password.PrincipalOverride').isEmpty())}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:supportedPrincipals</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:classifiedMessages-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.ClassifiedMessageMap"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:resultCachingPredicate</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.resultCachingPredicate')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:matchExpression</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.matchExpression')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:returnAttributes-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.LDAP.returnAttributes"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:lockoutManager</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.AccountLockoutManager')}" </span><span style="color:rgb(232,191,106)">/></span></pre></div><div>so for idpv4 we have changed to the <span style="color:rgb(106,135,89);background-color:rgb(43,43,43);font-family:"JetBrains Mono",monospace;white-space:pre-wrap">net.shibboleth.idp.</span><span style="color:rgb(106,135,89);background-color:rgb(43,43,43);font-family:"JetBrains Mono",monospace;white-space:pre-wrap">authn.impl.</span><span style="color:rgb(106,135,89);background-color:rgb(43,43,43);font-family:"JetBrains Mono",monospace;white-space:pre-wrap">LDAPCredentialValidator</span></div><div>implementation which has a lot less property and doesn't seems to be triggered by the state</div><div><pre style="white-space:pre-wrap;background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"JetBrains Mono",monospace"><span style="color:rgb(232,191,106)"><evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="ValidateUsernamePassword" </span><span style="color:rgb(232,191,106)">/></span></pre></div><div>Regards,</div><div>Claude</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le mer. 5 mai 2021 à 09:53, Claude Libois <<a href="mailto:clibois.work@gmail.com">clibois.work@gmail.com</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hello,<div>We are currently upgrading from idp 3.4.3 to idp 4.0.x</div><div>I our 3.4.x flow we used to trigger username/password against ldap in a flow:</div><div><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"JetBrains Mono",monospace"><span style="color:rgb(232,191,106)"><action-state </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ValidateUsernamePassword" </span><span style="color:rgb(186,186,186)">parent</span><span style="color:rgb(106,135,89)">="authn/conditions#ValidateUsernamePassword"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="ValidateUsernamePassword" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <evaluate </span><span style="color:rgb(186,186,186)">expression</span><span style="color:rgb(106,135,89)">="'proceed'" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> <transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="proceed" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="ContinueSuccessfulAuthentication" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> </span><span style="color:rgb(128,128,128)"><!-- Fall through to a different flow if login fails on a passive or non-browser request. --><br></span><span style="color:rgb(128,128,128)"> </span><span style="color:rgb(232,191,106)"><transition </span><span style="color:rgb(186,186,186)">on</span><span style="color:rgb(106,135,89)">="#{ opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive() || !opensamlProfileRequestContext.isBrowserProfile() }" </span><span style="color:rgb(186,186,186)">to</span><span style="color:rgb(106,135,89)">="ReselectFlow" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"> </span><span style="color:rgb(128,128,128)"><!-- Other event transitions are determined by deployer in /flows/authn/conditions/conditions-flow.xml --><br></span><span style="color:rgb(232,191,106)"></action-state></span></pre></div><div>
</div><div>and the beans was containing </div><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"JetBrains Mono",monospace"><span style="color:rgb(232,191,106)"><bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ValidateUsernamePasswordAgainstLDAP"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.LDAPCredentialValidator" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:savePasswordToCredentialSet</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') ?: false}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:removeContextAfterValidation</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RemoveAfterValidation') ?: true}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:authenticator-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.LDAP.authenticator"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:supportedPrincipals</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:matchExpression</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.matchExpression')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:returnAttributes-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.LDAP.returnAttributes"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="PopulateSubjectCanonicalizationContext"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:availableFlows-ref</span><span style="color:rgb(106,135,89)">="shibboleth.PostLoginSubjectCanonicalizationFlows" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span></pre><div><span style="color:rgb(232,191,106);background-color:rgb(43,43,43);font-family:"JetBrains Mono",monospace"></beans></span> </div><div><br></div><div><div>The alias ValidateUsernamePassword was defined with the alias <br></div><div> <alias name="ValidateUsernamePasswordAgainstLDAP" alias="ValidateUsernamePassword" />
in the
password-authn-conf.xml</div></div><div><br></div><div></div><div>I have noticed there was quite a lot of changes in the way of defining the validate user/pwd against LDAP. The class
ValidateUsernamePasswordAgainstLDAP no more exist and I have replace it with the LDAPCredentialValidator:</div><div><pre style="background-color:rgb(43,43,43);color:rgb(169,183,198);font-family:"JetBrains Mono",monospace"><span style="color:rgb(232,191,106)"><bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="ValidateUsernamePasswordAgainstLDAP"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.LDAPCredentialValidator" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:savePasswordToCredentialSet</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential') ?: false}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:removeContextAfterValidation</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.RemoveAfterValidation') ?: true}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:authenticator-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.LDAP.authenticator"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:supportedPrincipals</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:matchExpression</span><span style="color:rgb(106,135,89)">="#{getObject('shibboleth.authn.Password.matchExpression')}"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:returnAttributes-ref</span><span style="color:rgb(106,135,89)">="shibboleth.authn.LDAP.returnAttributes"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"> <bean </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="PopulateSubjectCanonicalizationContext"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(186,186,186)">class</span><span style="color:rgb(106,135,89)">="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext" </span><span style="color:rgb(186,186,186)">scope</span><span style="color:rgb(106,135,89)">="prototype"<br></span><span style="color:rgb(106,135,89)"> </span><span style="color:rgb(152,118,170)">p</span><span style="color:rgb(186,186,186)">:availableFlows-ref</span><span style="color:rgb(106,135,89)">="shibboleth.PostLoginSubjectCanonicalizationFlows" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"><br></span><span style="color:rgb(232,191,106)"></beans></span></pre></div><div> </div><div>However, the doValidate of the
LDAPCredentialValidator is never triggered. <br></div><div>I have read the <a href="https://wiki.shibboleth.net/confluence/display/IDP4/PasswordAuthnConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP4/PasswordAuthnConfiguration</a></div><div>There is an alternative to the alias
ValidateUsernamePassword.</div><div>I have then updated my password-authn-config and ldap-authn-config by disabling the alias and adding:</div><div><span style="color:rgb(232,191,106)"><</span><span style="color:rgb(152,118,170)">util</span><span style="color:rgb(232,191,106)">:list </span><span style="color:rgb(186,186,186)">id</span><span style="color:rgb(106,135,89)">="shibboleth.authn.Password.Validators"</span><span style="color:rgb(232,191,106)">><br></span><span style="color:rgb(232,191,106)"> <ref </span><span style="color:rgb(186,186,186)">bean</span><span style="color:rgb(106,135,89)">="shibboleth.LDAPValidator" </span><span style="color:rgb(232,191,106)">/><br></span><span style="color:rgb(232,191,106)"></</span><span style="color:rgb(152,118,170)">util</span><span style="color:rgb(232,191,106)">:list></span> <br></div><div><br></div><div>However, I don't know how to wire the shibboleth.LDAPValidator with my
ValidateUsernamePasswordAgainstLDAP. </div><div>Moreover, I don't know how to trigger the doValidate from the
ValidateUsernamePasswordAgainstLDAP.</div><div><br></div><div>Could somebody point me on how to trigger the validation manually or what are the "convention" to have the password against LDAP triggered after having submit the j_username and j_password ?</div><div>Best Regards,<br>Claude <br></div></div>
</blockquote></div>