Thanks for the input, Daniel. > Did you list all these attributes twice or is CAS duplicating them?
I specified them only once in the CAS properties file. I don't know why it's duplicating them either. > Although a connectTimeout of PT1H23M20S is either a configuration mistake or a CAS parsing bug. I used the default connectTimeout of 5000 (milliseconds, I hope? the oficial docs don't specify [1]). I should probably change that to the notation expected by ldaptive. > You should probably file a feature request and ask for an anonymous bind to be performed when using the BIND option with no bindDN property. I will. Thanks! [1] https://apereo.github.io/cas/5.0.x/installation/Configuration-Properties.html#ldap-authentication Best regards, -- Carlos M. Fernández Enterprise Systems Manager *Saint Joseph’s University* Philadelphia PA 19131 T: +1 610 660 1501 On Tue, Jul 11, 2017 at 2:14 PM, Daniel Fisher <[email protected]> wrote: > On Mon, Jul 10, 2017 at 6:21 PM, Carlos Fernandez <[email protected]> > wrote: > >> 2017-07-10 13:02:40,171 DEBUG >> [org.ldaptive.auth.PooledBindAuthenticationHandler] >> - <authenticate criteria=[org.ldaptive.auth.Au >> thenticationCriteria@530348177::dn=uid=jb617017,ou=people,o=sju.edu, >> authenticationRequest=[org.ldaptive.auth.AuthenticationRequest@2074611074 >> <(207)%20461-1074>::user=[org.ldaptive.auth.User@1520364966::identifier=jb617017, >> context=null], returnAttributes=[udcid, uid, employeeType, mail, >> displayName, givenName, departmentNumber, pswUserName, sn, employeeNumber, >> udcid, uid, employeeType, mail, displayName, givenName, departmentNumber, >> pswUserName, sn, employeeNumber]]]> >> > > Did you list all these attributes twice or is CAS duplicating them? > > >> 2017-07-10 13:02:40,182 DEBUG [org.ldaptive.SearchOperation] - <execute >> response=[org.ldaptive.Response@2058915982 <(205)%20891-5982> >> ::result=[org.ldaptive.SearchResult@-1951941189::entries=[[dn=[], >> responseControls=null, messageId=-1]], references=[]], resultCode=SUCCESS, >> message=null, matchedDn=null, responseControls=null, referralURLs=null, >> messageId=-1] for request=[org.ldaptive.SearchRequest@600881066::baseDn=, >> searchFilter=[org.ldaptive.SearchFilter@1642584434::filter=(objectClass=*), >> parameters={}], returnAttributes=[1.1], searchScope=OBJECT, timeLimit=PT0S, >> sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, >> sortBehavior=UNORDERED, searchEntryHandlers=null, >> searchReferenceHandlers=null, controls=null, referralHandler=null, >> intermediateResponseHandlers=null] >> > > Here's the successful connection validation. > > >> 2017-07-10 13:02:40,189 DEBUG [org.ldaptive.BindOperation] - <execute >> response=[org.ldaptive.Response@1635611633::result=null, >> resultCode=SUCCESS, message=null, matchedDn=null, >> responseControls=[[org.ldaptive.control.PasswordPolicyControl@ >> -350057371::criticality=false, timeBeforeExpiration=0, >> graceAuthNsRemaining=0, error=null]], referralURLs=null, messageId=-1] for >> request=[org.ldaptive.BindRequest@1840527521::bindDn=uid= >> jb617017,ou=people,o=sju.edu, saslConfig=null, >> controls=[[org.ldaptive.control.PasswordPolicyControl@-350057371::criticality=false, >> timeBeforeExpiration=0, graceAuthNsRemaining=0, error=null]], >> referralHandler=null, intermediateResponseHandlers=null] with >> connection=[org.ldaptive.DefaultConnectionFactory$DefaultCon >> nection@1236378265::config=[org.ldaptive.ConnectionConfig@2142472158 >> <(214)%20247-2158>::ldapUrl=ldaps://axldap.sju.edu, >> connectTimeout=PT1H23M20S, responseTimeout=null, >> sslConfig=[org.ldaptive.ssl.SslConfig@1154240951::credential >> Config=[org.ldaptive.ssl.X509CredentialConfig@-747746929:: >> trustCertificates=file:/etc/cas/credentials/axldap.crt, >> authenticationCertificate=null, authenticationKey=null], >> trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, >> handshakeCompletedListeners=null], useSSL=true, useStartTLS=false, >> connectionInitializer=null, connectionStrategy=org.ldaptiv >> e.DefaultConnectionStrategy@22c0dfad], providerConnectionFactory=[org >> .ldaptive.provider.jndi.JndiConnectionFactory@412312959:: >> metadata=[ldapUrl=ldaps://axldap.sju.edu, count=1], >> environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, >> com.sun.jndi.ldap.connect.timeout=5000000, java.naming.ldap.version=3, >> java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, >> java.naming.security.protocol=ssl}, classLoader=null, >> providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@2080218308 >> ::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], >> properties={}, controlProcessor=org.ldaptive. >> provider.ControlProcessor@5d1a2be5, environment=null, tracePackets=null, >> removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, >> SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], classLoader=null, >> sslSocketFactory=null, hostnameVerifier=null]], >> providerConnection=org.ldaptive.provider.jndi.JndiConnection@7983aa5c]> >> > > Here's the successful bind. Although a connectTimeout of PT1H23M20S is > either a configuration mistake or a CAS parsing bug. > > >> 2017-07-10 13:02:40,189 DEBUG [org.ldaptive.auth.PooledSearchEntryResolver] >> - <resolve criteria=[org.ldaptive.auth.AuthenticationCriteria@530348177 >> ::dn=uid=jb617017,ou=people,o=sju.edu, authenticationRequest=[org.lda >> ptive.auth.AuthenticationRequest@2074611074 <(207)%20461-1074> >> ::user=[org.ldaptive.auth.User@1520364966::identifier=jb617017, >> context=null], returnAttributes=[udcid, uid, employeeType, mail, >> displayName, givenName, departmentNumber, pswUserName, sn, employeeNumber, >> udcid, uid, employeeType, mail, displayName, givenName, departmentNumber, >> pswUserName, sn, employeeNumber]]]> >> > > I'm confused why this search entry resolver is running. Perhaps it's > configuration mistake, perhaps CAS is leveraging the DN resolver in a way I > don't understand. > > >> java.lang.IllegalStateException: Connection is not open >> > > Here's the connection validation failing, presumably because of the close > passivator. There's definitely some strange stuff going on here. I see you > changed your config and got it working, however it should be possible to > get the behavior you want with the direct authenticator. You should > probably file a feature request and ask for an anonymous bind to be > performed when using the BIND option with no bindDN property. > > --Daniel Fisher > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: https://apereo.github.io/cas/ > Mailing-Lists.html > <http://spamburger.sju.edu/canit/urlproxy.php?_q=aHR0cHM6Ly9hcGVyZW8uZ2l0aHViLmlvL2Nhcy9NYWlsaW5nLUxpc3RzLmh0bWw%3D&_s=Y2Zlcm5hbmQ%3D&_c=77a03ca9> > - CAS documentation website: https://apereo.github.io/cas > <http://spamburger.sju.edu/canit/urlproxy.php?_q=aHR0cHM6Ly9hcGVyZW8uZ2l0aHViLmlvL2Nhcw%3D%3D&_s=Y2Zlcm5hbmQ%3D&_c=9d7960c0> > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit https://groups.google.com/a/ > apereo.org/d/msgid/cas-user/CAFC6YwT_kcCFzykj0cqWq9XnQw% > 3DCqN_%3DTG%3D87rPOzfr_D0ZU4A%40mail.gmail.com > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAFC6YwT_kcCFzykj0cqWq9XnQw%3DCqN_%3DTG%3D87rPOzfr_D0ZU4A%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAE7KU84Gd8Yqrte-byEh-aHQ8k_n%3DZn4s483bGka3NA0vVkJpg%40mail.gmail.com.
