Can not login TERNET IDP

[DamasMakweba_cd63]

Hi team,
We are experiencing problem to login at TERNET IDP, if you open https://idp.ternet.or.tz and try to login it gives Invalid usernme or Password is wrong, at the same time if you go through federated services like swg.africa-grid.org you get HTTP error Resource is not available.

The shibboleth log has the following message:

ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - 
Configuration was not loaded for shibboleth.AttributeResolver service, error creating components.  
The root cause of this error was: edu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResolutionException: Unable to retrieve LDAP connection

I need assistant please.

Rgds,

[brucellino]

Hi @DamasMakweba_cd63

Looks like the problem is with the LDAP connection :

The root cause of this error was: edu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResolutionException: Unable to retrieve LDAP connection

check the attribute resolver (xml file) and login.config. If you have your inventory and group vars in the DevOps repo, I'll happily send a PR.

[DamasMakweba_cd63]

@brucellino,

The files resolver and login are both seems to be fine. I tried to run ldapsearch from the LDAP server with password prompt it worked but using the same from IDP it looks to be not working;

Here is what I did;

1. Direct to ldap server;

[dmakweba@ldap ~]$ ldapsearch -h 127.0.0.1 -D "cn=admin,dc=local" -W
Enter LDAP Password:

......a lot of outout ended with

# search result
search: 2
result: 0 Success

# numResponses: 670
# numEntries: 669

1. From IDP server

[dmakweba@idp ~]$ ldapsearch -h 41.93.32.33 -D "cn=admin,dc=local" -W
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <> (default) with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 2
result: 32 No such object

# numResponses: 1

Any clue.

[brucellino]

Hi @DamasMakweba_cd63 - if your ldap is working, and the idp service is giving ldap connection errors, then there must be a problem with the configuration of the resolver and/or login.properties.

Without a view into your configuration, we can't provide any further suggestion

The best I can do is provide you with what the configuration should be. The templates for the configuraiton are :

• login.conf
• attribute-resolver

Maybe that can help you find the bug.

I remember a while back that there was some mismatch between the configurations at your site, where a different war was being used, or a different config. I don't have the full information for you, since again that wasn't in a repo anywhere. Have a look and let us know if that helps - but most importantly - get your configuration into change control

[DamasMakweba_cd63]

@Bruce,
My resolver and login properties are well configured but still I cant connect from my IDP, it seems that like having wrong bind.
I am worried the server to be compromised or the shibboleth application v2 I am using might have bugs.

BTW: I have prepared another container/server t be installed IDP only, How can I introduce in the ansibel my new IDP server so that when running playbook then the server installed with IDP?

Rgds,