>>> On 09/10/2008 at 15:41, in message
<[log in to unmask]>, Ian Fogarty
<[log in to unmask]> wrote:
>
> using CAS to do the SSO.
Any particular reason you're using CAS? It's not really necessary as Shib does SSO anyway and you can get Tomcat to do the authentication so that you get a fully customisable login page. (This is with Shib 1.3, AIUI Shib 2 has the authentication module built in) You may already be using CAS for other purposes and therefore want to give your users a common and familiar login environment ? - I considered using it and after googling a lot and talking to quite a few people decided it was an unnecessary complication.
> 1359 [main] ERROR
> edu.internet2.middleware.shibboleth.aa.attrresolv.provider.JNDIDirectory
> DataConnector - An error occurred while retieving data for principal
> (ian fogarty) :Unprocessed Continuation Reference(s)
Colin's already suggested googling the error, which produces quite a few hits. When I first saw your post I thought "I bet this is that AD referrals thing". I'm no expert on AD (must get my VM going again and play a bit more!) but when I tried to get it to authenticate I found
a) it worked perfectly if you start the search at a sub container, below the root
b)If you tried to search from the root you get this referrals error.
This, it seems, is a "feature" of AD, it can be resolved for authentication by adding a line into the tomcat realm or (and?) going to the Global Catalog on 3268 ( see the thread in August). But you've already got your authn going via CAS.
I found this post which is probably quite helpful for fixing resolver: http://groups.google.com/group/shibboleth-users/msg/426b1d12725461d5 from a discussion on the I2 shib list 10-11 sept this year which hilights the point that using the GC to get the attributes may be fraught due to the GC only having a partial set!
Depending on your tree construction you could always point the search to start lower than the root?
> I was wondering if anyone has seen this sort of error before and if it
> is a quick fix to resolve?
Anyway, I'm in danger of just repeating what other people have said,
HTH
Andy
p.s. You could always slap in a copy of Novell eDirectory and run Novell IDM to automatically populate it from AD? ( Sorry, I am being a bit facetious, but it would give you a really good directory to read from!)
The University of Dundee is a registered Scottish charity, No: SC015096
|