The default idp.authn.LDAP.authenticator=adAuthenticator
with idp.authn.LDAP.dnFormat=%s
fails to resolve the LDAP entry or return any attributes, because it incorrectly uses the user@domain
principal as a base DN for the search:
2018-12-20 11:09:07,543 - 127.0.0.1 - DEBUG [org.ldaptive.auth.SearchEntryResolver:415] - resolve criteria=[org.ldaptive.auth.AuthenticationCriteria@889474363::dn=user@example.com, authenticationRequest=[org.ldaptive.auth.AuthenticationRequest@2125852170::user=[org.ldaptive.auth.User@1891586491::identifier=user@example.com, context=org.apache.velocity.VelocityContext@1bbd991a], retAttrs=[cn, userPrincipalName, mail], controls=null]]
2018-12-20 11:09:07,544 - 127.0.0.1 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[org.ldaptive.SearchRequest@-1882291035::baseDn=user@example.com, searchFilter=[org.ldaptive.SearchFilter@1642584434::filter=(objectClass=*), parameters={}], returnAttributes=[cn, userPrincipalName, mail], searchScope=OBJECT, timeLimit=0, sizeLimit=