Problem setting up LdapFilterForGroups
Hello,
I'am trying to setup the LdapFilterForAttributes and LdapFilterForGroups
for a Fedora Repository. The first works (I think), but the the
LdapFilterForGroups seems not to work.
In the Fedora Server log I can see the following output:
INFO 2009-12-04 13:17:05.179 [http-8080-1] (Cache) Authenticating user
[jdoe]
INFO 2009-12-04 13:17:05.185 [http-8080-1] (Cache) Authenticating user
[jdoe]
INFO 2009-12-04 13:17:05.185 [http-8080-1] (FilterLdap) A
getNamingEnumeration() -binding- individual user
INFO 2009-12-04 13:17:05.215 [http-8080-1] (FilterLdap) G
getNamingEnumeration() -binding- individual user
ERROR 2009-12-04 13:17:05.221 [http-8080-1] (FilterLdap) G
populateCacheElement() unexpected null ne w/o exception thrown
ERROR 2009-12-04 13:17:05.223 [http-8080-1] (FilterLdap) G
populateCacheElement() accept to mean failed bind, so false
I've also edited the source of the LdapFilter a bit, so that the
exceptions is logged also. The exception looks like this:
javax.naming.NamingException: [LDAP: error code 49 - Bind failed:
expected some
at
fedora.server.security.servletfilters.ldap.FilterLdap.getNamingEnumeration(FilterLdap.java:594)
at
fedora.server.security.servletfilters.ldap.FilterLdap.populateCacheElement(FilterLdap.java:795)
at
fedora.server.security.servletfilters.CacheElement.getNamedValues(CacheElement.java:199)
at
fedora.server.security.servletfilters.Cache.getNamedValues(Cache.java:221)
at
fedora.server.security.servletfilters.BaseCaching.contributeAttributes(BaseCaching.java:314)
at
fedora.server.security.servletfilters.BaseCaching.contributeAuthenticatedAttributes(BaseCaching.java:342)
at
fedora.server.security.servletfilters.BaseContributing.doThisSubclass(BaseContributing.java:252)
at
fedora.server.security.servletfilters.FilterSetup.doFilter(FilterSetup.java:211)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
fedora.server.security.servletfilters.FilterSetup.doFilter(FilterSetup.java:234)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
fedora.server.security.servletfilters.FilterSetup.doFilter(FilterSetup.java:234)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
fedora.server.security.servletfilters.FilterSetup.doFilter(FilterSetup.java:234)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:525)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
at org.apache.coyote.http11.Http11Protocol
$Http11ConnectionHandler.process(Http11Protocol.java:583)
at org.apache.tomcat.util.net.JIoEndpoint
$Worker.run(JIoEndpoint.java:454)
at java.lang.Thread.run(Thread.java:619)
My filter configurations:
<filter>
<filter-name>LdapFilterForAttributes</filter-name>
<filter-class>fedora.server.security.servletfilters.ldap.FilterLdap</filter-class>
<init-param>
<param-name>version</param-name>
<param-value>3</param-value>
</init-param>
<init-param>
<param-name>authenticate</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>security-authentication</param-name>
<param-value>simple</param-value>
</init-param>
<init-param>
<param-name>id-attribute</param-name>
<param-value>uid</param-value>
</init-param>
<init-param>
<param-name>bind-filter</param-name>
<param-value>uid={0},ou=people,dc=project,dc=example,dc=org</param-value>
</init-param>
<init-param>
<param-name>url</param-name>
<param-value>ldap://localhost:389</param-value>
</init-param>
<init-param>
<param-name>search-base</param-name>
<param-value>ou=people,dc=project,dc=example,dc=org</param-value>
</init-param>
<init-param>
<param-name>search-filter</param-name>
<param-value>(uid={0})</param-value>
</init-param>
<init-param>
<param-name>attributes</param-name>
<param-value>cn</param-value>
</init-param>
</filter>
<filter>
<filter-name>LdapFilterForGroups</filter-name>
<filter-class>fedora.server.security.servletfilters.ldap.FilterLdap</filter-class>
<init-param>
<param-name>associated-filters</param-name>
<param-value>LdapFilterForAttributes,LdapFilterForGroups</param-value>
</init-param>
<init-param>
<param-name>version</param-name>
<param-value>3</param-value>
</init-param>
<init-param>
<param-name>authenticate</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>security-authentication</param-name>
<param-value>simple</param-value>
</init-param>
<init-param>
<param-name>id-attribute</param-name>
<param-value>uid</param-value>
</init-param>
<init-param>
<param-name>bind-filter</param-name>
<param-value>uid={0},ou=people,dc=project,dc=example,dc=org</param-value>
</init-param>
<init-param>
<param-name>url</param-name>
<param-value>ldap://localhost:389</param-value>
</init-param>
<init-param>
<param-name>search-base</param-name>
<param-value>ou=groups,dc=project,dc=example,dc=org</param-value>
</init-param>
<init-param>
<param-name>search-filter</param-name>
<param-value>(memberUid=uid={0},ou=people,dc=project,dc=example,dc=org)</param-value>
</init-param>
<init-param>
<param-name>attributes</param-name>
<param-value>cn</param-value>
</init-param>
<init-param>
<param-name>attributes-common-name</param-name>
<param-value>groups</param-value>
</init-param>
</filter>
I've used the configuration on this page as a template:
http://www.fedora-commons.org/confluence/display/FCKB/Authenticating
+Fedora+2.2+against+LDAP
We are using Fedora 3.2, but as far as I can tell, the configuration on
this page is still valid.
Anyone who can give me a hint what is wrong with the configuration?
Thanks.
Jens Pelzetter
------------------------------------------------------------------------------
Join us December 9, 2009 for the Red Hat Virtual Experience,
a free event focused on virtualization and cloud computing.
Attend in-depth sessions from your desk. Your couch. Anywhere.
http://p.sf.net/sfu/redhat-sfdev2dev
RSS Feed