My ansible AWX exists in a domain.dev domain. I am trying to configure ldap access from ansible awx (tower). The following default "ldap user search" works.
[
"OU=Admins,OU=Dev,DC=domain,DC=dev",
"SCOPE_SUBTREE",
"(sAMAccountName=%(user)s)"
]
However, we have security groups which contain users from another trusted domain. Those users must be able to login so "ldap user search" should search for users in all groups in an OU or specific groups depending on what is possible.
[
"MemberOf=CN=DEVOPS,OU=Groups,OU=Dev,DC=domain,DC=dev",
"SCOPE_SUBTREE",
"(sAMAccountName=%(user)s)"
]
awx_web log returns:
INVALID_CREDENTIALS({'msgtype': 97, 'msgid': 1, 'result': 49, 'desc': 'Invalid credentials', 'ctrls': [], 'info': '80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563'}
"LDAP group type" is set to "NestedMemberDNGroupType".
The ldap host is a global catalog and I'm using port 3268.
Unfortunately I don't know any ldap experts, so any tips or help would be greatly appreciated. Thanks.
Related
I was able to connect ldaps://ldap.google.com using the downloaded cert.
I'm trying to do the user authentication against it, always failed
My settings, we are using GSuite Business plus planning.
The connection url: ldaps://ldap.google.com
edit mode: read only
users DN: dc=xxxx,dc=xx (no filter applied)
search scope: subtree
Bind type:
When I set it to ‘none’ I get error: “error during sync of users” in server log:
error code 50: insufficient access rights
Uncaught server error: LDAP query failed.
When I enter a user:
User + #domain = LDAP: error 50 - Not authorized to authenticate password
User without #domain = error 49 - Incorrect password
User in DN = uid or cn=xxxx, ou=xxxx - error 50 - Not authorized to authenticate password
Anything I'm missing? or google ldap don't allow it?
I want to configure LDAP for my portal. I have added the connection details such as:
Connection
Base Provider URL : ldap://SBS.ecompany.local:300(example)
Base DN: ecompany.local
Principal : myldap username
Credentials: myldap password.
also did the following mappings:
Screen Name : sn
Email Address: mail
Password: userPassword
First Name: givenName
Middle Name
Last Name: sn
Full Name: givenName sn
Job Title : title
I checked for the connection, and I got the following message:
Liferay has successfully connected to the LDAP server.
When I checked for Test LDAP Users I got the following message:
Test LDAP Users A subset of users has been displayed for you to review.
No users were found.
(Might be because I did not provide LDATP admin uname and pwd)
But when I tried to login I was not able to login using the LDAP configuration.
And got this error:
09:38:33,808 ERROR [liferay/scheduler_dispatch-5][PortalLDAPImporterImpl:210] Error importing LDAP users and groups
javax.naming.directory.InvalidSearchFilterException: Empty filter; remaining name 'ecompany.local'
at com.sun.jndi.ldap.Filter.encodeFilterString(Filter.java:57)
at com.sun.jndi.ldap.LdapClient.search(LdapClient.java:548)
at com.sun.jndi.ldap.LdapCtx.doSearch(LdapCtx.java:1985)
at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1844)
at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1769)
at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:392)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:358)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:341)
at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:267)
at com.liferay.portal.security.ldap.PortalLDAPUtil.searchLDAP(PortalLDAPUtil.java:820)
at com.liferay.portal.security.ldap.PortalLDAPUtil.getUsers(PortalLDAPUtil.java:617)
at com.liferay.portal.security.ldap.PortalLDAPUtil.getUsers(PortalLDAPUtil.java:652)
at com.liferay.portal.security.ldap.PortalLDAPImporterImpl.importFromLDAPByUser(PortalLDAPImporterImpl.java:695)
at com.liferay.portal.security.ldap.PortalLDAPImporterImpl.importFromLDAP(PortalLDAPImporterImpl.java:203)
at com.liferay.portal.security.ldap.PortalLDAPImporterImpl.importFromLDAP(PortalLDAPImporterImpl.java:139)
at com.liferay.portal.security.ldap.PortalLDAPImporterUtil.importFromLDAP(PortalLDAPImporterUtil.java:43)
at com.liferay.portlet.admin.messaging.LDAPImportMessageListener.doImportOnStartup(LDAPImportMessageListener.java:38)
at com.liferay.portlet.admin.messaging.LDAPImportMessageListener.doReceive(LDAPImportMessageListener.java:48)
at com.liferay.portal.kernel.messaging.BaseMessageListener.receive(BaseMessageListener.java:26)
at sun.reflect.GeneratedMethodAccessor405.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:483)
at com.liferay.portal.kernel.bean.ClassLoaderBeanHandler.invoke(ClassLoaderBeanHandler.java:67)
at com.sun.proxy.$Proxy303.receive(Unknown Source)
at com.liferay.portal.kernel.scheduler.messaging.SchedulerEventMessageListenerWrapper.receive(SchedulerEventMessageListenerWrapper.java:77)
at com.liferay.portal.kernel.messaging.InvokerMessageListener.receive(InvokerMessageListener.java:72)
at com.liferay.portal.kernel.messaging.ParallelDestination$1.run(ParallelDestination.java:69)
at com.liferay.portal.kernel.concurrent.ThreadPoolExecutor$WorkerTask._runTask(ThreadPoolExecutor.java:682)
at com.liferay.portal.kernel.concurrent.ThreadPoolExecutor$WorkerTask.run(ThreadPoolExecutor.java:593)
at java.lang.Thread.run(Thread.java:745)
The error is because of the DN. Can somebody help me solve this issue.
I got it working with an another issue. The problem was with the authentication search filter . I gave the format as :
Authentication Search Filter : Authentication Search Filter" as (mail=#email_address#). Actual format is Authentication Search Filter : (mail=#email_address#)
Next, the dn : format is dc=ecompany, dc=local.
The problem of ldap configuration was solved.
But when I changed the search filter from mail to screen name ie Authentication Search Filter : (sAMAccountName=#screen_name#) and also changed the How do users authenticate? to By screen name.
But I am not able to login using the ldap screen name and password. I checked the log files. I did not find any error. Please help .
I am trying to use AD authentication. I am able to login successfully but i am not authorized to perform any query in marvel.
Everytime i execute query in marvel, i get the following error.Below are the details
{
"error": "AuthorizationException[action [indices:data/read/search] is unauthorized for user [shivang.Mittal]]",
"status": 403
}
elasticsearch.yml (C:\ES\elasticsearch-1.4.4\config)
shield:
authc:
realms:
active_directory:
type: active_directory
domain_name: tavant.in
url: "LDAP://DODC1.tavant.in:389"
user_dn_templates:
- "cn={0}, dc=tavant, dc=in"
group_search:
base_dn: "dc=tavant,dc=in"
files:
role_mapping: "C:/ES/elasticsearch-1.4.4/config/shield/role_mapping.yml"
role_mapping.yml (C:\ES\elasticsearch-1.4.4\config\shield).
Copied the same file in Node(C:\ES\elasticsearch-1.4.4\data\elasticsearch\nodes\0)
admin:
- "cn=users, dc=tavant,dc=in"
roles.yml
admin:
cluster: all
indices:
'*': all
UPDATE
As per Jaymode suggestion, I added the shield.auth: debug.
Below is the log (Which i thought would be useful)
[2015-04-27 11:54:12][DEBUG][shield.authc.ldap.support] [Talisman] the roles [[]], are mapped from these [active_directory] groups [[CN=Users,CN=Builtin,DC=tavant,DC=in, CN=Domain Users,CN=Users,DC=tavant,DC=in,
[2015-04-27 11:54:14,935][DEBUG][shield.authc.activedirectory] [Talisman] authenticated user [shivang.Mittal], with roles [[]]
[2015-04-27 11:54:16,447][ERROR][marvel.agent.exporter ] [Talisman] error adding the marvel template to [[0:0:0:0:0:0:0:0]:9200] response code [401 Unauthorized]. content: [{"error":"AuthenticationException[missing authentication token for REST request [/_template/marvel]]","status":401}]
[2015-04-27 11:54:16,447][ERROR][marvel.agent.exporter ] [Talisman] failed to verify/upload the marvel template to [[0:0:0:0:0:0:0:0]:9200]:
Server returned HTTP response code: 401 for URL: http://[0:0:0:0:0:0:0:0]:9200/_template/marvel
[2015-04-27 11:54:16,447][ERROR][marvel.agent.exporter ] [Talisman] failed to verify/upload the marvel template to [[0:0:0:0:0:0:0:0]:9200]:
Server returned HTTP response code: 401 for URL: http://[0:0:0:0:0:0:0:0]:9200/_template/marvel
EDIT 2: Based on your log message, you probably want to use the following mapping
admin:
- "CN=Users,CN=Builtin,DC=tavant,DC=in"
EDIT: I think I see your issue. In your role_mapping.yml you have:
admin:
- "cn=users, dc=tavant,dc=tavant"
It should most likely be:
admin:
- "cn=users,dc=tavant,dc=in"
I wonder if the DN you are using for role mapping is correct and is being retrieved. If you set debug logging the list of groups that are found for the user will be logged. To enable debug logging, edit the C:\ES\elasticsearch-1.4.4\config\logging.yml file:
...
logger:
# Add the line below
shield.authc: DEBUG
...
The log line will look something like this: the roles [], are mapped from these [active_directory] groups [ list of group DNs here ] for realm [active_directory/active_directory]
In that line you will find the actual list of group DNs that are retrieved. Also, your realm configuration can be simplified to the following:
shield:
authc:
realms:
active_directory:
type: active_directory
domain_name: tavant.in
url: "LDAP://DODC1.tavant.in:389"
The other settings actually appear to just specify what would be the default values if they are not specified.
I have set up an ldap authentication using the following configuration. I just need to user to authenticate to the LDAP data store, then have their session get an authentication token. From reading the docs, this is what I am thinking is supposed to happen:
applicationContextSecurity.xml
<ldap-server id="contextSource"
url="ldap://192.168.0.1:389/DC=cn,DC=bleum,DC=com"
manager-dn="cn=buddy,ou=Neil,OU=Development,OU=Micosoft,DC=cn,DC=Micosoft,DC=com"
manager-password="A,1234567890" />
<authentication-manager alias="authenticationManager" erase-credentials="true">
<!--<authentication-provider user-service-ref="securityManagerSupport"/> -->
<ldap-authentication-provider server-ref="contextSource" role-prefix="none" user-search-filter="(uid={0})"
user-search-base="ou=Neil,OU=Development,OU=Micosoft" user-context-mapper-ref="contextMapper">
</ldap-authentication-provider>
</authentication-manager>
<beans:bean id="contextMapper" class="com.micosoft.neil.security.UserDetailsContextMapperSupport"/>
Error:
[DEBUG,FilterBasedLdapUserSearch] Searching for user 'test', with user search [ searchFilter: '(samaccountname={0})', searchBase: 'dc=company,dc=com', scope: subtree, searchTimeLimit: 0, derefLinkFlag: false ]
[DEBUG,AbstractContextSource] Got Ldap context on server 'ldap://adapps.company.com:389/dc=company,dc=com'
[INFO,SpringSecurityLdapTemplate] Ignoring PartialResultException
[DEBUG,XmlWebApplicationContext] Publishing event in Root WebApplicationContext: org.springframework.security.authentication.event.AuthenticationFailureBadCredentialsEvent[source=org.springframework.security.authentication.UsernamePasswordAuthenticationToken#488b5f0b: Principal: test; Password: [PROTECTED]; Authenticated: false; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffd148a: RemoteIpAddress: 127.0.0.1; SessionId: 0718B7EED3F930C63C03DA97C4344CBD; Not granted any authorities]
[DEBUG,UsernamePasswordAuthenticationFilter] Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
[DEBUG,UsernamePasswordAuthenticationFilter] Updated SecurityContextHolder to contain null Authentication
[DEBUG,UsernamePasswordAuthenticationFilter] Delegating to authentication failure handlerorg.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler#395158
[DEBUG,TokenBasedRememberMeServices] Interactive login attempt was unsuccessful.
[DEBUG,TokenBasedRememberMeServices] Cancelling cookie
From the result, it looks like the password was incorrect, so if you were trying to enter an incorrect user / password, then yes, that is what is expected.
Really not sure what your question is though? Were you expecting something different? Did you pass the correct credentials?
I have the same error with pretty much the same configuration. I can't give you an answer yet (sorry!), but running a debugger through the Spring classes, it seems they're trying to compare the password the user entered as a string (and the debugger confirms it is the correct password) to a password retrieved from LDAP - which is null - which then fails.
I have set up an ldap authentication using the following configuration. I just need to user to authenticate to the LDAP data store, then have their session get an authentication token. From reading the docs, this is what I am thinking is supposed to happen:
Authenticate as the manager, find the users full dn based on search criteria
Attempt to bind as the user (using their full dn) and the provided password
The logs dont seem to give enough information as to why this is failing. It just says invalid credentials - when I know they are valid. My thoughts are one of the following is happening:
The users full DN is not being found, and they are just being authenticated with the username
It is trying to do a password compare, vs actually trying to bind to the directory
Configuration:
<ldap-server
url="ldap://adapps.company.com:389/dc=company,dc=com"
manager-dn="cn=fulluserdn,dc=company,dc=com"
manager-password="password"/>
<ldap-user-service user-search-base="" user-search-filter="(samaccountname={0})"/>
<authentication-manager>
<ldap-authentication-provider user-search-filter="(samaccountname={0})" user-search-base="dc=company,dc=com"/>
</authentication-manager>
Error logs:
[DEBUG,FilterBasedLdapUserSearch] Searching for user 'test', with user search [ searchFilter: '(samaccountname={0})', searchBase: 'dc=company,dc=com', scope: subtree, searchTimeLimit: 0, derefLinkFlag: false ]
[DEBUG,AbstractContextSource] Got Ldap context on server 'ldap://adapps.company.com:389/dc=company,dc=com'
[INFO,SpringSecurityLdapTemplate] Ignoring PartialResultException
[DEBUG,XmlWebApplicationContext] Publishing event in Root WebApplicationContext: org.springframework.security.authentication.event.AuthenticationFailureBadCredentialsEvent[source=org.springframework.security.authentication.UsernamePasswordAuthenticationToken#488b5f0b: Principal: test; Password: [PROTECTED]; Authenticated: false; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffd148a: RemoteIpAddress: 127.0.0.1; SessionId: 0718B7EED3F930C63C03DA97C4344CBD; Not granted any authorities]
[DEBUG,UsernamePasswordAuthenticationFilter] Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
[DEBUG,UsernamePasswordAuthenticationFilter] Updated SecurityContextHolder to contain null Authentication
[DEBUG,UsernamePasswordAuthenticationFilter] Delegating to authentication failure handlerorg.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler#395158
[DEBUG,TokenBasedRememberMeServices] Interactive login attempt was unsuccessful.
[DEBUG,TokenBasedRememberMeServices] Cancelling cookie
The problem was teat the LDAP server was running on a different port, but the normal port was still open.