Issue using LDAP User and Groups different OUs

lhoepfne · June 23, 2018, 8:46am

Hello Community,

I have installed Ubuntu 18.04 with xwiki and LDAP extension 9.2.5.
Can’t login in to with a user i have tried with sAMAccountName and user logon name.
Thanks for you help.
xwiki.authentication.authclass=org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl
xwiki.authentication.ldap=1
xwiki.authentication.ldap.trylocal=1
xwiki.authentication.ldap.server=adserver.company.local
xwiki.authentication.ldap.port=389
xwiki.authentication.ldap.base_DN=dc=company,dc=local
xwiki.authentication.ldap.UID_attr=sAMAccountName
xwiki.authentication.ldap.fields_mapping=name=sAMAccountName,last_name=sn,first_name=givenName,fullname=displayName,email=mail,ldap_dn=dn
xwiki.authentication.ldap.bind_DN=cn=ldapuser,OU=service_account,dc=company,dc=local
xwiki.authentication.ldap.bind_pass=passwort1234
xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=cn=wikiadmin,ou=admin,ou=group
XWiki.wikiuser=cn=wikiuser,ou=user,ou=group

rbr · June 23, 2018, 9:49am

Hi,

to know what is going on we need some more information. The easiest way is to install the Logging Application extension and search for ldap and set everything to TRACE.
Please note: You need to reset this everytime you restart your server!
Then you need to have a look into the catalina.out log, which you should find in /var/log/tomcat8/catalina.out on a ubuntu machine (assuming you used the deb packages), else it is in /path/to/tomcat/log/catalina.out

To get your config running, start with the easiest possible one, so please comment (add # in front of the line) xwiki.authentication.ldap.fields_mapping=name=sAMAccountName,last_name=sn,first_name=givenName,fullname=displayName,email=mail,ldap_dn=dn and xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=cn=wikiadmin,ou=admin,ou=group for now.

Also I’ve never seen this configuration before, so may want to comment it too, for the moment.
Restart your wiki and set log level to trace again (see above).

Hope that helps.

tmortagne · June 23, 2018, 1:31pm

Actually it’s already part of XWiki Standard

rbr · June 24, 2018, 1:02pm

@tmortagne: Great and thanks for the information.

lhoepfne · June 25, 2018, 8:59am

[http://192.168.1.10/xwiki/bin/loginsubmit/XWiki/XWikiLogin] TRACE x.c.l.XWikiLDAPAuthServiceImpl - Starting LDAP authentication
[http://192.168.1.10/xwiki/bin/loginsubmit/XWiki/XWikiLogin] DEBUG x.c.l.XWikiLDAPAuthServiceImpl - The provided user is null. We don’t try to authenticate, it probably means the user is in non logged mode.
[http://192.168.1.10/xwiki/bin/loginsubmit/XWiki/XWikiLogin] TRACE x.c.l.XWikiLDAPAuthServiceImpl - Starting LDAP authentication
[http://192.168.1.10/xwiki/bin/loginsubmit/XWiki/XWikiLogin] DEBUG x.c.l.XWikiLDAPAuthServiceImpl - Local LDAP authentication failed.
org.xwiki.contrib.ldap.XWikiLDAPException: Error number 0 in 5: LDAP bind failed with LDAPException.
at org.xwiki.contrib.ldap.XWikiLDAPConnection.open(XWikiLDAPConnection.java:227)
at org.xwiki.contrib.ldap.XWikiLDAPConnection.open(XWikiLDAPConnection.java:155)
at org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl.ldapAuthenticateInContext(XWikiLDAPAuthServiceImpl.java:518)
at org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl.ldapAuthenticate(XWikiLDAPAuthServiceImpl.java:334)
at org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl.authenticate(XWikiLDAPAuthServiceImpl.java:268)
at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.authenticate(MyFormAuthenticator.java:272)
at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.processLogin(MyFormAuthenticator.java:192)
at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.processLogin(MyFormAuthenticator.java:174)
at com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl.checkAuth(XWikiAuthServiceImpl.java:239)
at org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl.checkAuth(XWikiLDAPAuthServiceImpl.java:163)
at com.xpn.xwiki.XWiki.checkAuth(XWiki.java:3883)
at org.xwiki.security.authorization.internal.XWikiCachingRightService.authenticateUser(XWikiCachingRightService.java:242)
at org.xwiki.security.authorization.internal.XWikiCachingRightService.checkAccess(XWikiCachingRightService.java:272)
at com.xpn.xwiki.XWiki.checkAccess(XWiki.java:3901)
at com.xpn.xwiki.XWiki.prepareDocuments(XWiki.java:4986)
at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:363)
at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:209)
at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:425)
at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:228)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1913)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:462)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at com.xpn.xwiki.web.ActionFilter.doFilter(ActionFilter.java:112)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.xwiki.wysiwyg.filter.ConversionFilter.doFilter(ConversionFilter.java:127)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.xwiki.container.servlet.filters.internal.SetHTTPHeaderFilter.doFilter(SetHTTPHeaderFilter.java:63)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.xwiki.container.servlet.filters.internal.SavedRequestRestorerFilter.doFilter(SavedRequestRestorerFilter.java:208)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.xwiki.container.servlet.filters.internal.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:111)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.xwiki.resource.servlet.RoutingFilter.doFilter(RoutingFilter.java:134)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:496)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:650)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1460)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)
Caused by: com.novell.ldap.LDAPException: Strong Authentication Required
at com.novell.ldap.LDAPResponse.getResultException(Unknown Source)
at com.novell.ldap.LDAPResponse.chkResultCode(Unknown Source)
at com.novell.ldap.LDAPConnection.chkResultCode(Unknown Source)
at com.novell.ldap.LDAPConnection.bind(Unknown Source)
at com.novell.ldap.LDAPConnection.bind(Unknown Source)
at org.xwiki.contrib.ldap.XWikiLDAPConnection.bind(XWikiLDAPConnection.java:261)
at org.xwiki.contrib.ldap.XWikiLDAPConnection.open(XWikiLDAPConnection.java:223)
… 62 common frames omitted

rbr · June 25, 2018, 10:47am

Sounds like your binddn or bind password is wrong. Can you please double check these?

Do you have access to tools like ADSI edit or can you install tools like jxplorer http://jxplorer.org to verify your binddn?

This may be a long shot but do you use “§” in your password? I have seen crazy trouble with this, especially between OSes.

lhoepfne · June 25, 2018, 2:20pm

Thanks the issue is solved

rbr · June 25, 2018, 2:30pm

Would you mind sharing your solution/what went wrong?
Thanks.

lhoepfne · June 25, 2018, 2:36pm

I have changed the password to without special charatcers

pdwalker · June 26, 2018, 10:28am

Can you tell us what special characters were used as it sounds like it might be a bug in the password handling.

rbr · June 27, 2018, 6:34am

I tested around yesterday and found two things:

If the bindpwd is configured in xwiki.cfg: As long as you stick to ASCII everything is fine, even if you use chars like $"<[, everything different, like our german trusty friends äöüß and § breaks authentication.
If you use LDAP Query , even characters from above ASCII work. Although I did not try superspecial unicode stuff.

So I assume that it may be an issue of reading the value from xwiki.cfg and not so much of ldap itself?

lhoepfne · June 27, 2018, 6:53am

I have used this charaters alt+255 and § and now with another password its works.

rbr · June 27, 2018, 7:06am

I guess it’s time for xkcd: Password Strength

tmortagne · June 27, 2018, 9:39am

That’s because xwiki.cfg is actually a ISO 8859-1 file (old style Java properties files) and unsupported stuff have to be escaped as explained in Chapter 3. Lexical Structure.

rbr · June 27, 2018, 12:14pm

Actually I’m not convinced. The section sign is 0xA7 (167) in ANSI, ISO 8859-1 and UTF-8, so there is nothing unsupported or needed to escape yet it breaks authentication.

tmortagne · June 27, 2018, 12:17pm

Well that’s the only thing that can explain the difference between password loaded from xwiki.cfg and XWikiPreferences page.