[Solved] Issue using LDAP: Users are in different organization unit

Help / Discuss
1

Good morning,

I am setting up xwiki from the Docker image and i’m trying to set-it up so my users can login from LDAP.

I went through the following references to solve my issue:

I also enabled trace debugging in logback.xml.

I ended up with the following addition to my xwiki.cfg (that is everything I added):

xwiki.authentication.authclass=org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl
xwiki.authentication.ldap=1
xwiki.authentication.ldap.trylocal=0
xwiki.authentication.ldap.server=192.168.*.*
xwiki.authentication.ldap.port=389
xwiki.authentication.ldap.base_DN=dc=******,dc=***
xwiki.authentication.ldap.bind_DN=cn=*******,ou=******,dc=********,dc=*******
xwiki.authentication.ldap.bind_pass=**********
xwiki.authentication.ldap.UID_attr=sAMAccountName

If I use JXplorer with the base DN, the bind_dn as the user and the bind_pass, my Read Only AD user can browse the entries and I can find the users i am looking for under the following different DN.

  • CN=My User,OU=Somewhere,OU=Some Logical Group,DC=******,DC=***
  • CN=Some User,OU=Somewhere Else,OU=Some Logical Group,DC=******,DC=***

Let’s say i’m trying to use the account associated with the following DN CN=My User,OU=Somewhere,OU=Some Logical Group,DC=******,DC=***, by using it’s associated login (sAMAccountName) , it ends up trying to bind to the server like so:

2017-08-22 12:49:55,214 [http://**************:8080/bin/loginsubmit/XWiki/XWikiLogin] DEBUG o.x.c.l.XWikiLDAPConnection    - Binding to LDAP server with credentials login=[cn="The sAMAccountName value",dc=********,dc=***] 
2017-08-22 12:49:55,292 [http://**************:8080/bin/loginsubmit/XWiki/XWikiLogin] DEBUG x.c.l.XWikiLDAPAuthServiceImpl - Local LDAP authentication failed. 
org.xwiki.contrib.ldap.XWikiLDAPException: Error number 0 in 5: LDAP bind failed with LDAPException.
	at org.xwiki.contrib.ldap.XWikiLDAPConnection.open(XWikiLDAPConnection.java:227)
	at org.xwiki.contrib.ldap.XWikiLDAPConnection.open(XWikiLDAPConnection.java:155)
	at org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl.ldapAuthenticateInContext(XWikiLDAPAuthServiceImpl.java:518)
	at org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl.ldapAuthenticate(XWikiLDAPAuthServiceImpl.java:334)
	at org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl.authenticate(XWikiLDAPAuthServiceImpl.java:268)
	at org.xwiki.contrib.ldap.XWikiLDAPAuthServiceImpl.checkAuth(XWikiLDAPAuthServiceImpl.java:163)
Caused by: com.novell.ldap.LDAPException: Invalid Credentials
	at com.novell.ldap.LDAPResponse.getResultException(Unknown Source)
	at com.novell.ldap.LDAPResponse.chkResultCode(Unknown Source)
	at com.novell.ldap.LDAPConnection.chkResultCode(Unknown Source)
	at com.novell.ldap.LDAPConnection.bind(Unknown Source)
	at com.novell.ldap.LDAPConnection.bind(Unknown Source)
	at org.xwiki.contrib.ldap.XWikiLDAPConnection.bind(XWikiLDAPConnection.java:261)
	at org.xwiki.contrib.ldap.XWikiLDAPConnection.open(XWikiLDAPConnection.java:223)

Hopefull, someone can point me at what needs to be changed in the configuration file.

Regards,

Philippe.

2

Hi,

I managed to get it working…

I had the UI previously installed. I think that some of that configuration was lingering somewhere since when I reinstalled it, the old bind_DN was there, which seems to match what I had in the log.

I do not know where that configuration was hidden. I uninstalled the UI application and restarted the container.

Now I reinstalled the UI application, ported the configuration there and it’s working.

I suspect some cleanup has to be done when the UI is removed.

3

The UI is just a helper to manipulate the wiki level configuration stored in an object in XWiki.XWikiPreferences page (which has priority over the xwiki.cfg file) so when you uninstall the UI the wiki level configuration is still there.

4

How would you “clean up” that object once you remove the UI?

Thank you.

5

With the UI you can empty all the fields.

Without the UI you need to:

2 Likes
6

I am facing a similar issue. do I need to configure LDAP binding in XWiki.XWikiPreferences as well as on xwiki.cfg?