Hi,
I got a problem with the LDAP configuration in 6.2. Seems some problem with finding roles by the username.
But I don't know what is exactly wrong.
I think there is an error in the OpenKM.xml config. What exactly should the group-search-* contain?
Also I got a working okm 5.1 as reference for the settings. (I took the settings from these working 5.1 instance)
But first of all, some logs and so on.
Logfile:
Thanks!
I got a problem with the LDAP configuration in 6.2. Seems some problem with finding roles by the username.
But I don't know what is exactly wrong.
I think there is an error in the OpenKM.xml config. What exactly should the group-search-* contain?
Also I got a working okm 5.1 as reference for the settings. (I took the settings from these working 5.1 instance)
But first of all, some logs and so on.
Logfile:
Code: Select all
OpenKM.xml
...
2013-01-07 14:01:02,372 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.authentication.ProviderManager - Authentication attempt using org.springframework.security.ldap.authentication.LdapAuthenticationProvider
2013-01-07 14:01:02,372 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.authentication.LdapAuthenticationProvider - Processing authentication request for user: okmstudent
2013-01-07 14:01:02,377 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.search.FilterBasedLdapUserSearch - Searching for user 'okmstudent', with user search [ searchFilter: '(&(sAMAccountName={0})(memberOf=cn=OpenKMAllUsers,cn=Users,dc=mmtopen,dc=de))', searchBase: 'ou=MMTOpenUsers,dc=mmtopen,dc=de', scope: subtree, searchTimeLimit: 0, derefLinkFlag: false ]
2013-01-07 14:01:02,387 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.SpringSecurityLdapTemplate - Searching for entry under DN '', base = 'ou=MMTOpenUsers,dc=mmtopen,dc=de', filter = '(&(sAMAccountName={0})(memberOf=cn=OpenKMAllUsers,cn=Users,dc=mmtopen,dc=de))'
2013-01-07 14:01:02,389 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.SpringSecurityLdapTemplate - Found DN: cn=OpenKM Student,ou=Studenten,ou=MMTOpenUsers,dc=mmtopen,dc=de
2013-01-07 14:01:02,392 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.authentication.BindAuthenticator - Attempting to bind as cn=OpenKM Student,ou=Studenten,ou=MMTOpenUsers,dc=mmtopen,dc=de
2013-01-07 14:01:02,392 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.DefaultSpringSecurityContextSource - Removing pooling flag for user cn=OpenKM Student,ou=Studenten,ou=MMTOpenUsers,dc=mmtopen,dc=de
2013-01-07 14:01:02,398 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.authentication.BindAuthenticator - Retrieving attributes...
2013-01-07 14:01:02,405 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Getting authorities for user cn=OpenKM Student,ou=Studenten,ou=MMTOpenUsers,dc=mmtopen,dc=de
2013-01-07 14:01:02,409 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Searching for roles for user 'okmstudent', DN = 'cn=OpenKM Student,ou=Studenten,ou=MMTOpenUsers,dc=mmtopen,dc=de', with filter (member={1}) in search base 'cn=Users,dc=mmtopen,dc=de'
2013-01-07 14:01:02,412 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.SpringSecurityLdapTemplate - Using filter: (member=okmstudent)
2013-01-07 14:01:02,412 [http-bio-0.0.0.0-8080-exec-3] INFO org.springframework.ldap.core.LdapTemplate - The returnObjFlag of supplied SearchControls is not set but a ContextMapper is used - setting flag to true
2013-01-07 14:01:02,414 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator - Roles from search: []
2013-01-07 14:01:02,415 [http-bio-0.0.0.0-8080-exec-3] DEBUG org.springframework.security.ldap.userdetails.LdapUserDetailsMapper - Mapping user details from context with DN: cn=OpenKM Student,ou=Studenten,ou=MMTOpenUsers,dc=mmtopen,dc=de
...
2013-01-07 14:01:02,469 [http-bio-0.0.0.0-8080-exec-1] INFO com.openkm.module.db.DbAuthModule - Create okm:trash/okmstudent
2013-01-07 14:01:02,476 [http-bio-0.0.0.0-8080-exec-1] ERROR com.openkm.module.db.DbAuthModule - 6b5ca2f3-a901-4caa-878a-402eea293d42 : /okm:trash
com.openkm.core.PathNotFoundException: 6b5ca2f3-a901-4caa-878a-402eea293d42 : /okm:trash
at com.openkm.module.db.stuff.SecurityHelper.checkRead(SecurityHelper.java:106)
at com.openkm.dao.NodeFolderDAO.create(NodeFolderDAO.java:102)
at com.openkm.module.db.DbAuthModule.createBase(DbAuthModule.java:437)
at com.openkm.module.db.DbAuthModule.loadUserData(DbAuthModule.java:400)
at com.openkm.module.db.DbAuthModule.login(DbAuthModule.java:81)
at com.openkm.api.OKMAuth.login(OKMAuth.java:52)
at org.apache.jsp.frontend.index_jsp._jspService(index_jsp.java:68)
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:432)
at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:390)
at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:334)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:311)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:116)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:101)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:182)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:173)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:309)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Code: Select all
OpenKM Konfiguration in the database (put from working 5.1 copy):
<security:ldap-server id="ldapServer"
url="ldap://<MY SERVER>:389"
manager-dn="cn=<USER>,ou=LMMT,ou=MMTOpenUsers,dc=mmtopen,dc=de"
manager-password="<PASSWORD>"/>
<security:authentication-manager alias="authenticationManager">
<security:ldap-authentication-provider
server-ref="ldapServer"
user-search-base="ou=MMTOpenUsers,dc=mmtopen,dc=de"
user-search-filter="(&(sAMAccountName={0})(memberOf=cn=OpenKMAllUsers,cn=Users,dc=mmtopen,dc=de))"
group-search-base="cn=Users,dc=mmtopen,dc=de"
group-search-filter="(member={1})"
group-role-attribute="cn"
role-prefix="none">
</security:ldap-authentication-provider>
</security:authentication-manager>
Code: Select all
Some advice? default.user.role UserRole
default.admin.role OpenKMAdmins
principal.adapter com.openkm.principal.DatabasePrincipalAdapter
principal.ldap.server ldap://<MYSERVER>:389
principal.ldap.security.principal CN=<USER>,ou=LMMT,ou=MMTOpenUsers,dc=mmtopen,dc=de
principal.ldap.security.credentials <PASSWORD>
principal.ldap.referral
principal.ldap.users.from.roles false
principal.ldap.user.search.base ou=MMTOpenUsers,dc=mmtopen,dc=de
principal.ldap.user.search.filter (&(objectClass=person)(memberOf=cn=OpenKMAllUsers,cn=Users,dc=mmtopen,dc=de))
principal.ldap.user.attribute cn
principal.ldap.role.search.base cn=Users,dc=mmtopen,dc=de
principal.ldap.role.search.filter (&(objectClass=group)(memberOf=cn=OpenKMGroups,cn=Users,dc=mmtopen,dc=de))
principal.ldap.role.attribute cn
principal.ldap.username.search.base ou=MMTOpenUsers,dc=mmtopen,dc=de
principal.ldap.username.search.filter (&(objectClass=person)(memberOf=cn=OpenKMAllUsers,cn=Users,dc=mmtopen,dc=de)(sAMAccountName={0}))
principal.ldap.username.attribute cn
principal.ldap.mail.search.base ou=MMTOpenUsers,dc=mmtopen,dc=de
principal.ldap.mail.search.filter (&(objectClass=person)(sAMAccountName={0}))
principal.ldap.mail.attribute mail
principal.ldap.users.by.role.search.base cn={0},cn=Users,dc=mmtopen,dc=de
principal.ldap.users.by.role.search.filter (objectClass=group)
principal.ldap.users.by.role.attribute member
principal.ldap.roles.by.user.search.base ou=MMTOpenUsers,dc=mmtopen,dc=de
principal.ldap.roles.by.user.search.filter (&(objectClass=person)(cn={0}))
principal.ldap.roles.by.user.attribute memberOf
Thanks!

