Access denied for 1 user

[S3SysAdmin]

Hello everybody

We use OpenKM (Version: 5.1.10-SNAPSHOT build: 7560) with LDAP authentication running on Debian 2.6.32
We have about 700 users working on OpenKM since 2008
699 users have no problems (even new users) and they can access the application without problems.

but just old 1 user (with no problems in the past), now, cannot access because he gets:

"HTTP Status 403 - Access to the requested resource has been denied" from "JBossWeb/2.0.1.GA"

user's LDAP information are perfect (checked several times and never changed in the past)
We try different browser and different PC.. same result.

This is for sure an openKM issue...

I'm going crazy. Any idea??

[S3SysAdmin]

OK, I solved.

The problem was the user's password, which contains double $...
Changing the password, the problem disappears.

Thank you

[jllort]

Extrange problem. Normally problems comes with userid not with password. Two $ in password has generated it ? seems some kind of internal bug in jboss - ldap authentication

[S3SysAdmin]

Yes very very strange...

Originally, the user's password was Ale$$andro9
I changed the password to Abc01abc
I made the first login with success..
Later I re-changed the user's password to Ale$$andro9
and then the user was able to login with Ale$$andro9

Actually I'm a little bit confuse..
I didn't think the password value could make this kind of issues..
Maybe I'm wrong.. but for sure changing the passoword has solved the problem

Bye

[pavila]

Anyway I recommend to upgrade to OpenKM 6.2 because 5.1 branch is deprecated.

[jllort]

could be locked user by do not change password ? policy disable after sometime if you do not change password.

[S3SysAdmin]

the locked user condition or expired password was immediately excluded because
the user was able to login to all other systems without problems (all our systems use the same LDAP Server for authentication)

but it's simple to replicate the issue:

- create a test user on M$ active directory (call him testuser)
- set Ale$$andro9 as password (and uncheck "change on first login".. if you like set "passoword never expires")
- open web site and try to login with testuser /Ale$$andro9

does it work??

if it works... mahh.. maybe it's just my problem..
if it doesn't, change the password to Abc01abc and try again with testuser / Abc01abc
Now it should work.... re-change testuser's password again to Ale$$andro9 and try to login
it still should work..