Problem with LDAP in OpenKM 6.2
PostPosted:Mon Nov 05, 2012 4:18 pm
Hello
I have a two problem with LDAP in OpenKM 6.2:
1)with administrator accounts. I can log in, and can see a administrator bookmark, but when I click on it, I get page with text: "Unauthorized access".
2) I use non adminitrator accounts, so when loggin i got a message:
com.openkm.core.RepositoryException: PathNotFoundException: 0a45bcad-3485-41d7-b0d0-df300b64d505 : /okm:trash
and from log file:
I will be glad for any help.
Ldap config:
I have a two problem with LDAP in OpenKM 6.2:
1)with administrator accounts. I can log in, and can see a administrator bookmark, but when I click on it, I get page with text: "Unauthorized access".
2) I use non adminitrator accounts, so when loggin i got a message:
com.openkm.core.RepositoryException: PathNotFoundException: 0a45bcad-3485-41d7-b0d0-df300b64d505 : /okm:trash
and from log file:
Code: Select all
When I use standard log in without LDAP, I can see(from LDAP) users, roles - > everything looks alright.INFO org.dozer.DozerBeanMapper - Initializing a new instance of dozer bean mapper.
2012-11-05 13:09:37,851 [http-bio-8443-exec-2] INFO org.dozer.loader.CustomMappingsLoader - Using the following xml files to load custom mappings for the bean mapper instance: [dozerBeanMapping.xml]
2012-11-05 13:09:37,851 [http-bio-8443-exec-2] INFO org.dozer.loader.CustomMappingsLoader - Trying to find xml mapping file: dozerBeanMapping.xml
2012-11-05 13:09:37,860 [http-bio-8443-exec-2] INFO org.dozer.loader.CustomMappingsLoader - Using URL [file:/opt/tomcat-7.0.27/webapps/OpenKM/WEB-INF/classes/dozerBeanMapping.xml] to load custom xml mappings
2012-11-05 13:09:37,930 [http-bio-8443-exec-2] INFO org.dozer.loader.CustomMappingsLoader - Successfully loaded custom xml mappings from URL: [file:/opt/tomcat-7.0.27/webapps/OpenKM/WEB-INF/classes/dozerBeanMapping.xml]
2012-11-05 13:09:42,216 [http-bio-8443-exec-8] WARN com.openkm.util.DocConverter - system.openoffice.path not configured
2012-11-05 13:17:45,330 [http-bio-8443-exec-4] INFO org.springframework.ldap.core.LdapTemplate - The returnObjFlag of supplied SearchControls is not set but a ContextMapper is used - setting flag to true
2012-11-05 13:17:45,490 [http-bio-8443-exec-8] INFO com.openkm.module.db.DbAuthModule - Create okm:trash/koc245
2012-11-05 13:17:45,519 [http-bio-8443-exec-8] ERROR com.openkm.module.db.DbAuthModule - 0a45bcad-3485-41d7-b0d0-df300b64d505 : /okm:trash
com.openkm.core.PathNotFoundException: 0a45bcad-3485-41d7-b0d0-df300b64d505 : /okm:trash
at com.openkm.module.db.stuff.SecurityHelper.checkRead(SecurityHelper.java:106)
at com.openkm.dao.NodeFolderDAO.create(NodeFolderDAO.java:101)
at com.openkm.module.db.DbAuthModule.createBase(DbAuthModule.java:437)
at com.openkm.module.db.DbAuthModule.loadUserData(DbAuthModule.java:400)
at com.openkm.module.db.DbAuthModule.login(DbAuthModule.java:81)
at com.openkm.api.OKMAuth.login(OKMAuth.java:52)
at org.apache.jsp.frontend.index_jsp._jspService(index_jsp.java:68)
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:432)
at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:390)
at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:334)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:311)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:116)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:101)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:182)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:173)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:225)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:999)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:565)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:309)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
I will be glad for any help.
Ldap config:
Code: Select all
OpenKM.xml:principal.ldap.mail.attribute = mail
principal.ldap.mail.search.base = ou=users,o=cz
principal.ldap.mail.search.filter = (&(objectClass=inetOrgPerson)(cn={0}))
principal.ldap.referral = follow
principal.ldap.role.attribute = cn
principal.ldap.role.search.base = ou=groups,o=cz
principal.ldap.role.search.filter = (cn=ZAM_*)
principal.ldap.roles.by.user.attribute = groupMembership
principal.ldap.roles.by.user.search.base = ou=users,o=cz
principal.ldap.roles.by.user.search.filter = (&(objectClass=inetOrgPerson)(cn={0}))
principal.ldap.security.credentials =
principal.ldap.security.principal =
principal.ldap.server = ldaps://ldap.xxx:636
principal.ldap.user.attribute = cn
principal.ldap.user.search.base = ou=users,o=cz
principal.ldap.user.search.filter = (groupMembership=cn=ZAM_xxx,ou=xxx,ou=groups,o=cz)
principal.ldap.username.attribute = fullName
principal.ldap.username.search.base = ou=users,o=cz
principal.ldap.username.search.filter = (&(objectClass=inetOrgPerson)(cn={0}))
principal.ldap.users.by.role.attribute = member
principal.ldap.users.by.role.search.base = ou=groups,o=cz
principal.ldap.users.by.role.search.filter = (&(objectClass=posixGroup)(cn={0}))
principal.ldap.users.from.roles = false
system.login.lowercase=true
Code: Select all
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref="ldapAuthProvider" />
</security:authentication-manager>
<beans:bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
<beans:constructor-arg value="ldaps://ldap.xxx:636/"/>
<beans:property name="userDn" value=""/>
<beans:property name="password" value=""/>
<beans:property name="baseEnvironmentProperties">
<beans:map>
<beans:entry>
<beans:key>
<beans:value>java.naming.referral</beans:value>
</beans:key>
<beans:value>follow</beans:value>
</beans:entry>
</beans:map>
</beans:property>
</beans:bean>
<beans:bean id="ldapAuthProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
<beans:constructor-arg>
<beans:bean class="org.springframework.security.ldap.authentication.BindAuthenticator">
<beans:constructor-arg ref="contextSource"/>
<beans:property name="userSearch" ref="userSearch"/>
</beans:bean>
</beans:constructor-arg>
<beans:constructor-arg>
<beans:bean class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator">
<beans:constructor-arg ref="contextSource"/>
<beans:constructor-arg value="ou=groups,o=cz"/>
<beans:property name="groupSearchFilter" value="member={0}"/>
<beans:property name="groupRoleAttribute" value="cn"/>
<beans:property name="searchSubtree" value="true" />
<beans:property name="convertToUpperCase" value="true" />
<beans:property name="rolePrefix" value="" />
</beans:bean>
</beans:constructor-arg>
</beans:bean>
<beans:bean id="userSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
<beans:constructor-arg index="0" value="ou=users,o=cz"/>
<beans:constructor-arg index="1" value="cn={0}" />
<beans:constructor-arg index="2" ref="contextSource" />
<beans:property name="searchSubtree" value="true" />
</beans:bean>
