You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Eric B." <eb...@hotmail.com> on 2009/08/06 22:49:06 UTC
Trouble configuring LDAP authentication
Hi,
I'm trying to get the JNDIRealms working using my LDAP server in Tomcat
6.0.18 for the manager and admin applications and am having difficulty
getting them to work. I tried following instructions in the tomcat doc
site, and think I have things fairly well set up. I have enabled full logs
on my LDAP server (slapd), and see the requests coming through. The problem
is that neither application seems to authenticate properly. My guess is
that I made a mistake somewhere in my LDAP tree.
I searched around and found additional documentation in Pro Apache Tomcat 6
by Matthew Moodie (apress publishing) that seems to indicate things step by
step as well. In the book, he refers to JNDIRealm logs:
<snip>
For a further insight into the communication between Tomcat and the
directory server, examine the log for the service component.
JNDIRealm[Catalina]: Connecting to URL ldap://localhost:389
JNDIRealm[Catalina]: lookupUser(admin)
JNDIRealm[Catalina]: dn=uid=admin,ou=people,dc=mycompany,dc=com
JNDIRealm[Catalina]: retrieving attribute userPassword
JNDIRealm[Catalina]: validating credentials
JNDIRealm[Catalina]: Username admin successfully authenticated
JNDIRealm[Catalina]: getRoles(uid=admin,ou=people,dc=mycompany,dc=com)
JNDIRealm[Catalina]: Searching role base 'ou=groups,dc=mycompany,dc=com' for
attribute 'cn'
JNDIRealm[Catalina]: With filter expression
'(uniqueMember=uid=admin,ou=people,dc=mycompany,dc=com)'
JNDIRealm[Catalina]: retrieving values for attribute cn
JNDIRealm[Catalina]: Returning 1 roles
JNDIRealm[Catalina]: Found role admin
</snip>
However, try as I might, I can't seem to figure out how to enable the
logging for the JNDIRealm.
I have placed the <Realm> object definition under my <Engine>, but no matter
what I see to do, I can't get any logging to display. I have even added the
following to logging.properties to no avail.
org.apache.catalina.core.ContainerBase.[Catalina].level = ALL
org.apache.catalina.core.ContainerBase.[Catalina].handlers =
4admin.org.apache.juli.FileHandler
org.apache.catalina.realm.RealmBase.level = ALL
org.apache.catalina.realm.RealmBase = 4admin.org.apache.juli.FileHandler
Can anyone help point me in the right direction as to how to get this
logging to be displayes so that I might be able to resolve my problem?
Thanks!
Eric
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Re: Re: Trouble configuring LDAP authentication
Posted by Geofrey Rainey <Ge...@tvnz.co.nz>.
Interesting. My configuration uses the latter - by doing a bind, getting
the user object, and comparing it locally.
Thanks.
-----Original Message-----
From: news [mailto:news@ger.gmane.org] On Behalf Of Eric B.
Sent: Wednesday, 12 August 2009 7:03 a.m.
To: users@tomcat.apache.org
Subject: Re: Re: Trouble configuring LDAP authentication
> "Geofrey Rainey" <Ge...@tvnz.co.nz> wrote in message
>
news:FCFF2EC7A020964FBC98B17F17A88AC4018BADCE@AKVXCH01.tvnzad.tvnz.co.nz
...
> I remember the big issue I faced regarding the JNDIRealm auth were the
> parameters in my Realm definition, there was one line that once added
> Everything started working, I think it was either "referrals" or "
> "userSearch="(sAMAccountName={0})" - which I recall were both
necessary
> in my instance, or one of the "role|usersubtree" ones.
>
> I found the following link invaluable in configuring my server, it's a
> must read:
>
> http://www.jspwiki.org/wiki/ActiveDirectoryIntegration
>
> Regarding logging, I found this tutorial quite helpful:
>
> http://wiki.apache.org/tomcat/Logging_Tutorial
>
Thanks for the links and the feedback. Several hours of reading docs
online, source code, pulling hair and of randomly trying things, I
finally
realized that I had to enable the TRACE level of debugging at the
container
level to get the debugging out. Unfortunately, doing that means having
to
put the realm defn in the actual context, or there is way too much noise
generated at a higher level. But it did finally give me the logging
information I needed.
Finally, with some additional help, I discovered that the pwd storage
mechanism in the LDAP server didn't match what Tomcat was expecting, so
I
had to drop the userPassword parameter in the Realm defn, which makes
Tomcat
validate the user/pwd by trying a simple bind to the LDAP server using
the
user's username/pwd instead of retreiving the user's object and checking
the
pwd itself.
Finally, everything seems to work. .... Several hours later.
Thanks again,
Eric
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
==========================================================
For more information on the Television New Zealand Group, visit us
online at tvnz.co.nz
==========================================================
CAUTION: This e-mail and any attachment(s) contain information that
is intended to be read only by the named recipient(s). This information
is not to be used or stored by any other person and/or organisation.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Re: Trouble configuring LDAP authentication
Posted by "Eric B." <eb...@hotmail.com>.
> "Geofrey Rainey" <Ge...@tvnz.co.nz> wrote in message
> news:FCFF2EC7A020964FBC98B17F17A88AC4018BADCE@AKVXCH01.tvnzad.tvnz.co.nz...
> I remember the big issue I faced regarding the JNDIRealm auth were the
> parameters in my Realm definition, there was one line that once added
> Everything started working, I think it was either "referrals" or "
> "userSearch="(sAMAccountName={0})" - which I recall were both necessary
> in my instance, or one of the "role|usersubtree" ones.
>
> I found the following link invaluable in configuring my server, it's a
> must read:
>
> http://www.jspwiki.org/wiki/ActiveDirectoryIntegration
>
> Regarding logging, I found this tutorial quite helpful:
>
> http://wiki.apache.org/tomcat/Logging_Tutorial
>
Thanks for the links and the feedback. Several hours of reading docs
online, source code, pulling hair and of randomly trying things, I finally
realized that I had to enable the TRACE level of debugging at the container
level to get the debugging out. Unfortunately, doing that means having to
put the realm defn in the actual context, or there is way too much noise
generated at a higher level. But it did finally give me the logging
information I needed.
Finally, with some additional help, I discovered that the pwd storage
mechanism in the LDAP server didn't match what Tomcat was expecting, so I
had to drop the userPassword parameter in the Realm defn, which makes Tomcat
validate the user/pwd by trying a simple bind to the LDAP server using the
user's username/pwd instead of retreiving the user's object and checking the
pwd itself.
Finally, everything seems to work. .... Several hours later.
Thanks again,
Eric
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Re: Trouble configuring LDAP authentication
Posted by Geofrey Rainey <Ge...@tvnz.co.nz>.
I remember the big issue I faced regarding the JNDIRealm auth were the
parameters in my Realm definition, there was one line that once added
Everything started working, I think it was either "referrals" or "
"userSearch="(sAMAccountName={0})" - which I recall were both necessary
in my instance, or one of the "role|usersubtree" ones.
I found the following link invaluable in configuring my server, it's a
must read:
http://www.jspwiki.org/wiki/ActiveDirectoryIntegration
Regarding logging, I found this tutorial quite helpful:
http://wiki.apache.org/tomcat/Logging_Tutorial
-----Original Message-----
From: news [mailto:news@ger.gmane.org] On Behalf Of Eric B.
Sent: Friday, 7 August 2009 1:49 p.m.
To: users@tomcat.apache.org
Subject: Re: Trouble configuring LDAP authentication
> "Geofrey Rainey" <Ge...@tvnz.co.nz> wrote in message
> I had this same issue, both with JNDIRealm, and logging.
>
> Firstly the JNDIRealm; I was authenticating to an AD server and
couldn't
> get the parameters right in my Realm definition. This is how I
resolved
> it - this realm definition resides within an Engine directive:
Luckily, I'm authenticating against a linux ldap server. I've read of
troubles with AD authentication.
> <Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
> connectionURL="ldap://hostname:389"
> connectionName="<us...@test.domain>"
> connectionPassword="<password>"
> userSearch="(sAMAccountName={0})"
> userBase="DC=test,DC=domain"
> referrals="follow"
> userSubtree="true"
> roleBase="DC=test,DC=domain"
> roleName="cn"
> roleSubtree="true"
> roleSearch="(member={0})"
> />
Thanks for sharing your config; mine is fairly similar:
<Realm className="org.apache.catalina.realm.JNDIRealm"
connectionURL="ldap://snoopy.domain.com:389"
debug="true"
userPassword="userPassword"
userPattern="uid={0},ou=People,dc=domain,dc=com"
roleBase="ou=Tomcat,ou=Group,dc=domain,dc=com"
roleName="cn"
roleSearch="(uniqueMember={0})"
/>
Note that I am not using ConnectionName or Password as I have ldap set
up
for anonymous reads. Currently, I have my Role cn's listed in a a
Tomcat ou
which is under a Group ou. Like I said, I see logging on my ldap server
that it is getting requested properly and is responding found, not
found,
etc. However, I can't seem to get any logs out from Tomcat.
> You also have to configure the <security-constraint> parameter in your
> web.xml.
I am using the admin & manager webapps that are shipped with Tomcat
(manager
part of Tomcat 6, and admin from Tomcat 5.5). They both work fine when
using the UserDatabaseRealm, but when I switch the the JNDIRealm, I get
nowhere.
>
> Secondly logging. It seems odd that it's not working. I didn't have to
> do anything with logging, it just wrote to the logs/Catalina..... logs
> by default.
I'm not getting any LDAP outputs to my logs at all. I even switched to
log4j logging by Tomcat in case the default JavaLogger was causing me
problems of sorts, but to no additional use. The only thing I have
managed
to get out in the logs relating to ldap is a single connection line, and
that was only once I expliticity enabled all logging for
org.apache.catalina.realm package.
DEBUG main
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/admin] -
Connecting to URL ldap://snoopy.domain.com:389
After that, the next log entries I get are (they don't tell me much,
however):
DEBUG http-8080-1 org.apache.catalina.realm.RealmBase - Checking
constraint 'SecurityConstraint[Protected Area]' against GET /index.jsp
-->
true
DEBUG http-8080-1 org.apache.catalina.realm.RealmBase - User data
constraint has no restrictions
ERROR http-8080-1 org.apache.struts.action.RequestProcessor - Invalid
path
was requested /login
DEBUG http-8080-1
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/admin].[
admin.login_jsp]
- Disabling the response for futher output
> With the JNDIRealm configuration within Tomcat I'm sure it should just
> log by default as mine did..?
I would have thought so / hoped so as well. But obviously there must be
something different / wrong with my configuration.
I am pasting my entire server.xml file here - is there something that I
am
missing in there?
Thanks!
Eric
SERVER.XML:
-----------------
<?xml version='1.0' encoding='utf-8'?>
<Server port="8005" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.core.JasperListener" />
<Listener
className="org.apache.catalina.mbeans.ServerLifecycleListener"
/>
<Listener
className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"
/>
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<Service name="Catalina">
<!-- standard HTTP Tomcat Connector -->
<Connector port="8080" redirectPort="8443" protocol="HTTP/1.1"
maxThreads="500" minSpareThreads="100"
maxSpareThreads="25"
enableLookups="false"
acceptCount="500" connectionTimeout="20000"
disableUploadTimeout="true"
compression="on"
compressableMimeType="text/html,text/xml,text/plain,text/javascript,text
/css"
/>
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443"
minSpareThreads="50"
maxThreads="10000" />
<Engine name="Catalina" defaultHost="localhost">
<!--
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
-->
<Realm className="org.apache.catalina.realm.JNDIRealm"
connectionURL="ldap://snoopy.domain.com:389"
debug="true"
userPassword="userPassword"
userPattern="uid={0},ou=People,dc=domain,dc=com"
roleBase="ou=Tomcat,ou=Group,dc=domain,dc=com"
roleName="cn"
roleSearch="(uniqueMember={0})"
/>
<Host name="localhost" appBase="${catalina.base}/webapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
</Host>
</Engine>
</Service>
</Server>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
==========================================================
For more information on the Television New Zealand Group, visit us
online at tvnz.co.nz
==========================================================
CAUTION: This e-mail and any attachment(s) contain information that
is intended to be read only by the named recipient(s). This information
is not to be used or stored by any other person and/or organisation.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Trouble configuring LDAP authentication
Posted by "Eric B." <eb...@hotmail.com>.
> "Geofrey Rainey" <Ge...@tvnz.co.nz> wrote in message
> I had this same issue, both with JNDIRealm, and logging.
>
> Firstly the JNDIRealm; I was authenticating to an AD server and couldn't
> get the parameters right in my Realm definition. This is how I resolved
> it - this realm definition resides within an Engine directive:
Luckily, I'm authenticating against a linux ldap server. I've read of
troubles with AD authentication.
> <Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
> connectionURL="ldap://hostname:389"
> connectionName="<us...@test.domain>"
> connectionPassword="<password>"
> userSearch="(sAMAccountName={0})"
> userBase="DC=test,DC=domain"
> referrals="follow"
> userSubtree="true"
> roleBase="DC=test,DC=domain"
> roleName="cn"
> roleSubtree="true"
> roleSearch="(member={0})"
> />
Thanks for sharing your config; mine is fairly similar:
<Realm className="org.apache.catalina.realm.JNDIRealm"
connectionURL="ldap://snoopy.domain.com:389"
debug="true"
userPassword="userPassword"
userPattern="uid={0},ou=People,dc=domain,dc=com"
roleBase="ou=Tomcat,ou=Group,dc=domain,dc=com"
roleName="cn"
roleSearch="(uniqueMember={0})"
/>
Note that I am not using ConnectionName or Password as I have ldap set up
for anonymous reads. Currently, I have my Role cn's listed in a a Tomcat ou
which is under a Group ou. Like I said, I see logging on my ldap server
that it is getting requested properly and is responding found, not found,
etc. However, I can't seem to get any logs out from Tomcat.
> You also have to configure the <security-constraint> parameter in your
> web.xml.
I am using the admin & manager webapps that are shipped with Tomcat (manager
part of Tomcat 6, and admin from Tomcat 5.5). They both work fine when
using the UserDatabaseRealm, but when I switch the the JNDIRealm, I get
nowhere.
>
> Secondly logging. It seems odd that it's not working. I didn't have to
> do anything with logging, it just wrote to the logs/Catalina..... logs
> by default.
I'm not getting any LDAP outputs to my logs at all. I even switched to
log4j logging by Tomcat in case the default JavaLogger was causing me
problems of sorts, but to no additional use. The only thing I have managed
to get out in the logs relating to ldap is a single connection line, and
that was only once I expliticity enabled all logging for
org.apache.catalina.realm package.
DEBUG main
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/admin] -
Connecting to URL ldap://snoopy.domain.com:389
After that, the next log entries I get are (they don't tell me much,
however):
DEBUG http-8080-1 org.apache.catalina.realm.RealmBase - Checking
constraint 'SecurityConstraint[Protected Area]' against GET /index.jsp -->
true
DEBUG http-8080-1 org.apache.catalina.realm.RealmBase - User data
constraint has no restrictions
ERROR http-8080-1 org.apache.struts.action.RequestProcessor - Invalid path
was requested /login
DEBUG http-8080-1
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/admin].[admin.login_jsp]
- Disabling the response for futher output
> With the JNDIRealm configuration within Tomcat I'm sure it should just
> log by default as mine did..?
I would have thought so / hoped so as well. But obviously there must be
something different / wrong with my configuration.
I am pasting my entire server.xml file here - is there something that I am
missing in there?
Thanks!
Eric
SERVER.XML:
-----------------
<?xml version='1.0' encoding='utf-8'?>
<Server port="8005" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.core.JasperListener" />
<Listener className="org.apache.catalina.mbeans.ServerLifecycleListener"
/>
<Listener
className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<Service name="Catalina">
<!-- standard HTTP Tomcat Connector -->
<Connector port="8080" redirectPort="8443" protocol="HTTP/1.1"
maxThreads="500" minSpareThreads="100"
maxSpareThreads="25"
enableLookups="false"
acceptCount="500" connectionTimeout="20000"
disableUploadTimeout="true"
compression="on"
compressableMimeType="text/html,text/xml,text/plain,text/javascript,text/css"
/>
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443"
minSpareThreads="50"
maxThreads="10000" />
<Engine name="Catalina" defaultHost="localhost">
<!--
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
-->
<Realm className="org.apache.catalina.realm.JNDIRealm"
connectionURL="ldap://snoopy.domain.com:389"
debug="true"
userPassword="userPassword"
userPattern="uid={0},ou=People,dc=domain,dc=com"
roleBase="ou=Tomcat,ou=Group,dc=domain,dc=com"
roleName="cn"
roleSearch="(uniqueMember={0})"
/>
<Host name="localhost" appBase="${catalina.base}/webapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
</Host>
</Engine>
</Service>
</Server>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Trouble configuring LDAP authentication
Posted by Geofrey Rainey <Ge...@tvnz.co.nz>.
I had this same issue, both with JNDIRealm, and logging.
Firstly the JNDIRealm; I was authenticating to an AD server and couldn't
get the parameters right in my Realm definition. This is how I resolved
it - this realm definition resides within an Engine directive:
<Realm className="org.apache.catalina.realm.JNDIRealm" debug="99"
connectionURL="ldap://hostname:389"
connectionName="<us...@test.domain>"
connectionPassword="<password>"
userSearch="(sAMAccountName={0})"
userBase="DC=test,DC=domain"
referrals="follow"
userSubtree="true"
roleBase="DC=test,DC=domain"
roleName="cn"
roleSubtree="true"
roleSearch="(member={0})"
/>
(The test.domain is the domain you setup within your LDAP server)
You also have to configure the <security-constraint> parameter in your
web.xml.
Secondly logging. It seems odd that it's not working. I didn't have to
do anything with logging, it just wrote to the logs/Catalina..... logs
by default. I did have big problems getting logging to work using my own
Customized login module however, in this case I had to instantiate
Logging class objects within my Java code and set the logging level in
the class to match the logging level in logging.properties, until I did
this, I got very minimal logging - but that is within a specific class
and I don't think this is your situation right?
With the JNDIRealm configuration within Tomcat I'm sure it should just
log
By default as mine did..?
-----Original Message-----
From: news [mailto:news@ger.gmane.org] On Behalf Of Eric B.
Sent: Friday, 7 August 2009 8:49 a.m.
To: users@tomcat.apache.org
Subject: Trouble configuring LDAP authentication
Hi,
I'm trying to get the JNDIRealms working using my LDAP server in Tomcat
6.0.18 for the manager and admin applications and am having difficulty
getting them to work. I tried following instructions in the tomcat doc
site, and think I have things fairly well set up. I have enabled full
logs
on my LDAP server (slapd), and see the requests coming through. The
problem
is that neither application seems to authenticate properly. My guess is
that I made a mistake somewhere in my LDAP tree.
I searched around and found additional documentation in Pro Apache
Tomcat 6
by Matthew Moodie (apress publishing) that seems to indicate things step
by
step as well. In the book, he refers to JNDIRealm logs:
<snip>
For a further insight into the communication between Tomcat and the
directory server, examine the log for the service component.
JNDIRealm[Catalina]: Connecting to URL ldap://localhost:389
JNDIRealm[Catalina]: lookupUser(admin)
JNDIRealm[Catalina]: dn=uid=admin,ou=people,dc=mycompany,dc=com
JNDIRealm[Catalina]: retrieving attribute userPassword
JNDIRealm[Catalina]: validating credentials
JNDIRealm[Catalina]: Username admin successfully authenticated
JNDIRealm[Catalina]: getRoles(uid=admin,ou=people,dc=mycompany,dc=com)
JNDIRealm[Catalina]: Searching role base 'ou=groups,dc=mycompany,dc=com'
for
attribute 'cn'
JNDIRealm[Catalina]: With filter expression
'(uniqueMember=uid=admin,ou=people,dc=mycompany,dc=com)'
JNDIRealm[Catalina]: retrieving values for attribute cn
JNDIRealm[Catalina]: Returning 1 roles
JNDIRealm[Catalina]: Found role admin
</snip>
However, try as I might, I can't seem to figure out how to enable the
logging for the JNDIRealm.
I have placed the <Realm> object definition under my <Engine>, but no
matter
what I see to do, I can't get any logging to display. I have even added
the
following to logging.properties to no avail.
org.apache.catalina.core.ContainerBase.[Catalina].level = ALL
org.apache.catalina.core.ContainerBase.[Catalina].handlers =
4admin.org.apache.juli.FileHandler
org.apache.catalina.realm.RealmBase.level = ALL
org.apache.catalina.realm.RealmBase = 4admin.org.apache.juli.FileHandler
Can anyone help point me in the right direction as to how to get this
logging to be displayes so that I might be able to resolve my problem?
Thanks!
Eric
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
==========================================================
For more information on the Television New Zealand Group, visit us
online at tvnz.co.nz
==========================================================
CAUTION: This e-mail and any attachment(s) contain information that
is intended to be read only by the named recipient(s). This information
is not to be used or stored by any other person and/or organisation.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org