You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@openmeetings.apache.org by mw...@beuth-hochschule.de on 2014/07/03 21:29:35 UTC
[SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
Hello Maxim, Hello Thibault,
now with the build 40 and the scope SUBTREE it works!
Great!
Thank you!
Michael
Am 02.07.14 16:30, schrieb Maxim Solodovnik:
> #38 is on the way :)
>
>
> On 2 July 2014 21:25, Michael Wuttke <mi...@beuth-hochschule.de>
> wrote:
>
>> with the build 37 or a new one?
>>
>> m.w.
>>
>> Am 02.07.2014 16:23, schrieb Maxim Solodovnik:
>>> should be fixed
>>> could you please set your scope to SUBTREE and try again?
Re: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
Posted by Maxim Solodovnik <so...@gmail.com>.
I'm glad it works :)
Thanks for the testing!
On Jul 4, 2014 2:58 AM, "Thibault Le Meur" <th...@supelec.fr>
wrote:
> Thanks for your tests and thank you to Maxim for the great work.
> Sorry that I wasn't able to help, I don't have enough free time these days.
>
> Thibault
>
>
> Envoyé de mon iPad
>
> Le 3 juil. 2014 à 21:29, mwuttke@beuth-hochschule.de a écrit :
>
> > Hello Maxim, Hello Thibault,
> >
> > now with the build 40 and the scope SUBTREE it works!
> >
> > Great!
> >
> > Thank you!
> > Michael
> >
> > Am 02.07.14 16:30, schrieb Maxim Solodovnik:
> >> #38 is on the way :)
> >>
> >>
> >> On 2 July 2014 21:25, Michael Wuttke <
> michael.wuttke@beuth-hochschule.de>
> >> wrote:
> >>
> >>> with the build 37 or a new one?
> >>>
> >>> m.w.
> >>>
> >>> Am 02.07.2014 16:23, schrieb Maxim Solodovnik:
> >>>> should be fixed
> >>>> could you please set your scope to SUBTREE and try again?
>
Re: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
Posted by Thibault Le Meur <th...@supelec.fr>.
Thanks for your tests and thank you to Maxim for the great work.
Sorry that I wasn't able to help, I don't have enough free time these days.
Thibault
Envoyé de mon iPad
Le 3 juil. 2014 à 21:29, mwuttke@beuth-hochschule.de a écrit :
> Hello Maxim, Hello Thibault,
>
> now with the build 40 and the scope SUBTREE it works!
>
> Great!
>
> Thank you!
> Michael
>
> Am 02.07.14 16:30, schrieb Maxim Solodovnik:
>> #38 is on the way :)
>>
>>
>> On 2 July 2014 21:25, Michael Wuttke <mi...@beuth-hochschule.de>
>> wrote:
>>
>>> with the build 37 or a new one?
>>>
>>> m.w.
>>>
>>> Am 02.07.2014 16:23, schrieb Maxim Solodovnik:
>>>> should be fixed
>>>> could you please set your scope to SUBTREE and try again?
Re: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
Posted by Michael Wuttke <mi...@beuth-hochschule.de>.
Hello Ed,
You are welcome. No problem. Please let us know if the LDAP
authentication is working for you as well. ;-)
Greetings,
Michael
Am 08.07.2014 15:00, schrieb BBS Technik:
> Hello Michael,
>
> thanks a lot for your fast response and the detailed informations.
> I think it is realy helpful.
>
> Best Regards
>
> Ed
>
>
>
> Gesendet: Montag, 07. Juli 2014 um 17:28 Uhr
> Von: "Michael Wuttke" <mi...@beuth-hochschule.de>
> An: user@openmeetings.apache.org
> Betreff: Re: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
> Hello Ed,
>
> sure! Here are my short howto, which works in our env. with an M$ Active
> Directory Server:
>
> O. I used the dev. builds of the version 3.0.3 with the Red5 Server
> version 1.0.3-SNAPSHOT under the hood. ;-)
>
> 1. I changed OpenMeetings to RTMS and HTTPS, you can change the ports of
> OM by using this tutorial here:
> http://openmeetings.apache.org/RTMPSAndHTTPS.html or you can configure a
> proxy for the apache server. Please see an example here in the tutorial
> step 13 on page 32:
> https://cwiki.apache.org/confluence/download/attachments/27838216/Installing%20OM2.1.1%20on%20Debian64%20Wheezy.pdf?version=1&modificationDate=1380291632000&api=v2[https://cwiki.apache.org/confluence/download/attachments/27838216/Installing%20OM2.1.1%20on%20Debian64%20Wheezy.pdf?version=1&modificationDate=1380291632000&api=v2].
>
> 2. I configured the OM server as a LDAP client. Please see the short
> steps/tutorial here: http://openmeetings.apache.org/LdapAndADS.html[http://openmeetings.apache.org/LdapAndADS.html]
>
> 3. I added the offical certificate of the OM server to a selfcreated
> keystore, added the chain of our CA to the keystore as well, added the
> offical certificate of the ldap server to a selfcreated truststore and
> added the paths of the stores and passwords to the java environment of
> the red5 server, by adding
> '-Djavax.net.ssl.keyStore=/usr/lib/red/conf/keystore
> -Djavax.net.ssl.keyStorePassword=keystorepassword
> -Djavax.net.ssl.trustStore=/usr/lib/red/conf/truststore
> -Djavax.net.ssl.trustStorePassword=truststorepassword' to the JVM_OPTS
> environment and I added '-Djavax.net.debug=all' to the LOGGING_OPTS (to
> see better, whats going on) in the ~/red5/red5.sh file.
>
> 4. The important parts of the om_ldap.cfg file for the authentication
> process against an Active Directory Server (!) looks like this:
> #LDAP URL
> ldap_conn_host=LDAP_server.Company.com
> ldap_conn_port=636
> ldap_conn_secure=true
>
> # Login distinguished name (DN) for Authentication on LDAP Server
> # Use full qualified LDAP DN
> ldap_admin_dn=CN=ldapauth,OU=Users,DC=Company,DC=com
>
> # Loginpass for Authentication on LDAP Server
> ldap_passwd=ldapauthpasswd
>
> # base to search for userdata(of user, that wants to login)
> ldap_search_base=OU=Users,DC=Company,DC=com
> #ldap_search_base=DC=Company,DC=com
>
> # Fieldnames (can differ between Ldap servers)
> ldap_search_query=(&(objectCategory=person)(objectClass=person)(sAMAccountName=%1$s))
> #ldap_search_query=(sAMAccountName=%s)
> #ldap_search_query=(CN=%s)
>
> # the scope of the search might be: OBJECT, ONELEVEL, SUBTREE
> ldap_search_scope=SUBTREE
>
> # Ldap auth type(NONE, SEARCHANDBIND, SIMPLEBIND)
> ldap_auth_type=SEARCHANDBIND
>
> # userDN format, will be used to bind if ldap_auth_type=SIMPLEBIND
> ldap_userdn_format=sAMAccountName=%s,OU=Users,DC=beuth-hochschule.de,DC=com
> #ldap_userdn_format=sAMAccountName=%s,DC=Company,DC=com
> #ldap_userdn_format=CN=%s,OU=Users,DC=Company,DC=com
> #ldap_userdn_format=CN=%s,DC=Company,DC=com
>
> # Ldap-password synchronization to OM DB
> ldap_sync_password_to_om=false
>
> # Ldap user attributes mapping
> # Set the following internal OM user attributes to their corresponding
> Ldap-attribute
> ldap_user_attr_lastname=sn
>
> And it works as expected! ;-)
>
> Thanks & Greetings,
> Michael
>
> Am 06.07.2014 20:21, schrieb BBS Technik:
>> Hello Michael,
>>
>> it is a very good news to hear, that the secure ldap login to om now works.
>> The realy working steps for the implementation I found in the mailinglist are not clear to me.
>> Could you please write down the needed steps in a short howto. I think, a lot of om admins wait for a working guideline.
>>
>> Perhapse we can pulish it on the om wiki.
>>
>>
>> Best regards Ed
>>
>>
>> Gesendet: Donnerstag, 03. Juli 2014 um 21:29 Uhr
>> Von: mwuttke@beuth-hochschule.de
>> An: user@openmeetings.apache.org
>> Betreff: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
>> Hello Maxim, Hello Thibault,
>>
>> now with the build 40 and the scope SUBTREE it works!
>>
>> Great!
>>
>> Thank you!
>> Michael
>>
>> Am 02.07.14 16:30, schrieb Maxim Solodovnik:
>>> #38 is on the way :)
>>>
>>>
>>> On 2 July 2014 21:25, Michael Wuttke <mi...@beuth-hochschule.de>
>>> wrote:
>>>
>>>> with the build 37 or a new one?
>>>>
>>>> m.w.
>>>>
>>>> Am 02.07.2014 16:23, schrieb Maxim Solodovnik:
>>>>> should be fixed
>>>>> could you please set your scope to SUBTREE and try again?
Aw: Re: [SOLVED !] (OPENMEETINGS-964) LDAP login should be
refactored
Posted by BBS Technik <do...@gmx.de>.
Hello Michael,
thanks a lot for your fast response and the detailed informations.
I think it is realy helpful.
Best Regards
Ed
Gesendet: Montag, 07. Juli 2014 um 17:28 Uhr
Von: "Michael Wuttke" <mi...@beuth-hochschule.de>
An: user@openmeetings.apache.org
Betreff: Re: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
Hello Ed,
sure! Here are my short howto, which works in our env. with an M$ Active
Directory Server:
O. I used the dev. builds of the version 3.0.3 with the Red5 Server
version 1.0.3-SNAPSHOT under the hood. ;-)
1. I changed OpenMeetings to RTMS and HTTPS, you can change the ports of
OM by using this tutorial here:
http://openmeetings.apache.org/RTMPSAndHTTPS.html or you can configure a
proxy for the apache server. Please see an example here in the tutorial
step 13 on page 32:
https://cwiki.apache.org/confluence/download/attachments/27838216/Installing%20OM2.1.1%20on%20Debian64%20Wheezy.pdf?version=1&modificationDate=1380291632000&api=v2[https://cwiki.apache.org/confluence/download/attachments/27838216/Installing%20OM2.1.1%20on%20Debian64%20Wheezy.pdf?version=1&modificationDate=1380291632000&api=v2].
2. I configured the OM server as a LDAP client. Please see the short
steps/tutorial here: http://openmeetings.apache.org/LdapAndADS.html[http://openmeetings.apache.org/LdapAndADS.html]
3. I added the offical certificate of the OM server to a selfcreated
keystore, added the chain of our CA to the keystore as well, added the
offical certificate of the ldap server to a selfcreated truststore and
added the paths of the stores and passwords to the java environment of
the red5 server, by adding
'-Djavax.net.ssl.keyStore=/usr/lib/red/conf/keystore
-Djavax.net.ssl.keyStorePassword=keystorepassword
-Djavax.net.ssl.trustStore=/usr/lib/red/conf/truststore
-Djavax.net.ssl.trustStorePassword=truststorepassword' to the JVM_OPTS
environment and I added '-Djavax.net.debug=all' to the LOGGING_OPTS (to
see better, whats going on) in the ~/red5/red5.sh file.
4. The important parts of the om_ldap.cfg file for the authentication
process against an Active Directory Server (!) looks like this:
#LDAP URL
ldap_conn_host=LDAP_server.Company.com
ldap_conn_port=636
ldap_conn_secure=true
# Login distinguished name (DN) for Authentication on LDAP Server
# Use full qualified LDAP DN
ldap_admin_dn=CN=ldapauth,OU=Users,DC=Company,DC=com
# Loginpass for Authentication on LDAP Server
ldap_passwd=ldapauthpasswd
# base to search for userdata(of user, that wants to login)
ldap_search_base=OU=Users,DC=Company,DC=com
#ldap_search_base=DC=Company,DC=com
# Fieldnames (can differ between Ldap servers)
ldap_search_query=(&(objectCategory=person)(objectClass=person)(sAMAccountName=%1$s))
#ldap_search_query=(sAMAccountName=%s)
#ldap_search_query=(CN=%s)
# the scope of the search might be: OBJECT, ONELEVEL, SUBTREE
ldap_search_scope=SUBTREE
# Ldap auth type(NONE, SEARCHANDBIND, SIMPLEBIND)
ldap_auth_type=SEARCHANDBIND
# userDN format, will be used to bind if ldap_auth_type=SIMPLEBIND
ldap_userdn_format=sAMAccountName=%s,OU=Users,DC=beuth-hochschule.de,DC=com
#ldap_userdn_format=sAMAccountName=%s,DC=Company,DC=com
#ldap_userdn_format=CN=%s,OU=Users,DC=Company,DC=com
#ldap_userdn_format=CN=%s,DC=Company,DC=com
# Ldap-password synchronization to OM DB
ldap_sync_password_to_om=false
# Ldap user attributes mapping
# Set the following internal OM user attributes to their corresponding
Ldap-attribute
ldap_user_attr_lastname=sn
And it works as expected! ;-)
Thanks & Greetings,
Michael
Am 06.07.2014 20:21, schrieb BBS Technik:
> Hello Michael,
>
> it is a very good news to hear, that the secure ldap login to om now works.
> The realy working steps for the implementation I found in the mailinglist are not clear to me.
> Could you please write down the needed steps in a short howto. I think, a lot of om admins wait for a working guideline.
>
> Perhapse we can pulish it on the om wiki.
>
>
> Best regards Ed
>
>
> Gesendet: Donnerstag, 03. Juli 2014 um 21:29 Uhr
> Von: mwuttke@beuth-hochschule.de
> An: user@openmeetings.apache.org
> Betreff: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
> Hello Maxim, Hello Thibault,
>
> now with the build 40 and the scope SUBTREE it works!
>
> Great!
>
> Thank you!
> Michael
>
> Am 02.07.14 16:30, schrieb Maxim Solodovnik:
>> #38 is on the way :)
>>
>>
>> On 2 July 2014 21:25, Michael Wuttke <mi...@beuth-hochschule.de>
>> wrote:
>>
>>> with the build 37 or a new one?
>>>
>>> m.w.
>>>
>>> Am 02.07.2014 16:23, schrieb Maxim Solodovnik:
>>>> should be fixed
>>>> could you please set your scope to SUBTREE and try again?
Re: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
Posted by Michael Wuttke <mi...@beuth-hochschule.de>.
Hello Ed,
sure! Here are my short howto, which works in our env. with an M$ Active
Directory Server:
O. I used the dev. builds of the version 3.0.3 with the Red5 Server
version 1.0.3-SNAPSHOT under the hood. ;-)
1. I changed OpenMeetings to RTMS and HTTPS, you can change the ports of
OM by using this tutorial here:
http://openmeetings.apache.org/RTMPSAndHTTPS.html or you can configure a
proxy for the apache server. Please see an example here in the tutorial
step 13 on page 32:
https://cwiki.apache.org/confluence/download/attachments/27838216/Installing%20OM2.1.1%20on%20Debian64%20Wheezy.pdf?version=1&modificationDate=1380291632000&api=v2.
2. I configured the OM server as a LDAP client. Please see the short
steps/tutorial here: http://openmeetings.apache.org/LdapAndADS.html
3. I added the offical certificate of the OM server to a selfcreated
keystore, added the chain of our CA to the keystore as well, added the
offical certificate of the ldap server to a selfcreated truststore and
added the paths of the stores and passwords to the java environment of
the red5 server, by adding
'-Djavax.net.ssl.keyStore=/usr/lib/red/conf/keystore
-Djavax.net.ssl.keyStorePassword=keystorepassword
-Djavax.net.ssl.trustStore=/usr/lib/red/conf/truststore
-Djavax.net.ssl.trustStorePassword=truststorepassword' to the JVM_OPTS
environment and I added '-Djavax.net.debug=all' to the LOGGING_OPTS (to
see better, whats going on) in the ~/red5/red5.sh file.
4. The important parts of the om_ldap.cfg file for the authentication
process against an Active Directory Server (!) looks like this:
#LDAP URL
ldap_conn_host=LDAP_server.Company.com
ldap_conn_port=636
ldap_conn_secure=true
# Login distinguished name (DN) for Authentication on LDAP Server
# Use full qualified LDAP DN
ldap_admin_dn=CN=ldapauth,OU=Users,DC=Company,DC=com
# Loginpass for Authentication on LDAP Server
ldap_passwd=ldapauthpasswd
# base to search for userdata(of user, that wants to login)
ldap_search_base=OU=Users,DC=Company,DC=com
#ldap_search_base=DC=Company,DC=com
# Fieldnames (can differ between Ldap servers)
ldap_search_query=(&(objectCategory=person)(objectClass=person)(sAMAccountName=%1$s))
#ldap_search_query=(sAMAccountName=%s)
#ldap_search_query=(CN=%s)
# the scope of the search might be: OBJECT, ONELEVEL, SUBTREE
ldap_search_scope=SUBTREE
# Ldap auth type(NONE, SEARCHANDBIND, SIMPLEBIND)
ldap_auth_type=SEARCHANDBIND
# userDN format, will be used to bind if ldap_auth_type=SIMPLEBIND
ldap_userdn_format=sAMAccountName=%s,OU=Users,DC=beuth-hochschule.de,DC=com
#ldap_userdn_format=sAMAccountName=%s,DC=Company,DC=com
#ldap_userdn_format=CN=%s,OU=Users,DC=Company,DC=com
#ldap_userdn_format=CN=%s,DC=Company,DC=com
# Ldap-password synchronization to OM DB
ldap_sync_password_to_om=false
# Ldap user attributes mapping
# Set the following internal OM user attributes to their corresponding
Ldap-attribute
ldap_user_attr_lastname=sn
And it works as expected! ;-)
Thanks & Greetings,
Michael
Am 06.07.2014 20:21, schrieb BBS Technik:
> Hello Michael,
>
> it is a very good news to hear, that the secure ldap login to om now works.
> The realy working steps for the implementation I found in the mailinglist are not clear to me.
> Could you please write down the needed steps in a short howto. I think, a lot of om admins wait for a working guideline.
>
> Perhapse we can pulish it on the om wiki.
>
>
> Best regards Ed
>
>
> Gesendet: Donnerstag, 03. Juli 2014 um 21:29 Uhr
> Von: mwuttke@beuth-hochschule.de
> An: user@openmeetings.apache.org
> Betreff: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
> Hello Maxim, Hello Thibault,
>
> now with the build 40 and the scope SUBTREE it works!
>
> Great!
>
> Thank you!
> Michael
>
> Am 02.07.14 16:30, schrieb Maxim Solodovnik:
>> #38 is on the way :)
>>
>>
>> On 2 July 2014 21:25, Michael Wuttke <mi...@beuth-hochschule.de>
>> wrote:
>>
>>> with the build 37 or a new one?
>>>
>>> m.w.
>>>
>>> Am 02.07.2014 16:23, schrieb Maxim Solodovnik:
>>>> should be fixed
>>>> could you please set your scope to SUBTREE and try again?
Aw: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
Posted by BBS Technik <do...@gmx.de>.
Hello Michael,
it is a very good news to hear, that the secure ldap login to om now works.
The realy working steps for the implementation I found in the mailinglist are not clear to me.
Could you please write down the needed steps in a short howto. I think, a lot of om admins wait for a working guideline.
Perhapse we can pulish it on the om wiki.
Best regards Ed
Gesendet: Donnerstag, 03. Juli 2014 um 21:29 Uhr
Von: mwuttke@beuth-hochschule.de
An: user@openmeetings.apache.org
Betreff: [SOLVED !] (OPENMEETINGS-964) LDAP login should be refactored
Hello Maxim, Hello Thibault,
now with the build 40 and the scope SUBTREE it works!
Great!
Thank you!
Michael
Am 02.07.14 16:30, schrieb Maxim Solodovnik:
> #38 is on the way :)
>
>
> On 2 July 2014 21:25, Michael Wuttke <mi...@beuth-hochschule.de>
> wrote:
>
>> with the build 37 or a new one?
>>
>> m.w.
>>
>> Am 02.07.2014 16:23, schrieb Maxim Solodovnik:
>>> should be fixed
>>> could you please set your scope to SUBTREE and try again?