You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@turbine.apache.org by Thomas Fröhlich <th...@medav.de> on 2010/04/26 11:26:03 UTC
Turbine Framework and LDAP
Hi,
is there anybody out there who uses the Turbine framework together with
LDAP or an AD-server? Unfortunately I failed to connect Turbine to our
AD-server.
I have observed the TCP communication on LDAP port 389 using WIRESHARK.
The Turbine connect binding works fine but retrieving the TurbineGroup
informations from LDAP Turbine crashes with an NullPointerException. You
will find the whole stacktrace and a TCP communication snippet at the
end of this mail.
The groups TurbineGroupGlobal an TurbineGroupService are LDAP group
objects expanded by the auxiliary Turbine object turbineGroup. The test
user "mhernandez" is a LDAP user object expanded by the auxiliary
Turbine object turbineUser. All required attributes are filled.
I have red all old mailing list entries concerning LDAP. I'm right if I
assume, that LDAP support isn't finally implemented into Turbine?
Thank you in advance for all hints :)
Kind regards
Thomas Froehlich
************************** snippet stacktrace **************************
2010-04-23 16:23:31,576 [TP-Processor2] ERROR org.apache.turbine.Turbine
- Turbine.handleException:
org.apache.turbine.util.security.DataBackendException: Failed to build
ACL for user 'mhernandez'
at
org.apache.turbine.services.security.ldap.LDAPSecurityService.getACL(LDAPSecurityService.java:139)
at
org.apache.turbine.services.security.TurbineSecurity.getACL(TurbineSecurity.java:444)
at
org.apache.turbine.modules.actions.AccessController.doPerform(AccessController.java:99)
at org.apache.turbine.modules.Action.perform(Action.java:51)
at org.apache.turbine.modules.ActionLoader.exec(ActionLoader.java:102)
at org.apache.turbine.Turbine.doGet(Turbine.java:760)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:690)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:568)
at
org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:421)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190)
at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283)
at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767)
at
org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697)
at
org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889)
at
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690)
at java.lang.Thread.run(Thread.java:595)
Caused by: java.lang.NullPointerException
at java.util.TreeMap.compare(TreeMap.java:1093)
at java.util.TreeMap.put(TreeMap.java:465)
at org.apache.turbine.util.security.GroupSet.add(GroupSet.java:79)
at org.apache.turbine.util.security.GroupSet.add(GroupSet.java:98)
at org.apache.turbine.util.security.GroupSet.<init>(GroupSet.java:66)
at
org.apache.turbine.services.security.ldap.LDAPSecurityService.getGroups(LDAPSecurityService.java:470)
at
org.apache.turbine.services.security.BaseSecurityService.getAllGroups(BaseSecurityService.java:1164)
at
org.apache.turbine.services.security.ldap.LDAPSecurityService.getACL(LDAPSecurityService.java:108)
... 24 more
2010-04-23 16:51:20,382 [TP-Processor9] ERROR
org.apache.turbine.services.pull.TurbinePullService - Could not
instantiate request tool acl from a de.tewisoft.aloe.turbine.ACLTool object
java.lang.NullPointerException
at java.lang.String.compareTo(String.java:998)
at java.lang.String.compareTo(String.java:90)
at java.util.TreeMap.compare(TreeMap.java:1093)
at java.util.TreeMap.getEntry(TreeMap.java:347)
at java.util.TreeMap.get(TreeMap.java:265)
at
org.apache.turbine.util.security.GroupSet.getGroupByName(GroupSet.java:173)
at
org.apache.turbine.services.security.BaseSecurityService.getGlobalGroup(BaseSecurityService.java:961)
at
org.apache.turbine.services.security.TurbineSecurity.getGlobalGroup(TurbineSecurity.java:595)
at
org.apache.turbine.util.security.TurbineAccessControlList.getPermissions(TurbineAccessControlList.java:148)
at de.tewisoft.aloe.turbine.ACLTool.init(ACLTool.java:43)
at
org.apache.turbine.services.pull.TurbinePullService.initTool(TurbinePullService.java:736)
at
org.apache.turbine.services.pull.TurbinePullService.populateWithRequestTools(TurbinePullService.java:456)
at
org.apache.turbine.services.pull.TurbinePullService.populateContext(TurbinePullService.java:378)
at
org.apache.turbine.services.velocity.TurbineVelocityService.getContext(TurbineVelocityService.java:250)
at
org.apache.turbine.services.velocity.TurbineVelocity.getContext(TurbineVelocity.java:122)
at
org.apache.turbine.modules.pages.VelocityPage.doBuildBeforeAction(VelocityPage.java:50)
at
org.apache.turbine.modules.pages.DefaultPage.doBuild(DefaultPage.java:110)
at org.apache.turbine.modules.Page.build(Page.java:56)
at org.apache.turbine.modules.PageLoader.exec(PageLoader.java:104)
at org.apache.turbine.Turbine.doGet(Turbine.java:796)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:690)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:568)
at
org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:421)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190)
at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283)
at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767)
at
org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697)
at
org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889)
at
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690)
at java.lang.Thread.run(Thread.java:595)
******************* snippet LDAP TCP communication *********************
No. Time Source Destination
Protocol Info
32 2010-04-23 16:23:31.642312 192.168.20.231 192.168.20.173
LDAP searchResEntry(2)
"CN=TurbineGroupGlobal,OU=Turbine,OU=myproject,DC=example,DC=com" |
searchResEntry(2)
"CN=TurbineGroupService,OU=Turbine,OU=myproject,DC=example,DC=com" |
searchResDone(2) success [2 results]
Frame 32 (1840 bytes on wire, 1840 bytes captured)
Ethernet II, Src: fa:a2:57:b8:8f:1b (fa:a2:57:b8:8f:1b), Dst:
4e:58:d9:f6:61:fd (4e:58:d9:f6:61:fd)
Internet Protocol, Src: 192.168.20.231 (192.168.20.231), Dst:
192.168.20.173 (192.168.20.173)
Transmission Control Protocol, Src Port: ldap (389), Dst Port:
turbonote-2 (34249), Seq: 23, Ack: 185, Len: 1774
Source port: ldap (389)
Destination port: turbonote-2 (34249)
[Stream index: 3]
Sequence number: 23 (relative sequence number)
[Next sequence number: 1797 (relative sequence number)]
Acknowledgement number: 185 (relative ack number)
Header length: 32 bytes
Flags: 0x18 (PSH, ACK)
Window size: 66304 (scaled)
Checksum: 0xaaeb [validation disabled]
Options: (12 bytes)
[SEQ/ACK analysis]
[PDU Size: 873]
[PDU Size: 879]
[PDU Size: 22]
Lightweight-Directory-Access-Protocol
LDAPMessage searchResEntry(2)
"CN=TurbineGroupGlobal,OU=Turbine,OU=myproject,DC=example,DC=com" [1 result]
messageID: 2
protocolOp: searchResEntry (4)
searchResEntry
objectName:
CN=TurbineGroupGlobal,OU=Turbine,OU=myproject,DC=example,DC=com
attributes: 17 items
PartialAttributeList item objectClass
PartialAttributeList item cn
PartialAttributeList item distinguishedName
PartialAttributeList item instanceType
PartialAttributeList item whenCreated
PartialAttributeList item whenChanged
PartialAttributeList item uSNCreated
PartialAttributeList item uSNChanged
PartialAttributeList item name
PartialAttributeList item objectGUID
PartialAttributeList item objectSid
PartialAttributeList item sAMAccountName
PartialAttributeList item sAMAccountType
PartialAttributeList item groupType
PartialAttributeList item objectCategory
PartialAttributeList item dSCorePropagationData
PartialAttributeList item turbineGroupName
[Response To: 31]
[Time: 0.000349000 seconds]
Lightweight-Directory-Access-Protocol
LDAPMessage searchResEntry(2)
"CN=TurbineGroupService,OU=Turbine,OU=myproject,DC=example,DC=com" [2
results]
messageID: 2
protocolOp: searchResEntry (4)
searchResEntry
objectName:
CN=TurbineGroupService,OU=Turbine,OU=myproject,DC=example,DC=com
attributes: 17 items
PartialAttributeList item objectClass
PartialAttributeList item cn
PartialAttributeList item distinguishedName
PartialAttributeList item instanceType
PartialAttributeList item whenCreated
PartialAttributeList item whenChanged
PartialAttributeList item uSNCreated
PartialAttributeList item uSNChanged
PartialAttributeList item name
PartialAttributeList item objectGUID
PartialAttributeList item objectSid
PartialAttributeList item sAMAccountName
PartialAttributeList item sAMAccountType
PartialAttributeList item groupType
PartialAttributeList item objectCategory
PartialAttributeList item dSCorePropagationData
PartialAttributeList item turbineGroupName
[Response To: 31]
[Time: 0.000349000 seconds]
Lightweight-Directory-Access-Protocol
LDAPMessage searchResDone(2) success [2 results]
messageID: 2
protocolOp: searchResDone (5)
searchResDone
resultCode: success (0)
matchedDN:
errorMessage:
[Response To: 31]
[Time: 0.000349000 seconds]
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@turbine.apache.org
For additional commands, e-mail: user-help@turbine.apache.org
Re: Turbine Framework and LDAP
Posted by Thomas Fröhlich <th...@medav.de>.
Hi Juergen,
> could you please post your LDAP Configuration for Turbine?
I used the original Turbine schema from turbine.schema and have made
some little chaneges to use it in an MS Windows 2008 R2 AD server.
I have made the following substitutions or assumptions:
a) Microsoft uses with the X500 OID his own id format which is NOT
comparable with the openldap id's. OIDs are assigned by the ISO
standard. Therefore every OID must start with "0", "1" or "2" for
instance. In case of the TURBINE openldap ids we expand these ids with
the prefixes "1.4" for attributes and "1.5" for classes.
b) To create the attributes and object classes we used Microsoft's
"Active Directory Schema snap-in"
(http://technet.microsoft.com/en-us/library/cc755885%28WS.10%29.aspx)
According to Microsoft's "Active Directory Schema snap-in" drop-down
menu "Syntax" we mapped the syntax notations as follows:
* 1.3.6.1.4.1.1466.115.121.1.40 to "octet string"
* 1.3.6.1.4.1.1466.115.121.1.15 to "case insensitive string"
* 1.3.6.1.4.1.1466.115.121.1.53 to "UTC coded time"
* 1.3.6.1.4.1.1466.115.121.1.26 to "IA5 String"
c) All TURBINE openldap attributes with a missing entry "SINGLE-VALUE"
are assigned as "Multi-Valued" in Microsoft's AD server.
You will find all config informations at the end of this mail. Please
let me know if you need more specific informations.
Kind regards
Thomas
--------------------------------------
And here is our "AD compliant" Turbine schema. The attributes and
objects are created in the LDAP schema section
(DN: CN=Schema,CN=Configuration,DC=example,DC=com)
attributetype ( 1.4.15530.1.2
NAME 'turbineObjectData'
DESC 'Turbine object data'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40)
attributetype ( 1.4.15530.1.3
NAME 'turbinePermissionName'
DESC 'Turbine permission name'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15)
attributetype ( 1.4.15530.1.5
NAME 'turbineUserCreationDate'
DESC 'Turbine user creation timestamp'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.53
SINGLE-VALUE)
attributetype ( 1.4.15530.1.6
NAME 'turbineUserFirstName'
DESC 'Turbine user first name'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15)
attributetype ( 1.4.15530.1.7
NAME 'turbineUserLastLogon'
DESC 'Turbine user last login timestamp'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.53
SINGLE-VALUE)
attributetype ( 1.4.15530.1.8
NAME 'turbineUserLastModifiedTime'
DESC 'Turbine user modification timestamp'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.53
SINGLE-VALUE)
attributetype ( 1.4.15530.1.9
NAME 'turbineUserLastName'
DESC 'Turbine user last name'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15)
attributetype ( 1.4.15530.1.10
NAME 'turbineUserMailAddress'
DESC 'Turbine user mail address'
EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26)
attributetype ( 1.4.15530.1.11
NAME 'turbineUserPassword'
DESC 'Turbine user pwd'
EQUALITY caseExactMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE)
attributetype ( 1.4.15530.1.12
NAME 'turbineUserUniqueId'
DESC 'Turbine unique user id'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE)
attributetype ( 1.4.15530.1.13
NAME 'turbineGroupName'
DESC 'Turbine group name'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15)
attributetype ( 1.4.15530.1.14
NAME 'turbineRoleName'
DESC 'Turbine role name'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15)
objectclass ( 1.5.15530.2.1
NAME 'turbineUser'
DESC 'Turbine user'
SUP top
AUXILIARY
MUST ( turbineUserUniqueId )
MAY ( turbineObjectData $ turbineUserCreationDate $
turbineUserFirstName $
turbineUserLastLogon $ turbineUserLastModifiedTime $
turbineUserLastName $
turbineUserMailAddress $ userPassword ))
objectclass ( 1.5.15530.2.2
NAME 'turbineUserGroup'
DESC 'Turbine User Group '
SUP top
AUXILIARY
MUST ( turbineUserUniqueId $ turbineGroupName )
MAY ( turbineRoleName $ turbineObjectData ))
objectclass ( 1.5.15530.2.3
NAME 'turbineGroup'
DESC 'Turbine Group'
SUP top
AUXILIARY
MUST ( turbineGroupName )
MAY ( turbineObjectData ))
objectclass ( 1.5.15530.2.4
NAME 'turbineRole'
DESC 'Turbine role'
SUP top
AUXILIARY
MUST ( turbineRoleName )
MAY ( turbineObjectData $ turbinePermissionName ))
objectclass ( 1.5.15530.2.5
NAME 'turbinePermission'
DESC 'Turbine Permission'
SUP top
AUXILIARY
MUST ( turbinePermissionName )
MAY ( turbineObjectData ))
*******************************************************************
The LDAP tree is as following (some project specific names are replaced
by placeholders):
DC=example,DC=com
|
|-OU=myproject
| |
| `OU=Turbine
| |
| |-CN=TurbinePermissionDelete
| |- ...
| |-CN=TurbineRoleEditor
| |- ...
| |-CN=TurbineGroupClobal
| |- ...
| |-CN=TUG_Maria_Hernandez
| |- ...
| |-CN=Maria Hernandez
| ` ...
|
|-CN=Users
| |
. .
*******************************************************************
Examples for every type of a Turbine object:
dn: CN=TurbinePermissionDelete,OU=Turbine,OU=myproject,DC=example,DC=com
objectClass: top
objectClass: turbinePermission
objectClass: group
groupType: -2147483646
instanceType: 4
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=example,DC=com
turbinePermissionName: MayDelete
cn: TurbinePermissionDelete
distinguishedName:
CN=TurbinePermissionDelete,OU=Turbine,OU=myproject,DC=example,DC=com
dSCorePropagationData: 16010101000000.0Z
name: TurbinePermissionDelete
objectGUID:: sZviLj5Vu0SrO+v1UfVumw==
objectSid:: AQUAAAAAAAUVAAAAn7xFeqHuYWk/K/AGkQQAAA==
sAMAccountName: TurbinePermissionDelete
sAMAccountType: 268435456
uSNChanged: 353800
uSNCreated: 353654
whenChanged: 20100421075518.0Z
whenCreated: 20100421064025.0Z
-----------------
dn: CN=TurbineRoleEditor,OU=Turbine,OU=myproject,DC=example,DC=com
objectClass: top
objectClass: turbineRole
objectClass: group
groupType: -2147483646
instanceType: 4
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=example,DC=com
turbineRoleName: editor
cn: TurbineRoleEditor
distinguishedName:
CN=TurbineRoleEditor,OU=Turbine,OU=myproject,DC=example,DC=co
m
dSCorePropagationData: 16010101000000.0Z
name: TurbineRoleEditor
objectGUID:: GoDLMaCAnUW/sIi2Xfkz6Q==
objectSid:: AQUAAAAAAAUVAAAAn7xFeqHuYWk/K/AGnwQAAA==
sAMAccountName: TurbineRoleEditor
sAMAccountType: 268435456
turbinePermissionName: DMFUser
turbinePermissionName: SeeInvisible
turbinePermissionName: SeeContacts
turbinePermissionName: MayPublishUserTags
turbinePermissionName: MayModify
turbinePermissionName: HasModifyButton
turbinePermissionName: MayExport
turbinePermissionName: PerformAction
turbinePermissionName: SeeScreen
turbinePermissionName: MayLogin
uSNChanged: 369135
uSNCreated: 354082
whenChanged: 20100423125045.0Z
whenCreated: 20100421110400.0Z
-----------------
dn: CN=TurbineGroupGlobal,OU=Turbine,OU=myproject,DC=example,DC=com
objectClass: top
objectClass: turbineGroup
objectClass: group
groupType: -2147483646
instanceType: 4
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=example,DC=com
turbineGroupName: global
cn: TurbineGroupGlobal
distinguishedName:
CN=TurbineGroupGlobal,OU=Turbine,OU=myproject,DC=example,DC=com
dSCorePropagationData: 16010101000000.0Z
name: TurbineGroupGlobal
objectGUID:: wIJvHdsVn0mO1tWx7KjMKQ==
objectSid:: AQUAAAAAAAUVAAAAn7xFeqHuYWk/K/AGjAQAAA==
sAMAccountName: TurbineGroupGlobal
sAMAccountType: 268435456
uSNChanged: 369243
uSNCreated: 352137
whenChanged: 20100423132300.0Z
whenCreated: 20100420121820.0Z
-----------------
dn: CN=TUG_Maria_Hernandez,OU=Turbine,OU=myproject,DC=example,DC=com
objectClass: top
objectClass: turbineUserGroup
objectClass: group
groupType: -2147483646
instanceType: 4
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=example,DC=com
turbineGroupName: global
turbineUserUniqueId: mhernandez
cn: TUG_Maria_Hernandez
distinguishedName:
CN=TUG_Maria_Hernandez,OU=Turbine,OU=myproject,DC=example,DC=
com
dSCorePropagationData: 16010101000000.0Z
name: TUG_Maria_Hernandez
objectGUID:: pLpvTDaSmk2Ltu4F12sNgw==
objectSid:: AQUAAAAAAAUVAAAAn7xFeqHuYWk/K/AGpQQAAA==
sAMAccountName: TUG_Maria_Hernandez
sAMAccountType: 268435456
turbineRoleName: editor
uSNChanged: 375291
uSNCreated: 375287
whenChanged: 20100426131621.0Z
whenCreated: 20100426131410.0Z
-----------------
dn: CN=Maria Hernandez,OU=Turbine,OU=myproject,DC=example,DC=com
objectClass: top
objectClass: turbineUser
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Maria Hernandez
instanceType: 4
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=example,DC=com
turbineUserUniqueId: mhernandez
accountExpires: 9223372036854775807
badPasswordTime: 0
badPwdCount: 0
codePage: 0
countryCode: 0
displayName: Maria Hernandez
distinguishedName: CN=Maria
Hernandez,OU=Turbine,OU=myproject,DC=example,DC=com
dSCorePropagationData: 16010101000000.0Z
givenName: Maria
lastLogoff: 0
lastLogon: 0
lastLogonTimestamp: 129165058316974001
logonCount: 0
mail: mhernande@itweb.com
name: Maria Hernandez
objectGUID:: XFbA3PRlKkmUZ4MAzBvcMQ==
objectSid:: AQUAAAAAAAUVAAAAn7xFeqHuYWk/K/AGogQAAA==
primaryGroupID: 513
pwdLastSet: 129164953562684115
sAMAccountName: mhernandez
sAMAccountType: 805306368
sn: Hernandez
userAccountControl: 66048
userPrincipalName: mhernandez@example.com
uSNChanged: 369288
uSNCreated: 368871
whenChanged: 20100423141711.0Z
whenCreated: 20100423112236.0Z
*******************************************************************
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@turbine.apache.org
For additional commands, e-mail: user-help@turbine.apache.org
Re: Turbine Framework and LDAP
Posted by Juergen Hoffmann <ho...@apache.org>.
Hi Thomas,
could you please post your LDAP Configuration for Turbine?
kind regards
Juergen
Am 26.04.2010 11:26, schrieb Thomas Fröhlich:
> Hi,
>
> is there anybody out there who uses the Turbine framework together
> with LDAP or an AD-server? Unfortunately I failed to connect Turbine
> to our AD-server.
>
> I have observed the TCP communication on LDAP port 389 using
> WIRESHARK. The Turbine connect binding works fine but retrieving the
> TurbineGroup informations from LDAP Turbine crashes with an
> NullPointerException. You will find the whole stacktrace and a TCP
> communication snippet at the end of this mail.
>
> The groups TurbineGroupGlobal an TurbineGroupService are LDAP group
> objects expanded by the auxiliary Turbine object turbineGroup. The
> test user "mhernandez" is a LDAP user object expanded by the auxiliary
> Turbine object turbineUser. All required attributes are filled.
>
> I have red all old mailing list entries concerning LDAP. I'm right if
> I assume, that LDAP support isn't finally implemented into Turbine?
>
> Thank you in advance for all hints :)
>
> Kind regards
> Thomas Froehlich
>
>
> ************************** snippet stacktrace **************************
>
>
> 2010-04-23 16:23:31,576 [TP-Processor2] ERROR
> org.apache.turbine.Turbine - Turbine.handleException:
> org.apache.turbine.util.security.DataBackendException: Failed to build
> ACL for user 'mhernandez'
> at
> org.apache.turbine.services.security.ldap.LDAPSecurityService.getACL(LDAPSecurityService.java:139)
>
> at
> org.apache.turbine.services.security.TurbineSecurity.getACL(TurbineSecurity.java:444)
>
> at
> org.apache.turbine.modules.actions.AccessController.doPerform(AccessController.java:99)
>
> at org.apache.turbine.modules.Action.perform(Action.java:51)
> at
> org.apache.turbine.modules.ActionLoader.exec(ActionLoader.java:102)
> at org.apache.turbine.Turbine.doGet(Turbine.java:760)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:690)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
>
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
>
> at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
>
> at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
>
> at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
>
> at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
>
> at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:568)
> at
> org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:421)
>
> at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
>
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
>
> at
> org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190)
> at
> org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283)
> at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767)
> at
> org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697)
>
> at
> org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889)
>
> at
> org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690)
>
> at java.lang.Thread.run(Thread.java:595)
> Caused by: java.lang.NullPointerException
> at java.util.TreeMap.compare(TreeMap.java:1093)
> at java.util.TreeMap.put(TreeMap.java:465)
> at org.apache.turbine.util.security.GroupSet.add(GroupSet.java:79)
> at org.apache.turbine.util.security.GroupSet.add(GroupSet.java:98)
> at org.apache.turbine.util.security.GroupSet.<init>(GroupSet.java:66)
> at
> org.apache.turbine.services.security.ldap.LDAPSecurityService.getGroups(LDAPSecurityService.java:470)
>
> at
> org.apache.turbine.services.security.BaseSecurityService.getAllGroups(BaseSecurityService.java:1164)
>
> at
> org.apache.turbine.services.security.ldap.LDAPSecurityService.getACL(LDAPSecurityService.java:108)
>
> ... 24 more
> 2010-04-23 16:51:20,382 [TP-Processor9] ERROR
> org.apache.turbine.services.pull.TurbinePullService - Could not
> instantiate request tool acl from a de.tewisoft.aloe.turbine.ACLTool
> object
> java.lang.NullPointerException
> at java.lang.String.compareTo(String.java:998)
> at java.lang.String.compareTo(String.java:90)
> at java.util.TreeMap.compare(TreeMap.java:1093)
> at java.util.TreeMap.getEntry(TreeMap.java:347)
> at java.util.TreeMap.get(TreeMap.java:265)
> at
> org.apache.turbine.util.security.GroupSet.getGroupByName(GroupSet.java:173)
>
> at
> org.apache.turbine.services.security.BaseSecurityService.getGlobalGroup(BaseSecurityService.java:961)
>
> at
> org.apache.turbine.services.security.TurbineSecurity.getGlobalGroup(TurbineSecurity.java:595)
>
> at
> org.apache.turbine.util.security.TurbineAccessControlList.getPermissions(TurbineAccessControlList.java:148)
>
> at de.tewisoft.aloe.turbine.ACLTool.init(ACLTool.java:43)
> at
> org.apache.turbine.services.pull.TurbinePullService.initTool(TurbinePullService.java:736)
>
> at
> org.apache.turbine.services.pull.TurbinePullService.populateWithRequestTools(TurbinePullService.java:456)
>
> at
> org.apache.turbine.services.pull.TurbinePullService.populateContext(TurbinePullService.java:378)
>
> at
> org.apache.turbine.services.velocity.TurbineVelocityService.getContext(TurbineVelocityService.java:250)
>
> at
> org.apache.turbine.services.velocity.TurbineVelocity.getContext(TurbineVelocity.java:122)
>
> at
> org.apache.turbine.modules.pages.VelocityPage.doBuildBeforeAction(VelocityPage.java:50)
>
> at
> org.apache.turbine.modules.pages.DefaultPage.doBuild(DefaultPage.java:110)
>
> at org.apache.turbine.modules.Page.build(Page.java:56)
> at org.apache.turbine.modules.PageLoader.exec(PageLoader.java:104)
> at org.apache.turbine.Turbine.doGet(Turbine.java:796)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:690)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
>
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
>
> at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
>
> at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
>
> at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
>
> at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
>
> at
> org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:568)
> at
> org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:421)
>
> at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
>
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
>
> at
> org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190)
> at
> org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:283)
> at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:767)
> at
> org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:697)
>
> at
> org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:889)
>
> at
> org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690)
>
> at java.lang.Thread.run(Thread.java:595)
>
>
> ******************* snippet LDAP TCP communication *********************
>
> No. Time Source Destination
> Protocol Info
> 32 2010-04-23 16:23:31.642312 192.168.20.231
> 192.168.20.173 LDAP searchResEntry(2)
> "CN=TurbineGroupGlobal,OU=Turbine,OU=myproject,DC=example,DC=com" |
> searchResEntry(2)
> "CN=TurbineGroupService,OU=Turbine,OU=myproject,DC=example,DC=com" |
> searchResDone(2) success [2 results]
>
> Frame 32 (1840 bytes on wire, 1840 bytes captured)
> Ethernet II, Src: fa:a2:57:b8:8f:1b (fa:a2:57:b8:8f:1b), Dst:
> 4e:58:d9:f6:61:fd (4e:58:d9:f6:61:fd)
> Internet Protocol, Src: 192.168.20.231 (192.168.20.231), Dst:
> 192.168.20.173 (192.168.20.173)
> Transmission Control Protocol, Src Port: ldap (389), Dst Port:
> turbonote-2 (34249), Seq: 23, Ack: 185, Len: 1774
> Source port: ldap (389)
> Destination port: turbonote-2 (34249)
> [Stream index: 3]
> Sequence number: 23 (relative sequence number)
> [Next sequence number: 1797 (relative sequence number)]
> Acknowledgement number: 185 (relative ack number)
> Header length: 32 bytes
> Flags: 0x18 (PSH, ACK)
> Window size: 66304 (scaled)
> Checksum: 0xaaeb [validation disabled]
> Options: (12 bytes)
> [SEQ/ACK analysis]
> [PDU Size: 873]
> [PDU Size: 879]
> [PDU Size: 22]
> Lightweight-Directory-Access-Protocol
> LDAPMessage searchResEntry(2)
> "CN=TurbineGroupGlobal,OU=Turbine,OU=myproject,DC=example,DC=com" [1
> result]
> messageID: 2
> protocolOp: searchResEntry (4)
> searchResEntry
> objectName:
> CN=TurbineGroupGlobal,OU=Turbine,OU=myproject,DC=example,DC=com
> attributes: 17 items
> PartialAttributeList item objectClass
> PartialAttributeList item cn
> PartialAttributeList item distinguishedName
> PartialAttributeList item instanceType
> PartialAttributeList item whenCreated
> PartialAttributeList item whenChanged
> PartialAttributeList item uSNCreated
> PartialAttributeList item uSNChanged
> PartialAttributeList item name
> PartialAttributeList item objectGUID
> PartialAttributeList item objectSid
> PartialAttributeList item sAMAccountName
> PartialAttributeList item sAMAccountType
> PartialAttributeList item groupType
> PartialAttributeList item objectCategory
> PartialAttributeList item dSCorePropagationData
> PartialAttributeList item turbineGroupName
> [Response To: 31]
> [Time: 0.000349000 seconds]
> Lightweight-Directory-Access-Protocol
> LDAPMessage searchResEntry(2)
> "CN=TurbineGroupService,OU=Turbine,OU=myproject,DC=example,DC=com" [2
> results]
> messageID: 2
> protocolOp: searchResEntry (4)
> searchResEntry
> objectName:
> CN=TurbineGroupService,OU=Turbine,OU=myproject,DC=example,DC=com
> attributes: 17 items
> PartialAttributeList item objectClass
> PartialAttributeList item cn
> PartialAttributeList item distinguishedName
> PartialAttributeList item instanceType
> PartialAttributeList item whenCreated
> PartialAttributeList item whenChanged
> PartialAttributeList item uSNCreated
> PartialAttributeList item uSNChanged
> PartialAttributeList item name
> PartialAttributeList item objectGUID
> PartialAttributeList item objectSid
> PartialAttributeList item sAMAccountName
> PartialAttributeList item sAMAccountType
> PartialAttributeList item groupType
> PartialAttributeList item objectCategory
> PartialAttributeList item dSCorePropagationData
> PartialAttributeList item turbineGroupName
> [Response To: 31]
> [Time: 0.000349000 seconds]
> Lightweight-Directory-Access-Protocol
> LDAPMessage searchResDone(2) success [2 results]
> messageID: 2
> protocolOp: searchResDone (5)
> searchResDone
> resultCode: success (0)
> matchedDN:
> errorMessage:
> [Response To: 31]
> [Time: 0.000349000 seconds]
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@turbine.apache.org
> For additional commands, e-mail: user-help@turbine.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@turbine.apache.org
For additional commands, e-mail: user-help@turbine.apache.org