You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by Peter Diefenthaeler <pd...@csc.com> on 2011/05/05 11:33:57 UTC

LDAP with SSL Connection

Hi,

I'm trying to connect to a LDAPv2 & LDAPv3 on SSLv3 port  and getting 
following messages:

2011-05-05 08:32:55,756 [TP-Processor3] DEBUG 
org.apache.shiro.realm.ldap.JndiLdapRealm - Authenticating user 'user' 
through LDAP 
2011-05-05 08:32:55,756 [TP-Processor3] DEBUG 
org.apache.shiro.realm.ldap.JndiLdapRealm - Authenticating user 'user' 
through LDAP 
2011-05-05 08:32:55,772 [TP-Processor3] DEBUG 
org.apache.shiro.realm.ldap.JndiLdapContextFactory - Initializing LDAP 
context using URL [ldap://ldap:888] and principal 
[racfid=user,profiletype=user,ou=racf,ou=sys,o=com] with pooling disabled 
2011-05-05 08:32:55,772 [TP-Processor3] DEBUG 
org.apache.shiro.realm.ldap.JndiLdapContextFactory - Initializing LDAP 
context using URL [ldap://ldap:888] and principal 
[racfid=user,profiletype=user,ou=racf,ou=sys,o=com] with pooling disabled 
2011-05-05 08:32:55,850 [TP-Processor3] DEBUG 
org.apache.shiro.web.servlet.SimpleCookie - Added HttpServletResponse 
Cookie [rememberMe=deleteMe; Path=/PtsCurrWeb; Max-Age=0; Expires=Wed, 
04-May-2011 06:32:55 GMT] 
2011-05-05 08:32:55,850 [TP-Processor3] DEBUG 
org.apache.shiro.web.servlet.SimpleCookie - Added HttpServletResponse 
Cookie [rememberMe=deleteMe; Path=/PtsCurrWeb; Max-Age=0; Expires=Wed, 
04-May-2011 06:32:55 GMT] 
2011-05-05 08:32:55,850 [TP-Processor3] ERROR 
com.csc.pts.curr.web.application.CurrWebSession - 
org.apache.shiro.authc.AuthenticationException: LDAP naming error while 
attempting to authenticate user. 
2011-05-05 08:32:55,865 [TP-Processor3] DEBUG 
org.apache.shiro.web.servlet.AbstractShiroFilter - No FilterChainResolver 
configured.  Returning original FilterChain. 
2011-05-05 08:32:55,865 [TP-Processor3] DEBUG 
org.apache.shiro.web.servlet.AbstractShiroFilter - No FilterChainResolver 
configured.  Returning original FilterChain. 
2011-05-05 08:33:05,272 [TP-Processor3] DEBUG 
org.apache.shiro.web.servlet.AbstractShiroFilter - No FilterChainResolver 
configured.  Returning original FilterChain. 
2011-05-05 08:33:05,272 [TP-Processor3] DEBUG 
org.apache.shiro.web.servlet.AbstractShiroFilter - No FilterChainResolver 
configured.  Returning original FilterChain. 

This is my shiro.ini file:

[main]
# LDAP authentication
ldapRealm = org.apache.shiro.realm.ldap.JndiLdapRealm
ldapRealm.userDnTemplate = racfid={0},profiletype=user,ou=racf,ou=sys
,o=com
ldapRealm.contextFactory.url = ldap://ldap:888
ldapRealm.contextFactory.authenticationMechanism = DIGEST-MD5
#ldapRealm.contextFactory.environment[some.obscure.jndi.key] = some value

# Simple Shiro authentication example
#credentialsMatcher = 
org.apache.shiro.authc.credential.SimpleCredentialsMatcher

[users]
# Users for simple authentication
#EOE = eoe

[roles]
# Roles for simple authentication
#admin = *


My Problem: How can I configure the SSL connection for the LDAP?

Thanks, Peter

Re: LDAP with SSL Connection

Posted by Les Hazlewood <lh...@apache.org>.
This is a bug that will be fixed soon:

https://issues.apache.org/jira/browse/SHIRO-305

HTH,

Les

On Fri, Oct 7, 2011 at 11:37 AM, iyya <ka...@gmail.com> wrote:
> Hi Peter
>
> Have you managed to solve this exception -
>
> Caused by: org.apache.shiro.config.ConfigurationException: Map property
> value [ldaps://ldap url] contained
> key-value pair token [ldaps://ldap url]] that does not properly split to a
> single key and pair.  This must b
> e the case for all map entries.
>
> I got stuck with this.
>
> Thanks
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/LDAP-with-SSL-Connection-tp6333691p6869758.html
> Sent from the Shiro User mailing list archive at Nabble.com.

Re: LDAP with SSL Connection

Posted by iyya <ka...@gmail.com>.
Hi Peter

Have you managed to solve this exception -

Caused by: org.apache.shiro.config.ConfigurationException: Map property
value [ldaps://ldap url] contained
key-value pair token [ldaps://ldap url]] that does not properly split to a
single key and pair.  This must b
e the case for all map entries.

I got stuck with this.

Thanks

--
View this message in context: http://shiro-user.582556.n2.nabble.com/LDAP-with-SSL-Connection-tp6333691p6869758.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: LDAP with SSL Connection

Posted by PDiefent <pd...@csc.com>.
Hi Les,
thanks for your fast response. I've tried one of your hints and added
following line to my shiro.ini file:

ldapRealm.contextFactory.environment[java.naming.security.protocol] = ssl

Starting the application results in following error messages:

2011-05-06 10:22:03,633 [Thread-1] ERROR
org.apache.shiro.web.servlet.AbstractFilter - Unable to start Filter: [Map
property value [ssl] contained key-value pair token [ssl] that does not
properly split to a single key and pair.  This must be the case for all map
entries.]. 
org.apache.shiro.config.ConfigurationException: Map property value [ssl]
contained key-value pair token [ssl] that does not properly split to a
single key and pair.  This must be the case for all map entries. 
      at
org.apache.shiro.config.ReflectionBuilder.toMap(ReflectionBuilder.java:286) 
      at
org.apache.shiro.config.ReflectionBuilder.applyProperty(ReflectionBuilder.java:350) 
      at
org.apache.shiro.config.ReflectionBuilder.applySingleProperty(ReflectionBuilder.java:198) 
      at
org.apache.shiro.config.ReflectionBuilder.applyProperty(ReflectionBuilder.java:159) 
      at
org.apache.shiro.config.ReflectionBuilder.buildObjects(ReflectionBuilder.java:119) 
      at
org.apache.shiro.config.IniSecurityManagerFactory.buildInstances(IniSecurityManagerFactory.java:170) 
      at
org.apache.shiro.config.IniSecurityManagerFactory.createSecurityManager(IniSecurityManagerFactory.java:119) 
      at
org.apache.shiro.config.IniSecurityManagerFactory.createSecurityManager(IniSecurityManagerFactory.java:97) 
      at
org.apache.shiro.config.IniSecurityManagerFactory.createInstance(IniSecurityManagerFactory.java:83) 
      at
org.apache.shiro.config.IniSecurityManagerFactory.createInstance(IniSecurityManagerFactory.java:41) 
      at
org.apache.shiro.config.IniFactorySupport.createInstance(IniFactorySupport.java:123) 
      at
org.apache.shiro.util.AbstractFactory.getInstance(AbstractFactory.java:47) 
      at
org.apache.shiro.web.servlet.IniShiroFilter.applySecurityManager(IniShiroFilter.java:353) 
      at
org.apache.shiro.web.servlet.IniShiroFilter.configure(IniShiroFilter.java:321) 
      at
org.apache.shiro.web.servlet.IniShiroFilter.init(IniShiroFilter.java:292) 
      at
org.apache.shiro.web.servlet.AbstractShiroFilter.onFilterConfigSet(AbstractShiroFilter.java:83) 
      at
org.apache.shiro.web.servlet.AbstractFilter.init(AbstractFilter.java:94) 
      at
org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:275) 
      at
org.apache.catalina.core.ApplicationFilterConfig.setFilterDef(ApplicationFilterConfig.java:397) 
      at
org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:108) 
      at
org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:3693) 
      at
org.apache.catalina.core.StandardContext.start(StandardContext.java:4340) 
      at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791) 
      at
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771) 
      at
org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525) 
      at
org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:626) 
      at
org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:553) 
      at
org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:488) 
      at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1138) 
      at
org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311) 
      at
org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117) 
      at
org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053) 
      at org.apache.catalina.core.StandardHost.start(StandardHost.java:719) 
      at
org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045) 
      at
org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443) 
      at
org.apache.catalina.core.StandardService.start(StandardService.java:516) 
      at
org.apache.catalina.core.StandardServer.start(StandardServer.java:710) 
      at org.apache.catalina.startup.Catalina.start(Catalina.java:566) 
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
      at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
      at java.lang.reflect.Method.invoke(Unknown Source) 
      at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288) 
      at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413) 
2011-05-06 10:22:03,633 [Thread-1] ERROR
org.apache.shiro.web.servlet.AbstractFilter - Unable to start Filter: [Map
property value [ssl] contained key-value pair token [ssl] that does not
properly split to a single key and pair.  This must be the case for all map
entries.]. 
org.apache.shiro.config.ConfigurationException: Map property value [ssl]
contained key-value pair token [ssl] that does not properly split to a
single key and pair.  This must be the case for all map entries. 
      at
org.apache.shiro.config.ReflectionBuilder.toMap(ReflectionBuilder.java:286) 
      at
org.apache.shiro.config.ReflectionBuilder.applyProperty(ReflectionBuilder.java:350) 
      at
org.apache.shiro.config.ReflectionBuilder.applySingleProperty(ReflectionBuilder.java:198) 
      at
org.apache.shiro.config.ReflectionBuilder.applyProperty(ReflectionBuilder.java:159) 
      at
org.apache.shiro.config.ReflectionBuilder.buildObjects(ReflectionBuilder.java:119) 
      at
org.apache.shiro.config.IniSecurityManagerFactory.buildInstances(IniSecurityManagerFactory.java:170) 
      at
org.apache.shiro.config.IniSecurityManagerFactory.createSecurityManager(IniSecurityManagerFactory.java:119) 
      at
org.apache.shiro.config.IniSecurityManagerFactory.createSecurityManager(IniSecurityManagerFactory.java:97) 
      at
org.apache.shiro.config.IniSecurityManagerFactory.createInstance(IniSecurityManagerFactory.java:83) 
      at
org.apache.shiro.config.IniSecurityManagerFactory.createInstance(IniSecurityManagerFactory.java:41) 
      at
org.apache.shiro.config.IniFactorySupport.createInstance(IniFactorySupport.java:123) 
      at
org.apache.shiro.util.AbstractFactory.getInstance(AbstractFactory.java:47) 
      at
org.apache.shiro.web.servlet.IniShiroFilter.applySecurityManager(IniShiroFilter.java:353) 
      at
org.apache.shiro.web.servlet.IniShiroFilter.configure(IniShiroFilter.java:321) 
      at
org.apache.shiro.web.servlet.IniShiroFilter.init(IniShiroFilter.java:292) 
      at
org.apache.shiro.web.servlet.AbstractShiroFilter.onFilterConfigSet(AbstractShiroFilter.java:83) 
      at
org.apache.shiro.web.servlet.AbstractFilter.init(AbstractFilter.java:94) 
      at
org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:275) 
      at
org.apache.catalina.core.ApplicationFilterConfig.setFilterDef(ApplicationFilterConfig.java:397) 
      at
org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:108) 
      at
org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:3693) 
      at
org.apache.catalina.core.StandardContext.start(StandardContext.java:4340) 
      at
org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791) 
      at
org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771) 
      at
org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525) 
      at
org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:626) 
      at
org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:553) 
      at
org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:488) 
      at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1138) 
      at
org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311) 
      at
org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117) 
      at
org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053) 
      at org.apache.catalina.core.StandardHost.start(StandardHost.java:719) 
      at
org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045) 
      at
org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443) 
      at
org.apache.catalina.core.StandardService.start(StandardService.java:516) 
      at
org.apache.catalina.core.StandardServer.start(StandardServer.java:710) 
      at org.apache.catalina.startup.Catalina.start(Catalina.java:566) 
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
      at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
      at java.lang.reflect.Method.invoke(Unknown Source) 
      at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288) 
      at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413) 



--
View this message in context: http://shiro-user.582556.n2.nabble.com/LDAP-with-SSL-Connection-tp6333691p6337235.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: LDAP with SSL Connection

Posted by Les Hazlewood <lh...@apache.org>.
Hi Peter,

Shiro's JndiLdapRealm uses the JNDI API to connect to an LDAP server.
This means you need to configure the appropriate JNDI environment
settings for SSL.  For example:

...
ldapRealm.contextFactory.environment[java.naming.security.protocol] = ssl

I'm not sure if that will be the only property necessary - it depends
on your LDAP server config.  E.g. I'm not sure if you'll need to set
up a custom SSL socket or not.  For more information, this appears to
be useful:

http://v1.dione.zcu.cz/java/docs/jndi-1.2/tutorial/ldap/security/ssl.html

And the first two results from this look relevant as well:

http://stackoverflow.com/search?q=java+ldap+ssl

HTH,

Les

On Thu, May 5, 2011 at 2:33 AM, Peter Diefenthaeler <pd...@csc.com> wrote:
> Hi,
>
> I'm trying to connect to a LDAPv2 & LDAPv3 on SSLv3 port  and getting
> following messages:
>
> 2011-05-05 08:32:55,756 [TP-Processor3] DEBUG
> org.apache.shiro.realm.ldap.JndiLdapRealm - Authenticating user 'user'
> through LDAP
> 2011-05-05 08:32:55,756 [TP-Processor3] DEBUG
> org.apache.shiro.realm.ldap.JndiLdapRealm - Authenticating user 'user'
> through LDAP
> 2011-05-05 08:32:55,772 [TP-Processor3] DEBUG
> org.apache.shiro.realm.ldap.JndiLdapContextFactory - Initializing LDAP
> context using URL [ldap://ldap:888] and principal
> [racfid=user,profiletype=user,ou=racf,ou=sys,o=com] with pooling disabled
> 2011-05-05 08:32:55,772 [TP-Processor3] DEBUG
> org.apache.shiro.realm.ldap.JndiLdapContextFactory - Initializing LDAP
> context using URL [ldap://ldap:888] and principal
> [racfid=user,profiletype=user,ou=racf,ou=sys,o=com] with pooling disabled
> 2011-05-05 08:32:55,850 [TP-Processor3] DEBUG
> org.apache.shiro.web.servlet.SimpleCookie - Added HttpServletResponse Cookie
> [rememberMe=deleteMe; Path=/PtsCurrWeb; Max-Age=0; Expires=Wed, 04-May-2011
> 06:32:55 GMT]
> 2011-05-05 08:32:55,850 [TP-Processor3] DEBUG
> org.apache.shiro.web.servlet.SimpleCookie - Added HttpServletResponse Cookie
> [rememberMe=deleteMe; Path=/PtsCurrWeb; Max-Age=0; Expires=Wed, 04-May-2011
> 06:32:55 GMT]
> 2011-05-05 08:32:55,850 [TP-Processor3] ERROR
> com.csc.pts.curr.web.application.CurrWebSession -
> org.apache.shiro.authc.AuthenticationException: LDAP naming error while
> attempting to authenticate user.
> 2011-05-05 08:32:55,865 [TP-Processor3] DEBUG
> org.apache.shiro.web.servlet.AbstractShiroFilter - No FilterChainResolver
> configured.  Returning original FilterChain.
> 2011-05-05 08:32:55,865 [TP-Processor3] DEBUG
> org.apache.shiro.web.servlet.AbstractShiroFilter - No FilterChainResolver
> configured.  Returning original FilterChain.
> 2011-05-05 08:33:05,272 [TP-Processor3] DEBUG
> org.apache.shiro.web.servlet.AbstractShiroFilter - No FilterChainResolver
> configured.  Returning original FilterChain.
> 2011-05-05 08:33:05,272 [TP-Processor3] DEBUG
> org.apache.shiro.web.servlet.AbstractShiroFilter - No FilterChainResolver
> configured.  Returning original FilterChain.
>
> This is my shiro.ini file:
>
> [main]
> # LDAP authentication
> ldapRealm = org.apache.shiro.realm.ldap.JndiLdapRealm
> ldapRealm.userDnTemplate = racfid={0},profiletype=user,ou=racf,ou=sys,o=com
> ldapRealm.contextFactory.url = ldap://ldap:888
> ldapRealm.contextFactory.authenticationMechanism = DIGEST-MD5
> #ldapRealm.contextFactory.environment[some.obscure.jndi.key] = some value
>
> # Simple Shiro authentication example
> #credentialsMatcher =
> org.apache.shiro.authc.credential.SimpleCredentialsMatcher
>
> [users]
> # Users for simple authentication
> #EOE = eoe
>
> [roles]
> # Roles for simple authentication
> #admin = *
>
>
> My Problem: How can I configure the SSL connection for the LDAP?
>
> Thanks, Peter