You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@archiva.apache.org by Kurt Yoder <ky...@gmail.com> on 2011/04/02 00:47:52 UTC
redback/ldap
Hello All,
I'm trying to get authentication for my existing LDAP users to work in Archiva. However my setup does not use an administrative user and bind password; instead my defined LDAP users have a SHA1-hashed password that should be used for authentication. The redback documentation seems to hint it *might* be possible, but frankly I don't understand it, and it seems out of date. Is my kind of LDAP setup supported?
Incidentally, the redback site I looked up for configuration help (http://redback.codehaus.org/integration/ldap.html) was last updated over two years ago, and the mailing lists seem similarly dead. Did the project get renamed and move elsewhere? Or worse, did it die out completely?
Thanks in advance,
-Kurt
Re: redback/ldap
Posted by Kurt Yoder <ky...@gmail.com>.
auth01.foo.bar is signed by my own internal CA. I originally got a certificate error, as reported here:
http://mail.openjdk.java.net/pipermail/discuss/2011-March/001731.html
However I was then able to import my certificate into openJDK's keystore and get past that error. So I'm pretty sure the LDAP connection is working normally.
As for anonymous binds, yes I can see users and most of their information.
On Apr 4, 2011, at 3:02 PM, Brent Atkinson wrote:
> Kurt,
>
> Thank you for sending this information along. It makes it much easier to try
> and help you.
>
> Some questions based on this configuration:
>
> * auth01.foo.bar - does the host have a signed cert from a trusted CA or is
> it self-signed?
> * if you connect anonymously to auth01.foo.bar, can you find users and see
> some of their basic information?
>
> Brent
>
> On Mon, Apr 4, 2011 at 9:50 PM, Kurt Yoder <ky...@gmail.com> wrote:
>
>> Thanks for all the replies. Here is my security.properties:
>>
>> email.from.address=root@foo.bar
>>
>> user.manager.impl=ldap
>> ldap.bind.authenticator.enabled=true
>> ldap.bind.authenticator=true
>> security.policy.password.expiration.enabled=false
>>
>> ldap.config.hostname=auth01.foo.bar
>> ldap.config.port=636
>> ldap.config.ssl=true
>> ldap.config.base.dn=ou=people,dc=foo,dc=bar
>> ldap.config.context.factory=com.sun.jndi.ldap.LdapCtxFactory
>>
>>
>> As for the application.xml, I was a bit confused by the documentation; is
>> it out of date? There are two versions of docs that I have been able to
>> find. One says to set various configurations directly in the
>> application.xml, and the other says to set these configurations within
>> security.properties. To be thorough, I will also include my application.xml:
>>
>>
>>
>>
>> Here's a screenshot of the immutable HTML form where archiva sends me (it's
>> behind an SSL proxy):
>>
>>
>>
>>
>>
>> On Apr 2, 2011, at 1:22 AM, Brett Porter wrote:
>>
>> <snip>
>>
>>>
>>> Asking here should be fine too, Archiva needs to offer the functionality
>> regardless, after all :)
>>>
>>> Kurt, can you post an obfuscated copy of the settings you're using?
>>>
>>> This works for me with anonymous bind:
>>>
>>> ===
>>> ldap.config.context.factory=com.sun.jndi.ldap.LdapCtxFactory
>>>
>>> # LDAP server config
>>> ldap.config.hostname=***
>>> ldap.config.base.dn=***
>>> ldap.config.port=389
>>>
>>> # LDAP anonymous bind config
>>> ldap.bind.authenticator.enabled=true
>>>
>>> # LDAP user mapping : openldap use uid, redback default is cn
>>> ldap.config.mapper.attribute.user.id=uid
>>> ldap.config.mapper.attribute.user.email=mail
>>> ldap.config.mapper.attribute.fullname=givenName
>>> ldap.config.mapper.attribute.password=userPassword
>>>
>>> # uid of the ldap user
>>> redback.default.admin=root
>>>
>>> security.policy.password.expiration.enabled=false
>>> ===
>>>
>>> (+ application.xml as in the docs)
>>>
>>> Cheers,
>>> Brett
>>>
>>> --
>>> Brett Porter
>>> brett@apache.org
>>> http://brettporter.wordpress.com/
>>> http://au.linkedin.com/in/brettporter
>>>
>>>
>>>
>>>
>>
>>
>>
Re: redback/ldap
Posted by Brent Atkinson <ba...@apache.org>.
Kurt,
Thank you for sending this information along. It makes it much easier to try
and help you.
Some questions based on this configuration:
* auth01.foo.bar - does the host have a signed cert from a trusted CA or is
it self-signed?
* if you connect anonymously to auth01.foo.bar, can you find users and see
some of their basic information?
Brent
On Mon, Apr 4, 2011 at 9:50 PM, Kurt Yoder <ky...@gmail.com> wrote:
> Thanks for all the replies. Here is my security.properties:
>
> email.from.address=root@foo.bar
>
> user.manager.impl=ldap
> ldap.bind.authenticator.enabled=true
> ldap.bind.authenticator=true
> security.policy.password.expiration.enabled=false
>
> ldap.config.hostname=auth01.foo.bar
> ldap.config.port=636
> ldap.config.ssl=true
> ldap.config.base.dn=ou=people,dc=foo,dc=bar
> ldap.config.context.factory=com.sun.jndi.ldap.LdapCtxFactory
>
>
> As for the application.xml, I was a bit confused by the documentation; is
> it out of date? There are two versions of docs that I have been able to
> find. One says to set various configurations directly in the
> application.xml, and the other says to set these configurations within
> security.properties. To be thorough, I will also include my application.xml:
>
>
>
>
> Here's a screenshot of the immutable HTML form where archiva sends me (it's
> behind an SSL proxy):
>
>
>
>
>
> On Apr 2, 2011, at 1:22 AM, Brett Porter wrote:
>
> <snip>
>
> >
> > Asking here should be fine too, Archiva needs to offer the functionality
> regardless, after all :)
> >
> > Kurt, can you post an obfuscated copy of the settings you're using?
> >
> > This works for me with anonymous bind:
> >
> > ===
> > ldap.config.context.factory=com.sun.jndi.ldap.LdapCtxFactory
> >
> > # LDAP server config
> > ldap.config.hostname=***
> > ldap.config.base.dn=***
> > ldap.config.port=389
> >
> > # LDAP anonymous bind config
> > ldap.bind.authenticator.enabled=true
> >
> > # LDAP user mapping : openldap use uid, redback default is cn
> > ldap.config.mapper.attribute.user.id=uid
> > ldap.config.mapper.attribute.user.email=mail
> > ldap.config.mapper.attribute.fullname=givenName
> > ldap.config.mapper.attribute.password=userPassword
> >
> > # uid of the ldap user
> > redback.default.admin=root
> >
> > security.policy.password.expiration.enabled=false
> > ===
> >
> > (+ application.xml as in the docs)
> >
> > Cheers,
> > Brett
> >
> > --
> > Brett Porter
> > brett@apache.org
> > http://brettporter.wordpress.com/
> > http://au.linkedin.com/in/brettporter
> >
> >
> >
> >
>
>
>
Re: redback/ldap
Posted by Kurt Yoder <ky...@gmail.com>.
Thanks for all the replies. Here is my security.properties:
email.from.address=root@foo.bar
user.manager.impl=ldap
ldap.bind.authenticator.enabled=true
ldap.bind.authenticator=true
security.policy.password.expiration.enabled=false
ldap.config.hostname=auth01.foo.bar
ldap.config.port=636
ldap.config.ssl=true
ldap.config.base.dn=ou=people,dc=foo,dc=bar
ldap.config.context.factory=com.sun.jndi.ldap.LdapCtxFactory
As for the application.xml, I was a bit confused by the documentation; is it out of date? There are two versions of docs that I have been able to find. One says to set various configurations directly in the application.xml, and the other says to set these configurations within security.properties. To be thorough, I will also include my application.xml:
Re: redback/ldap
Posted by Brett Porter <br...@apache.org>.
On 02/04/2011, at 12:42 PM, Wendy Smoak wrote:
> On Fri, Apr 1, 2011 at 6:47 PM, Kurt Yoder <ky...@gmail.com> wrote:
>
>> I'm trying to get authentication for my existing LDAP users to work in Archiva. However my setup does not use an administrative user and bind password; instead my defined LDAP users have a SHA1-hashed password that should be used for authentication. The redback documentation seems to hint it *might* be possible, but frankly I don't understand it, and it seems out of date. Is my kind of LDAP setup supported?
>>
>> Incidentally, the redback site I looked up for configuration help (http://redback.codehaus.org/integration/ldap.html) was last updated over two years ago, and the mailing lists seem similarly dead. Did the project get renamed and move elsewhere? Or worse, did it die out completely?
>
> It's not completely dead, they've even done a couple of releases
> recently: http://repo2.maven.org/maven2/org/codehaus/redback/redback/
> . Coming from mostly Apache projects it's strange to me not to see
> discussion, release votes, and announcements, but Codehaus doesn't
> have the same rules. If you look at the scm@redback list, that's
> where all the activity (JIRA and commits) is.
There was some discussion about folding it into Archiva or Continuum, the main users of it - but others piped up with reasons it may be better to be independent and I haven't followed it up since.
>
> Ping the Redback dev list and see if someone can update the website.
> Here's the source of the page you mentioned, you can see if anything
> has changed since it was last published:
> http://svn.codehaus.org/redback/redback-site/trunk/src/site/apt/integration/ldap.apt
>
> I don't know the answer to your original question though. I've
> managed to get it minimally working against ApacheDS, but nothing more
> complicated than that.
Asking here should be fine too, Archiva needs to offer the functionality regardless, after all :)
Kurt, can you post an obfuscated copy of the settings you're using?
This works for me with anonymous bind:
===
ldap.config.context.factory=com.sun.jndi.ldap.LdapCtxFactory
# LDAP server config
ldap.config.hostname=***
ldap.config.base.dn=***
ldap.config.port=389
# LDAP anonymous bind config
ldap.bind.authenticator.enabled=true
# LDAP user mapping : openldap use uid, redback default is cn
ldap.config.mapper.attribute.user.id=uid
ldap.config.mapper.attribute.user.email=mail
ldap.config.mapper.attribute.fullname=givenName
ldap.config.mapper.attribute.password=userPassword
# uid of the ldap user
redback.default.admin=root
security.policy.password.expiration.enabled=false
===
(+ application.xml as in the docs)
Cheers,
Brett
--
Brett Porter
brett@apache.org
http://brettporter.wordpress.com/
http://au.linkedin.com/in/brettporter
Re: redback/ldap
Posted by Wendy Smoak <ws...@gmail.com>.
On Fri, Apr 1, 2011 at 6:47 PM, Kurt Yoder <ky...@gmail.com> wrote:
> I'm trying to get authentication for my existing LDAP users to work in Archiva. However my setup does not use an administrative user and bind password; instead my defined LDAP users have a SHA1-hashed password that should be used for authentication. The redback documentation seems to hint it *might* be possible, but frankly I don't understand it, and it seems out of date. Is my kind of LDAP setup supported?
>
> Incidentally, the redback site I looked up for configuration help (http://redback.codehaus.org/integration/ldap.html) was last updated over two years ago, and the mailing lists seem similarly dead. Did the project get renamed and move elsewhere? Or worse, did it die out completely?
It's not completely dead, they've even done a couple of releases
recently: http://repo2.maven.org/maven2/org/codehaus/redback/redback/
. Coming from mostly Apache projects it's strange to me not to see
discussion, release votes, and announcements, but Codehaus doesn't
have the same rules. If you look at the scm@redback list, that's
where all the activity (JIRA and commits) is.
Ping the Redback dev list and see if someone can update the website.
Here's the source of the page you mentioned, you can see if anything
has changed since it was last published:
http://svn.codehaus.org/redback/redback-site/trunk/src/site/apt/integration/ldap.apt
I don't know the answer to your original question though. I've
managed to get it minimally working against ApacheDS, but nothing more
complicated than that.
--
Wendy
Re: redback/ldap
Posted by Brent Atkinson <ba...@apache.org>.
Kurt,
>From your description, I'm not sure I completely understand your LDAP
configuration. What I can say is that I have run Continuum and Archiva in a
number of LDAP configurations on different LDAP implementations such as
Active Directory, OpenLDAP, Novel eDirectory, Apache DS.
As I understand it, you need to have the ability to do two major things:
* Search for users
* Bind as a user (for non-guest and admin users)
There are two ways this is typically done:
* Search is privileged and only allowed to a privileged account
* Search is open, but ACLs protect any privileged information
In the first case, you need an administrative account to satisfy the search
for users functionality. In the second case, you don't need an
administrative LDAP user. If you can describe a little more about how your
configuration differs from one of these, I am happy to help you get it
setup. If it doesn't currently work, I'm willing to help make the changes
necessary to make it work, provided it is relatively conventional and
doesn't invalidate the more conventional setups.
Brent
On Sat, Apr 2, 2011 at 1:47 AM, Kurt Yoder <ky...@gmail.com> wrote:
> Hello All,
>
> I'm trying to get authentication for my existing LDAP users to work in
> Archiva. However my setup does not use an administrative user and bind
> password; instead my defined LDAP users have a SHA1-hashed password that
> should be used for authentication. The redback documentation seems to hint
> it *might* be possible, but frankly I don't understand it, and it seems out
> of date. Is my kind of LDAP setup supported?
>
> Incidentally, the redback site I looked up for configuration help (
> http://redback.codehaus.org/integration/ldap.html) was last updated over
> two years ago, and the mailing lists seem similarly dead. Did the project
> get renamed and move elsewhere? Or worse, did it die out completely?
>
> Thanks in advance,
>
> -Kurt