You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@directory.apache.org by Sergey Mikhno <se...@gmail.com> on 2019/07/01 10:02:02 UTC
ERR_5 Attempted operation MODIFY_REQUEST by unauthenticated caller.
Dear Emmanuel
We are using ApacheDS to authenticate our users.
ApacheDS connections are in the connection Apache GenericObjectPool version
2.6.
All the connections in the pool have user name and password specified and
are authenticated (as far as we understand). We are using TestOnBorrow from
the pool, and borrowing a connection the pool tests if connection is
authenticated.
Our problem is that sometimes (more that 50 times a day) we see following
error messages in apacheds.log
01.07.2019 01:41:18,487 ERROR [pool-6-thread-766]
org.apache.directory.server.core.authn.AuthenticationInterceptor.checkAuthenticated():1354
- ERR_5 Attempted operation MODIFY_REQUEST by unauthenticated caller.
01.07.2019 01:41:24,617 ERROR [pool-6-thread-766]
org.apache.directory.server.core.authn.AuthenticationInterceptor.checkAuthenticated():1354
- ERR_5 Attempted operation SEARCH_REQUEST by unauthenticated caller.
Do you have any idea what could be wrong or what could we check to get rid
of these error messages?
Best Regards
Sergey Mikhno
Software Developer
Galexis AG
--
Sergey Mikhno
Re: ERR_5 Attempted operation MODIFY_REQUEST by unauthenticated
caller.
Posted by Emmanuel Lécharny <el...@gmail.com>.
Hi Sergey,
nothing that seems unusual.
On 03/07/2019 07:46, Sergey Mikhno wrote:
> Hi Emmanuel,
>
> I had to check which connection pool we are using and see now that our
> configuration looks like this:
>
> LdapConnectionConfig config = *new* LdapConnectionConfig();
>
> config.setLdapHost(apacheDSHost);
>
> config.setLdapPort(apacheDSPort);
>
> config.setName(writeUser);
>
> config.setCredentials(writePassword);
>
>
>
> GenericObjectPoolConfig<Object> poolConfig = *new*
> GenericObjectPoolConfig<>();
>
> poolConfig.setLifo(*true*);
>
> poolConfig.setMaxTotal(600);
>
> poolConfig.setMaxIdle(128);
>
> poolConfig.setMaxWaitMillis(-1L);
>
> poolConfig.setMinEvictableIdleTimeMillis(1000L * 60L * 30L);
>
> poolConfig.setMinIdle(8);
>
> poolConfig.setNumTestsPerEvictionRun(3);
>
> poolConfig.setSoftMinEvictableIdleTimeMillis(-1L);
>
> poolConfig.setTestOnBorrow(*true*);
>
> poolConfig.setTestOnReturn(*false*);
>
> poolConfig.setTestWhileIdle(*false*);
>
> poolConfig.setTimeBetweenEvictionRunsMillis(-1L);
>
>
> *return* *new* LdapConnectionPool(factory, poolConfig);
>
>
> Could you please check if out connection pool configuration is
> correct, or maybe some property needs a change.
>
>
> Some more info:
>
> We have approximately 800 requests per minute.
>
>
> Best Regards
>
>
> Sergey Mikhno
>
> Software Developer
>
> Galexis AG
>
>
> On Mon, Jul 1, 2019 at 4:11 PM Sergey Mikhno <sergey.mikhno@gmail.com
> <ma...@gmail.com>> wrote:
>
> We are using 2.0.0.AM24
>
> On Mon, Jul 1, 2019 at 4:05 PM Emmanuel Lécharny
> <elecharny@gmail.com <ma...@gmail.com>> wrote:
>
>
> On 01/07/2019 15:51, Sergey Mikhno wrote:
> > Thank you, Emmanuel,
> >
> > We'll activate this logger and see what happens.
>
>
> The idea is just to rule out the possibility that a Anonymous
> request is
> done. There are two possibility for that to happen :
>
> - an anonymous bind followed by a request. In this case, the
> request
> message ID would be > 1
>
> - a direct request from a non bound session (it will be an
> anonymous
> request then) and the request messageID would be 1
>
>
> Sadly the logs don't register the session IP nor do we create
> a session
> ID which would help us tracking a full session. This is
> probably two
> things we should do...
>
>
> Can you tell me which ApacheDS version you are using ?
>
>
> Tanks !
>
>
>
> --
> Sergey Mikhno
>
>
>
> --
> Sergey Mikhno
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@directory.apache.org
For additional commands, e-mail: users-help@directory.apache.org
Re: ERR_5 Attempted operation MODIFY_REQUEST by unauthenticated caller.
Posted by Sergey Mikhno <se...@gmail.com>.
Hi Emmanuel,
I had to check which connection pool we are using and see now that our
configuration looks like this:
LdapConnectionConfig config = *new* LdapConnectionConfig();
config.setLdapHost(apacheDSHost);
config.setLdapPort(apacheDSPort);
config.setName(writeUser);
config.setCredentials(writePassword);
GenericObjectPoolConfig<Object> poolConfig = *new*
GenericObjectPoolConfig<>();
poolConfig.setLifo(*true*);
poolConfig.setMaxTotal(600);
poolConfig.setMaxIdle(128);
poolConfig.setMaxWaitMillis(-1L);
poolConfig.setMinEvictableIdleTimeMillis(1000L * 60L * 30L);
poolConfig.setMinIdle(8);
poolConfig.setNumTestsPerEvictionRun(3);
poolConfig.setSoftMinEvictableIdleTimeMillis(-1L);
poolConfig.setTestOnBorrow(*true*);
poolConfig.setTestOnReturn(*false*);
poolConfig.setTestWhileIdle(*false*);
poolConfig.setTimeBetweenEvictionRunsMillis(-1L);
*return* *new* LdapConnectionPool(factory, poolConfig);
Could you please check if out connection pool configuration is correct, or
maybe some property needs a change.
Some more info:
We have approximately 800 requests per minute.
Best Regards
Sergey Mikhno
Software Developer
Galexis AG
On Mon, Jul 1, 2019 at 4:11 PM Sergey Mikhno <se...@gmail.com>
wrote:
> We are using 2.0.0.AM24
>
> On Mon, Jul 1, 2019 at 4:05 PM Emmanuel Lécharny <el...@gmail.com>
> wrote:
>
>>
>> On 01/07/2019 15:51, Sergey Mikhno wrote:
>> > Thank you, Emmanuel,
>> >
>> > We'll activate this logger and see what happens.
>>
>>
>> The idea is just to rule out the possibility that a Anonymous request is
>> done. There are two possibility for that to happen :
>>
>> - an anonymous bind followed by a request. In this case, the request
>> message ID would be > 1
>>
>> - a direct request from a non bound session (it will be an anonymous
>> request then) and the request messageID would be 1
>>
>>
>> Sadly the logs don't register the session IP nor do we create a session
>> ID which would help us tracking a full session. This is probably two
>> things we should do...
>>
>>
>> Can you tell me which ApacheDS version you are using ?
>>
>>
>> Tanks !
>>
>>
>
> --
> Sergey Mikhno
>
--
Sergey Mikhno
Re: ERR_5 Attempted operation MODIFY_REQUEST by unauthenticated
caller.
Posted by Emmanuel Lécharny <el...@gmail.com>.
On 01/07/2019 15:51, Sergey Mikhno wrote:
> Thank you, Emmanuel,
>
> We'll activate this logger and see what happens.
The idea is just to rule out the possibility that a Anonymous request is
done. There are two possibility for that to happen :
- an anonymous bind followed by a request. In this case, the request
message ID would be > 1
- a direct request from a non bound session (it will be an anonymous
request then) and the request messageID would be 1
Sadly the logs don't register the session IP nor do we create a session
ID which would help us tracking a full session. This is probably two
things we should do...
Can you tell me which ApacheDS version you are using ?
Tanks !
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@directory.apache.org
For additional commands, e-mail: users-help@directory.apache.org
Re: ERR_5 Attempted operation MODIFY_REQUEST by unauthenticated
caller.
Posted by Emmanuel Lécharny <el...@gmail.com>.
Hi Sergey,
you can use the 'org.apache.directory.api.CODEC_LOG' logger to get a
trace of every received and sent PDU. This is quite verbose. That would
probably be easier than using wireshark and correlate the traces with
the server logs...
On 01/07/2019 13:11, Emmanuel Lécharny wrote:
> Hi Sergey,
>
>
> this error is produced when an anonymous bind is done. This is ther
> first check done when any operation is executed (add, search, modify,
> etc). Sadly, we would need more logs to be able to determinate what
> could be wrong.
>
>
> Ideally speaking, the right logs would be on
> 'org.apache.directory.server.ldap.handlers.request' which would logs
> any operation and the associated context. That will be quite verbose
> though, and it will be hard to find the request that is not done with
> an authenticated user.
>
> Another thing to do would be to capture a wireshark session, in order
> to try to correlate a received LDAP message that ends with such an
> error to a Bind anonymous (if any).
>
>
> Other things that could happen is a pb with the connection pool. Do
> you know that we have implemented a LDAP connection pool in Apache
> LDAP API ?
>
>
> Last, not least, that may also be a problem in the server, where the
> operation is processed after an unbind has been done, leaving the
> connection anonymous. This is pure hypothesis at this point, an unbind
> is supposed to delete all the pending operations.
>
>
> What is the ApacheDS version you are using ?
>
>
> Thanks !
>
> On 01/07/2019 12:02, Sergey Mikhno wrote:
>> Dear Emmanuel
>>
>> We are using ApacheDS to authenticate our users.
>> ApacheDS connections are in the connection Apache GenericObjectPool
>> version 2.6.
>> All the connections in the pool have user name and password specified
>> and are authenticated (as far as we understand). We are using
>> TestOnBorrow from the pool, and borrowing a connection the pool tests
>> if connection is authenticated.
>>
>> Our problem is that sometimes (more that 50 times a day) we see
>> following error messages in apacheds.log
>>
>> 01.07.2019 01:41:18,487 ERROR [pool-6-thread-766]
>> org.apache.directory.server.core.authn.AuthenticationInterceptor.checkAuthenticated():1354
>> - ERR_5 Attempted operation MODIFY_REQUEST by unauthenticated
>> caller.
>> 01.07.2019 01:41:24,617 ERROR [pool-6-thread-766]
>> org.apache.directory.server.core.authn.AuthenticationInterceptor.checkAuthenticated():1354
>> - ERR_5 Attempted operation SEARCH_REQUEST by unauthenticated
>> caller.
>>
>> Do you have any idea what could be wrong or what could we check to
>> get rid of these error messages?
>>
>> Best Regards
>>
>> Sergey Mikhno
>> Software Developer
>> Galexis AG
>>
>> --
>> Sergey Mikhno
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@directory.apache.org
For additional commands, e-mail: users-help@directory.apache.org
Re: ERR_5 Attempted operation MODIFY_REQUEST by unauthenticated
caller.
Posted by Emmanuel Lécharny <el...@gmail.com>.
Hi Sergey,
this error is produced when an anonymous bind is done. This is ther
first check done when any operation is executed (add, search, modify,
etc). Sadly, we would need more logs to be able to determinate what
could be wrong.
Ideally speaking, the right logs would be on
'org.apache.directory.server.ldap.handlers.request' which would logs any
operation and the associated context. That will be quite verbose though,
and it will be hard to find the request that is not done with an
authenticated user.
Another thing to do would be to capture a wireshark session, in order to
try to correlate a received LDAP message that ends with such an error to
a Bind anonymous (if any).
Other things that could happen is a pb with the connection pool. Do you
know that we have implemented a LDAP connection pool in Apache LDAP API ?
Last, not least, that may also be a problem in the server, where the
operation is processed after an unbind has been done, leaving the
connection anonymous. This is pure hypothesis at this point, an unbind
is supposed to delete all the pending operations.
What is the ApacheDS version you are using ?
Thanks !
On 01/07/2019 12:02, Sergey Mikhno wrote:
> Dear Emmanuel
>
> We are using ApacheDS to authenticate our users.
> ApacheDS connections are in the connection Apache GenericObjectPool
> version 2.6.
> All the connections in the pool have user name and password specified
> and are authenticated (as far as we understand). We are using
> TestOnBorrow from the pool, and borrowing a connection the pool tests
> if connection is authenticated.
>
> Our problem is that sometimes (more that 50 times a day) we see
> following error messages in apacheds.log
>
> 01.07.2019 01:41:18,487 ERROR [pool-6-thread-766]
> org.apache.directory.server.core.authn.AuthenticationInterceptor.checkAuthenticated():1354
> - ERR_5 Attempted operation MODIFY_REQUEST by unauthenticated caller.
> 01.07.2019 01:41:24,617 ERROR [pool-6-thread-766]
> org.apache.directory.server.core.authn.AuthenticationInterceptor.checkAuthenticated():1354
> - ERR_5 Attempted operation SEARCH_REQUEST by unauthenticated caller.
>
> Do you have any idea what could be wrong or what could we check to get
> rid of these error messages?
>
> Best Regards
>
> Sergey Mikhno
> Software Developer
> Galexis AG
>
> --
> Sergey Mikhno
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@directory.apache.org
For additional commands, e-mail: users-help@directory.apache.org