You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by Jeff Lansing <jl...@spawar.navy.mil> on 2005/12/17 00:39:32 UTC
[ApacheDS] authentication problem
Hi,
I am having problems connecting to the ldap server. (I am using an 0.9.4
SNAPSHOT build created today. I did not have these problems with 0.9.3)
I can connect with JXplorer, as admin, and add a user, for instance with the
newuser.ldif example. I can see the new user in JXplorer. I can then
disconnect and reconnect as uid=jdoe,ou=users,ou=system with JXplorer.
However, none of the examples on the page
http://directory.apache.org/subprojects/apacheds/users/authentication.html
will work. For example:
C:\openldap>ldapsearch -D 'uid=admin,ou=system' -h localhost -p 10389 -x -w
secret -s one -b 'ou=users,ou=system' '(uid=jdoe)'
ldap_bind: Invalid credentials (49)
additional info: Bind failed
More importantly (to me), I can no longer search programmatically for users,
as in:
InitialDirContext ctx = new InitialDirContext();
LdapName name = new LdapName("ou=users");
Attributes attributes = new LockableAttributesImpl();
attributes.put("uid", "jdoe");
NamingEnumeration ne = ctx.search(name, attributes);
which returns nothing.
I know the user is there because I can connect as that user with JXplorer.
Surely I am doing something stupid, but I just don't see what.
Any suggestions?
Jeff
RE: [ApacheDS] Race condition in DNParser
Posted by Emmanuel Lecharny <el...@gmail.com>.
Thanks a lot for the feedback !
We are currently working on a new implementation of the DnParser which
will be totally stateless, thus we will not need anymore
synchronization, and which will be 2 times faster than the current one -
may be faster as it does not need synch. -
What kind of performance do you have? Is it possible that you give us
some info on the number of requests per second you have, and which kind
of requests (bind, search, add)? Of course, I'm not asking for a
performance test, but just wanted o know what you can obtain an a 4 proc
serveur !
Thanks a lot, jeff.
On Thu, 2005-12-22 at 09:09 -0800, Jeff Lansing wrote:
> Emmanuel,
>
> FYI, the problem that we were initially experiencing has not reoccurred
> after almost a week of testing. I am now fairly confident that it must have
> been fixed by http://issues.apache.org/jira/browse/DIRLDAP-70.
>
> Thanks,
>
> Jeff
>
> -----Original Message-----
> From: Emmanuel Lecharny [mailto:elecharny@gmail.com]
> Sent: Monday, December 19, 2005 1:01 PM
> To: Apache Directory Developers List
> Subject: RE: [ApacheDS] authentication problem
>
> Hi Jeff,
>
> btw, what about the test you launched friday? Has it ran ok? No
> synchronization problems, no memory leaks?
>
> Thanks for the feedback !
>
> --Emmanuel
>
>
>
> ---------------------------------------------------------------------------------------
> Wanadoo vous informe que cet e-mail a ete controle par l'anti-virus mail.
> Aucun virus connu a ce jour par nos services n'a ete detecte.
>
>
>
--
Emmanuel Lécharny
www.iktek.com
RE: [ApacheDS] Race condition in DNParser
Posted by Jeff Lansing <jl...@spawar.navy.mil>.
Emmanuel,
FYI, the problem that we were initially experiencing has not reoccurred
after almost a week of testing. I am now fairly confident that it must have
been fixed by http://issues.apache.org/jira/browse/DIRLDAP-70.
Thanks,
Jeff
-----Original Message-----
From: Emmanuel Lecharny [mailto:elecharny@gmail.com]
Sent: Monday, December 19, 2005 1:01 PM
To: Apache Directory Developers List
Subject: RE: [ApacheDS] authentication problem
Hi Jeff,
btw, what about the test you launched friday? Has it ran ok? No
synchronization problems, no memory leaks?
Thanks for the feedback !
--Emmanuel
RE: [ApacheDS] authentication problem
Posted by Jeff Lansing <jl...@spawar.navy.mil>.
So far no synchronization problems. I don't know about memory leaks; I'll
start watching for that.
Jeff
-----Original Message-----
From: Emmanuel Lecharny [mailto:elecharny@gmail.com]
Sent: Monday, December 19, 2005 1:01 PM
To: Apache Directory Developers List
Subject: RE: [ApacheDS] authentication problem
Hi Jeff,
btw, what about the test you launched friday? Has it ran ok? No
synchronization problems, no memory leaks?
Thanks for the feedback !
--Emmanuel
RE: [ApacheDS] authentication problem
Posted by Emmanuel Lecharny <el...@gmail.com>.
Hi Jeff,
btw, what about the test you launched friday? Has it ran ok? No
synchronization problems, no memory leaks?
Thanks for the feedback !
--Emmanuel
RE: [ApacheDS] authentication problem
Posted by Jeff Lansing <jl...@spawar.navy.mil>.
Stefan,
> How about your other problem? Does it still exist? You told us about a
> code snippet like this:
>
> InitialDirContext ctx = new InitialDirContext();
> LdapName name = new LdapName("ou=users");
> Attributes attributes = new LockableAttributesImpl();
> attributes.put("uid", "jdoe");
> NamingEnumeration ne = ctx.search(name, attributes);
>
> Can you provide information about the JNDI config you use (file
> jndi.properties, for instance)? Is it the LDAP provider from Sun, and
> are you talking about the network with plain LDAP?
The other problem was my fault. I didn't realize that the password attribute
was now returned as a byte[]. (I think formerly it was a String.)
We have embedded ApacheDS in our application. We could use the Sun provider,
but by embedding the directory, it starts up and stops at the same time as
our other services. Of course we can also talk to the directory itself with
an LDAP client (JXplorer, say).
Our application is based on the Globus ws-core, which uses JNDI for all of
its configuration, based on (lots of) jndi-config.xml files. We added an
additional layer by writing a custom InitialContextFactory that returns
InitialContexts that wrap the LDAP ones, but translate J2EE style names to
LdapNames (i.e., java:/comp/env/foo gets translated to dn=foo, dn=env,
dn=comp, ou=j2ee, ou=system), and vice-versa. In this way we keep all of the
Globus configuration in the directory, where it can be dynamically modified,
persisted, etc. without changing any of their code.
Jeff
Re: [ApacheDS] authentication problem
Posted by Stefan Zoerner <sz...@apache.org>.
Jeff Lansing wrote:
>
> I am using Windows XP with openldap 2.2.19. If I change the quotes as you
> suggest then the examples work ok.
>
Thank you for your valuable feedback, Jeff. In order to prevent others
from this trap I have modified the type of quotes in the LDAP command
line tool examples here:
http://directory.apache.org/subprojects/apacheds/users/authentication.html
How about your other problem? Does it still exist? You told us about a
code snippet like this:
InitialDirContext ctx = new InitialDirContext();
LdapName name = new LdapName("ou=users");
Attributes attributes = new LockableAttributesImpl();
attributes.put("uid", "jdoe");
NamingEnumeration ne = ctx.search(name, attributes);
Can you provide information about the JNDI config you use (file
jndi.properties, for instance)? Is it the LDAP provider from Sun, and
are you talking about the network with plain LDAP?
If so, I do not understand why you use class LockableAttributesImpl,
which is not part of JNDI. In order to create portable client code,
class javax.naming.directory.BasicAttributes should work for you.
Greetings, Stefan
RE: [ApacheDS] authentication problem
Posted by Jeff Lansing <jl...@spawar.navy.mil>.
Stephan,
> Which OS and LDAP clients do you use? I was able to reproduce it on
> Windows XP with the IBM TivoliDS LDAP client:
...
> Tell us whether it works for you now when you use -D "...". If yes, we
> should update the examples.
I am using Windows XP with openldap 2.2.19. If I change the quotes as you
suggest then the examples work ok.
Thanks,
Jeff
Re: [ApacheDS] authentication problem
Posted by Stefan Zoerner <sz...@apache.org>.
Jeff Lansing wrote:
> ...
> However, none of the examples on the page
> http://directory.apache.org/subprojects/apacheds/users/authentication.html
> will work. For example:
>
> C:\openldap>ldapsearch -D 'uid=admin,ou=system' -h localhost -p 10389 -x -w
> secret -s one -b 'ou=users,ou=system' '(uid=jdoe)'
> ldap_bind: Invalid credentials (49)
> additional info: Bind failed
>
> ...
>
> Any suggestions?
>
Hi Jeff!
At least for this one. I was able to reproduce this error and recommend
not to use '...' for the -D argument, but "..." (actually, for all of
the args!).
Which OS and LDAP clients do you use? I was able to reproduce it on
Windows XP with the IBM TivoliDS LDAP client:
C:\>ldapsearch -h magritte -p 10389 -b "ou=users,ou=system" -s base -D
'uid=admin,ou=system' -w secret "(objectclass=*)"
ldap_simple_bind: Invalid credentials
C:\>ldapsearch -h magritte -p 10389 -b "ou=users,ou=system" -s base -D
"uid=admin,ou=system" -w secret "(objectclass=*)"
ou=users,ou=system
objectClass=organizationalUnit
objectClass=top
ou=users
The same effect does not happen e.g. on Solaris9/bash with Suns own
ldapsearch. Here it doesn't matter whether one uses -D '...' or -D "..."
(this is why the example docs probably worked for the author, s/he used
a different environment).
Tell us whether it works for you now when you use -D "...". If yes, we
should update the examples.
Greetings from Hamburg,
Stefan