cas+ldap [beginner's?] problem

[Giuseppe Sollazzo-2]

Dear all,
I've just started setting up CAS for our Moodle installation and can't
get it to work properly with ldap. I was wondering if anyone had any
similar experiences and could give me a hand.

I can connect easily from moodle to ldap without CAS, so what I did is
the following:
1. I replicated the native moodle LDAP onfiguration into the CAS section
of the Authentication settings page and made the same data mapping.
2. I changed priority to have CAS to be above LDAP and moodle net auth.
3. I set up the deployerConfigContext.xml as explained on
http://www.ja-sig.org/wiki/display/CASUM/LDAP:
    - inserted a <bean> for the LdapContextSource using a valid LDAP
user with admin capabilities
    - added a bean for the BindLdapAuthenticationHandler in the
authentication manager section, with <property name="searchBase"
value="{same ou=... that I use for my native ldap auth into moodle}" />
4. Start tomcat, the deployment goes smoothly (I have DEBUG level for
log4j and can see there's absolutely no problem in this phase).

When I try to authenticate, I cannot get in, and the error seems
connected to the ldap user I specified:
Error in object 'credentials': codes
[error.authentication.credentials.bad.credentials,error.authentication.credentials.bad];
arguments []; default message [error.authentication.credentials.bad],
'org.springframework.validation.BindException.credentials' ->
org.springframework.validation.BindException:
org.springframework.validation.BeanPropertyBindingResult: 1 errors
Error in object 'credentials': codes
[error.authentication.credentials.bad.credentials,error.authentication.credentials.bad];
arguments []; default message [error.authentication.credentials.bad]],
status = Paused]]]]>

I tried different users, and no user at all, and I always get the same
error.

Does anyone have any idea or experience on this? I know it's possibly
something very simple and I do apologize for increasing the number of
messages in the mailing list :)


Of course, if anyone could show me a working deployerConfigContext.xml
that would also be helpful.

Thanks,
G


--
Giuseppe Sollazzo
Systems Developer / Administrator

Computing Services
St. George's, University of London


--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Marvin Addison]

> When I try to authenticate, I cannot get in, and the error seems connected
> to the ldap user I specified:
> Error in object 'credentials': codes
> [error.authentication.credentials.bad.credentials,error.authentication.credentials.bad];
> arguments []; default message [error.authentication.credentials.bad],

I've found it's most helpful to review the LDAP logs when
troubleshooting authentication failures like this.  There are at least
three points of failure:  the administrative bind, user search to
lookup user DN, and user bind; the logs will likely isolate which of
those is the cause of failure.  Once you identify which phase is
failing, it would help to post your entire LdapContextSource bean
definition so we can evaluate it against the details of your LDAP
environment, which you'd need to provide as well.

M

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Giuseppe Sollazzo-2]

Hi Marvin,
thanks for your message. The reason for which I didn't post my
LdapContextSource bean is that it's basically the same as the one on the
example. Moreover, the only difference is of course the details of the
username, which in my case is:
<property name="userDn" value="uid=username,ou=X,o=Y,o=Z"/>

where "uid=username,ou=X,o=Y,o=Z" is exactly the same ldap context
configuration I have for "native" ldap in the moodle configuration when
not using CAS. I also tried only "uid=admin" without success. (username
is a power ldap user).

What I get from the ldap log is as follows:

[14/Oct/2009:14:34:38 +0100] conn=302540 op=0 msgId=1 - BIND
dn="uid=username,ou=X,o=Y,o=Z" method=128 version=3
[14/Oct/2009:14:34:38 +0100] conn=302540 op=0 msgId=1 - RESULT err=32
tag=97 nentries=0 etime=0


I'm not a world-expert of LDAP but as far as I know error 32 is a "no
such object", meaning that "username" was not found in the directory -
which is technically not possible. Please note that "username" manages
to authenticate into moodle when using the native direct connection to LDAP.

Any hint would be highly appreciated :)

Thanks,
Giuseppe

Marvin Addison wrote:

>> When I try to authenticate, I cannot get in, and the error seems connected
>> to the ldap user I specified:
>> Error in object 'credentials': codes
>> [error.authentication.credentials.bad.credentials,error.authentication.credentials.bad];
>> arguments []; default message [error.authentication.credentials.bad],
>>    
>
> I've found it's most helpful to review the LDAP logs when
> troubleshooting authentication failures like this.  There are at least
> three points of failure:  the administrative bind, user search to
> lookup user DN, and user bind; the logs will likely isolate which of
> those is the cause of failure.  Once you identify which phase is
> failing, it would help to post your entire LdapContextSource bean
> definition so we can evaluate it against the details of your LDAP
> environment, which you'd need to provide as well.
>
> M
>
>  

--
Giuseppe Sollazzo
Systems Developer / Administrator

Computing Services
St. George's, University of London


--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Marvin Addison]

> What I get from the ldap log is as follows:
>
> [14/Oct/2009:14:34:38 +0100] conn=302540 op=0 msgId=1 - BIND
> dn="uid=username,ou=X,o=Y,o=Z" method=128 version=3
> [14/Oct/2009:14:34:38 +0100] conn=302540 op=0 msgId=1 - RESULT err=32 tag=97
> nentries=0 etime=0

The ldapsearch tool (provided by ldap-utils package on Debian) is
invaluable for diagnosing LDAP bind problems.  Execute the following
command which attempts to bind as the user above:

ldapsearch -H ldap://your.ldap.host -x -Z -b ou=X,o=Y,o=Z -D
uid=username,ou=X,o=Y,o=Z -W uid=username

Omit the -Z argument if you use an ldaps URL (SSL) to talk to your LDAP host.

M

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Giuseppe Sollazzo-2]

Some javascript/style in this post has been disabled (why?)

The ldapsearch tool (provided by ldap-utils package on Debian) is
invaluable for diagnosing LDAP bind problems.  Execute the following
command which attempts to bind as the user above:

ldapsearch -H ldap://your.ldap.host -x -Z -b ou=X,o=Y,o=Z -D
uid=username,ou=X,o=Y,o=Z -W uid=user

Omit the -Z argument if you use an ldaps URL (SSL) to talk to your LDAP host.

  

Hi Marvin,
your help is being amazingly invaluable!

First of all, I discovered I was being silly, using a wrong user. Only the Directory Manager is allowed to search ldap in my current configuration, so I managed to get info for "username" running this command:

ldapsearch -H ldap://my.ldap.server -x -Z -b ou=X,o=Y,o=Z -D "cn=Directory Manager" -W uid=user

So I adapted the deployerConfigContext.xml accordingly:

<bean id="contextSource" 
                  class="org.springframework.ldap.core.support.LdapContextSource">
          <property name="pooled" value="true"/>
          <property name="urls">
            <list>
              <value>ldap://my.ldap.server</value>
            </list>
          </property>
          <property name="userDn" value="cn=Directory Manager"/>
          <property name="password" value="HISPASSWORD"/>
          <property name="baseEnvironmentProperties">
            <map>
              <entry key="java.naming.security.authentication" value="simple" />
            </map>
          </property>
</bean>

and

<bean id="authenticationManager"
    class="org.jasig.cas.authentication.AuthenticationManagerImpl">
    [...]
    <property name="authenticationHandlers">
        <list>
            <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
                p:httpClient-ref="httpClient" />
            <bean class="org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler" >
                <property name="filter" value="uid=%u,ou=X,o=Y,o=Z" /> // [I also tried with username=%u, as it's called in our ldap]
                <property name="contextSource" ref="contextSource" />
            </bean>

        </list>
    </property>
[...]
</bind>

The result when I try to authenticate with username "user" is always as follows:

[15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - BIND dn="username=user,ou=people,o=sghms.ac.uk,o=sghms.ac.uk" method=128 version=3
[15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - RESULT err=32 tag=97 nentries=0 etime=0

(or uid=... in place of username)

I'm wondering if I'm getting something wrong elsewhere in the deployerConfigContext.xml?

Thanks again for your help,
Giuseppe

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Giuseppe Sollazzo-2]

Giuseppe Sollazzo wrote:

>
>
> The result when I try to authenticate with username "user" is always
> as follows:
>
> [15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - BIND
> dn="username=user,ou=people,o=sghms.ac.uk,o=sghms.ac.uk" method=128
> version=3
> [15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - RESULT err=32
> tag=97 nentries=0 etime=0
>

Erm..of course I left the original output of our domain, where it should
have been dn="username=user,ou=X,o=Y,o=Z"


--
Giuseppe Sollazzo
Systems Developer / Administrator

Computing Services
St. George's, University of London


--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Ryan Fox]

----- "Giuseppe Sollazzo" <[hidden email]> wrote:

> Giuseppe Sollazzo wrote:
> >
> >
> > The result when I try to authenticate with username "user" is always
>
> > as follows:
> >
> > [15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - BIND
> > dn="username=user,ou=people,o=sghms.ac.uk,o=sghms.ac.uk" method=128
>
> > version=3
> > [15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - RESULT
> err=32
> > tag=97 nentries=0 etime=0
> >
>
> Erm..of course I left the original output of our domain, where it
> should
> have been dn="username=user,ou=X,o=Y,o=Z"

LDAP err=32 means the object couldn't be found.  That is, the dn you are binding with doesn't exist.

Ryan

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Ryan Fox]

Sorry... now that I've read more of the thread, I can offer more help.  Funny how that works.

The err=32 means that the dn you are binding with doesn't exist.  If you look, that is the uid=user,ou=X,o=Y,o=Z.

> First of all, I discovered I was being silly, using a wrong user. Only
> the Directory Manager is allowed to search ldap in my current
> configuration, so I managed to get info for "username" running this
> command:

You need
ldapsearch -H ldap://my.ldap.server -x -Z -b ou=X,o=Y,o=Z -D "uid=user,ou=X,o=Y,o=Z" -W uid=user
to succeed.  I can't tell from your e-mail if it will or not, as I don't know what ACL's you have on your ldap.  The FastBindLdapAuthenticationHandler binds to your ldap as the user, and uses the result (success/error) to judge the validity of the credentials. The ldapsearch above is a good analogue for that.  Once that works, CAS auth should work (or at least progress farther).  :)

Ryan


----- "Giuseppe Sollazzo" <[hidden email]> wrote:

> The ldapsearch tool (provided by ldap-utils package on Debian) is
> invaluable for diagnosing LDAP bind problems.  Execute the following
> command which attempts to bind as the user above:
>
> ldapsearch -H ldap://your.ldap.host -x -Z -b ou=X,o=Y,o=Z -D
> uid=username,ou=X,o=Y,o=Z -W uid=user
>
> Omit the -Z argument if you use an ldaps URL (SSL) to talk to your
> LDAP host.
> Hi Marvin,
> your help is being amazingly invaluable!
>
> First of all, I discovered I was being silly, using a wrong user. Only
> the Directory Manager is allowed to search ldap in my current
> configuration, so I managed to get info for "username" running this
> command:
>
> ldapsearch -H ldap://my.ldap.server -x -Z -b ou=X,o=Y,o=Z -D
> "cn=Directory Manager" -W uid=user
> So I adapted the deployerConfigContext.xml accordingly:
>
> <bean id="contextSource"
> class="org.springframework.ldap.core.support.LdapContextSource">
> <property name="pooled" value="true"/>
> <property name="urls">
> <list>
> <value>ldap://my.ldap.server</value>
> </list>
> </property>
> <property name="userDn" value="cn=Directory Manager"/>
> <property name="password" value="HISPASSWORD"/>
> <property name="baseEnvironmentProperties">
> <map>
> <entry key="java.naming.security.authentication" value="simple" />
> </map>
> </property>
> </bean> and
>
> <bean id="authenticationManager"
> class="org.jasig.cas.authentication.AuthenticationManagerImpl">
> [...]
> <property name="authenticationHandlers">
> <list>
> <bean
> class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
> p:httpClient-ref="httpClient" />
> <bean
> class="org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler"
> >
> <property name="filter" value="uid=%u,ou=X,o=Y,o=Z" /> // [I also
> tried with username=%u, as it's called in our ldap]
> <property name="contextSource" ref="contextSource" />
> </bean>
>
> </list>
> </property>
> [...]
> </bind>
>
> The result when I try to authenticate with username "user" is always
> as follows:
>
> [15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - BIND
> dn="username=user,ou=people,o=sghms.ac.uk,o=sghms.ac.uk" method=128
> version=3
> [15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - RESULT err=32
> tag=97 nentries=0 etime=0
>
> (or uid=... in place of username)
>
> I'm wondering if I'm getting something wrong elsewhere in the
> deployerConfigContext.xml?
>
> Thanks again for your help,
> Giuseppe
>
> --
> Giuseppe Sollazzo
> Systems Developer / Administrator
>
> Computing Services
> St. George's, University of London --
> You are currently subscribed to [hidden email] as:
> [hidden email]
> To unsubscribe, change settings or access archives, see
> http://www.ja-sig.org/wiki/display/JSG/cas-user

--

Ryan Fox
The University of Findlay
1000 N Main St - Findlay, OH 45840
419-434-4348

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Giuseppe Sollazzo-2]

Some javascript/style in this post has been disabled (why?)

Hi Ryan,
yes the way I get it to work is by giving the fully qualified id

ldapsearch -H ldap://my.ldap.server -x -Z -b o=Y -D "uid=user,ou=a,ou=b,ou=c,ou=X,o=Y,o=Z" -W uid=user

Here was my misunderstanding: there is a need for fully qualified identifier for the user who binds, not for the one we're searching (yep - I know it wouldn't make sense otherwise but it was not extremely clear to me).

So, what happens now is that by adjusting the xml to look like

<bean id="contextSource" 
    class="org.springframework.ldap.core.support.LdapContextSource">
    <property name="pooled" value="true"/>
    <property name="urls">
        <list>
            <value>ldap://my.ldap.server</value>
        </list>
    </property>
    <property name="userDn" value="uid=user,ou=a,ou=b,ou=c,ou=X,o=Y,o=Z"/>
    <property name="password" value="pass"/>
    <property name="baseEnvironmentProperties">
        <map>
            <entry key="java.naming.security.authentication" value="simple" />
        </map>
    </property>
</bean>

and

<property name="authenticationHandlers">
    <list>
        <bean class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler" p:httpClient-ref="httpClient" />
        <bean class="org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler" >
            <property name="filter" value="uid=%u,o=Y" />
            <property name="contextSource" ref="contextSource" />
        </bean>
    </list>
</property>

is that I still get kicked out when I try to authenticate with CAS on moodle. Just to summarize:
- I activated CAS in the Authentication settings
- I moved CAS on top of LDAP and Moodle Network Authentication
- Logged out
- clicked on Login, entered a username (in this case "user" itself, as given the execution of ldapsearch it should work).

Any idea?

Thanks,
Giuseppe

Ryan Fox wrote:

Sorry... now that I've read more of the thread, I can offer more help.  Funny how that works.

The err=32 means that the dn you are binding with doesn't exist.  If you look, that is the uid=user,ou=X,o=Y,o=Z.

  

First of all, I discovered I was being silly, using a wrong user. Only
the Directory Manager is allowed to search ldap in my current
configuration, so I managed to get info for "username" running this
command:
    

You need 
ldapsearch -H ldap://my.ldap.server -x -Z -b ou=X,o=Y,o=Z -D "uid=user,ou=X,o=Y,o=Z" -W uid=user
to succeed.  I can't tell from your e-mail if it will or not, as I don't know what ACL's you have on your ldap.  The FastBindLdapAuthenticationHandler binds to your ldap as the user, and uses the result (success/error) to judge the validity of the credentials. The ldapsearch above is a good analogue for that.  Once that works, CAS auth should work (or at least progress farther).  :)

Ryan


----- "Giuseppe Sollazzo" [hidden email] wrote:

  

The ldapsearch tool (provided by ldap-utils package on Debian) is
invaluable for diagnosing LDAP bind problems.  Execute the following
command which attempts to bind as the user above:

ldapsearch -H ldap://your.ldap.host -x -Z -b ou=X,o=Y,o=Z -D
uid=username,ou=X,o=Y,o=Z -W uid=user

Omit the -Z argument if you use an ldaps URL (SSL) to talk to your
LDAP host.
Hi Marvin,
your help is being amazingly invaluable!

First of all, I discovered I was being silly, using a wrong user. Only
the Directory Manager is allowed to search ldap in my current
configuration, so I managed to get info for "username" running this
command:

ldapsearch -H ldap://my.ldap.server -x -Z -b ou=X,o=Y,o=Z -D
"cn=Directory Manager" -W uid=user
So I adapted the deployerConfigContext.xml accordingly:

<bean id="contextSource"
class="org.springframework.ldap.core.support.LdapContextSource">
<property name="pooled" value="true"/>
<property name="urls">
<list>
<value>ldap://my.ldap.server</value>
</list>
</property>
<property name="userDn" value="cn=Directory Manager"/>
<property name="password" value="HISPASSWORD"/>
<property name="baseEnvironmentProperties">
<map>
<entry key="java.naming.security.authentication" value="simple" />
</map>
</property>
</bean> and

<bean id="authenticationManager"
class="org.jasig.cas.authentication.AuthenticationManagerImpl">
[...]
<property name="authenticationHandlers">
<list>
<bean
class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
p:httpClient-ref="httpClient" />
<bean
class="org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler"
    

<property name="filter" value="uid=%u,ou=X,o=Y,o=Z" /> // [I also
tried with username=%u, as it's called in our ldap]
<property name="contextSource" ref="contextSource" />
</bean>

</list>
</property>
[...]
</bind>

The result when I try to authenticate with username "user" is always
as follows:

[15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - BIND
dn="username=user,ou=people,o=sghms.ac.uk,o=sghms.ac.uk" method=128
version=3
[15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - RESULT err=32
tag=97 nentries=0 etime=0

(or uid=... in place of username)

I'm wondering if I'm getting something wrong elsewhere in the
deployerConfigContext.xml?

Thanks again for your help,
Giuseppe

--
Giuseppe Sollazzo
Systems Developer / Administrator

Computing Services
St. George's, University of London --
You are currently subscribed to [hidden email] as:
[hidden email]
To unsubscribe, change settings or access archives, see
http://www.ja-sig.org/wiki/display/JSG/cas-user
    

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Giuseppe Sollazzo-2]

A little update...
I managed to get something different using the BindLdap instead of the
FastBind.

What I get this time is:

2009-10-15 14:28:03,472 INFO
[org.jasig.cas.authentication.AuthenticationManagerImpl] -
<AuthenticationHandler:
org.jasig.cas.adaptors.ldap.BindLdapAuthenticationHandler successfully
authenticated the user which provided the following credentials:
[username: user]>


followed by an eternal sequence of:

2009-10-15 14:28:03,477 INFO
[org.jasig.cas.CentralAuthenticationServiceImpl] - <Granted service
ticket [ST-1-OVG5l4krlYLR9q0Xl5Jl-cas] for service
[https://moodle.sgul.ac.uk/devmoodle/login/index.php] for user [user]>
2009-10-15 14:28:04,229 INFO
[org.jasig.cas.CentralAuthenticationServiceImpl] - <Granted service
ticket [ST-2-RBc0et7WkjCTqduVaPcK-cas] for service
[https://moodle.sgul.ac.uk/devmoodle/login/index.php] for user [user]>
...
2009-10-15 14:28:16,812 INFO
[org.jasig.cas.CentralAuthenticationServiceImpl] - <Granted service
ticket [ST-31-y1i0RQ5mfqS2zOzokAtx-cas] for service
[https://moodle.sgul.ac.uk/devmoodle/login/index.php] for user [user]>
2009-10-15 14:28:17,231 INFO
[org.jasig.cas.CentralAuthenticationServiceImpl] - <Granted ser...
...
(and counting :P)

I guess something is moving in the right direction but there are still
some issues?

Thanks for any help,
Giuseppe

Giuseppe Sollazzo wrote:

> Hi Ryan,
> yes the way I get it to work is by giving the fully qualified id
>
> ldapsearch -H ldap://my.ldap.server -x -Z -b o=Y -D
> "uid=user,ou=a,ou=b,ou=c,ou=X,o=Y,o=Z" -W uid=user
>
> Here was my misunderstanding: there is a need for fully qualified
> identifier for the user who binds, not for the one we're searching
> (yep - I know it wouldn't make sense otherwise but it was not
> extremely clear to me).
>
> So, what happens now is that by adjusting the xml to look like
>
> <bean id="contextSource"
>     class="org.springframework.ldap.core.support.LdapContextSource">
>     <property name="pooled" value="true"/>
>     <property name="urls">
>         <list>
>             <value>ldap://my.ldap.server</value>
>         </list>
>     </property>
>     <property name="userDn" value="uid=user,ou=a,ou=b,ou=c,ou=X,o=Y,o=Z"/>
>     <property name="password" value="pass"/>
>     <property name="baseEnvironmentProperties">
>         <map>
>             <entry key="java.naming.security.authentication"
> value="simple" />
>         </map>
>     </property>
> </bean>
>
> and
>
> <property name="authenticationHandlers">
>     <list>
>         <bean
> class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
> p:httpClient-ref="httpClient" />
>         <bean
> class="org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler" >
>             <property name="filter" value="uid=%u,o=Y" />
>             <property name="contextSource" ref="contextSource" />
>         </bean>
>     </list>
> </property>
>
> is that I still get kicked out when I try to authenticate with CAS on
> moodle. Just to summarize:
> - I activated CAS in the Authentication settings
> - I moved CAS on top of LDAP and Moodle Network Authentication
> - Logged out
> - clicked on Login, entered a username (in this case "user" itself, as
> given the execution of ldapsearch it should work).
>
> Any idea?
>
> Thanks,
> Giuseppe
>
> Ryan Fox wrote:
>> Sorry... now that I've read more of the thread, I can offer more help.  Funny how that works.
>>
>> The err=32 means that the dn you are binding with doesn't exist.  If you look, that is the uid=user,ou=X,o=Y,o=Z.
>>
>>  
>>> First of all, I discovered I was being silly, using a wrong user. Only
>>> the Directory Manager is allowed to search ldap in my current
>>> configuration, so I managed to get info for "username" running this
>>> command:
>>>    
>>
>> You need
>> ldapsearch -H ldap://my.ldap.server -x -Z -b ou=X,o=Y,o=Z -D "uid=user,ou=X,o=Y,o=Z" -W uid=user
>> to succeed.  I can't tell from your e-mail if it will or not, as I don't know what ACL's you have on your ldap.  The FastBindLdapAuthenticationHandler binds to your ldap as the user, and uses the result (success/error) to judge the validity of the credentials. The ldapsearch above is a good analogue for that.  Once that works, CAS auth should work (or at least progress farther).  :)
>>
>> Ryan
>>
>>
>> ----- "Giuseppe Sollazzo" <[hidden email]> wrote:
>>
>>  
>>> The ldapsearch tool (provided by ldap-utils package on Debian) is
>>> invaluable for diagnosing LDAP bind problems.  Execute the following
>>> command which attempts to bind as the user above:
>>>
>>> ldapsearch -H ldap://your.ldap.host -x -Z -b ou=X,o=Y,o=Z -D
>>> uid=username,ou=X,o=Y,o=Z -W uid=user
>>>
>>> Omit the -Z argument if you use an ldaps URL (SSL) to talk to your
>>> LDAP host.
>>> Hi Marvin,
>>> your help is being amazingly invaluable!
>>>
>>> First of all, I discovered I was being silly, using a wrong user. Only
>>> the Directory Manager is allowed to search ldap in my current
>>> configuration, so I managed to get info for "username" running this
>>> command:
>>>
>>> ldapsearch -H ldap://my.ldap.server -x -Z -b ou=X,o=Y,o=Z -D
>>> "cn=Directory Manager" -W uid=user
>>> So I adapted the deployerConfigContext.xml accordingly:
>>>
>>> <bean id="contextSource"
>>> class="org.springframework.ldap.core.support.LdapContextSource">
>>> <property name="pooled" value="true"/>
>>> <property name="urls">
>>> <list>
>>> <value>ldap://my.ldap.server</value>
>>> </list>
>>> </property>
>>> <property name="userDn" value="cn=Directory Manager"/>
>>> <property name="password" value="HISPASSWORD"/>
>>> <property name="baseEnvironmentProperties">
>>> <map>
>>> <entry key="java.naming.security.authentication" value="simple" />
>>> </map>
>>> </property>
>>> </bean> and
>>>
>>> <bean id="authenticationManager"
>>> class="org.jasig.cas.authentication.AuthenticationManagerImpl">
>>> [...]
>>> <property name="authenticationHandlers">
>>> <list>
>>> <bean
>>> class="org.jasig.cas.authentication.handler.support.HttpBasedServiceCredentialsAuthenticationHandler"
>>> p:httpClient-ref="httpClient" />
>>> <bean
>>> class="org.jasig.cas.adaptors.ldap.FastBindLdapAuthenticationHandler"
>>>    
>>> <property name="filter" value="uid=%u,ou=X,o=Y,o=Z" /> // [I also
>>> tried with username=%u, as it's called in our ldap]
>>> <property name="contextSource" ref="contextSource" />
>>> </bean>
>>>
>>> </list>
>>> </property>
>>> [...]
>>> </bind>
>>>
>>> The result when I try to authenticate with username "user" is always
>>> as follows:
>>>
>>> [15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - BIND
>>> dn="username=user,ou=people,o=sghms.ac.uk,o=sghms.ac.uk" method=128
>>> version=3
>>> [15/Oct/2009:10:43:11 +0100] conn=374073 op=0 msgId=1 - RESULT err=32
>>> tag=97 nentries=0 etime=0
>>>
>>> (or uid=... in place of username)
>>>
>>> I'm wondering if I'm getting something wrong elsewhere in the
>>> deployerConfigContext.xml?
>>>
>>> Thanks again for your help,
>>> Giuseppe
>>>
>>> --
>>> Giuseppe Sollazzo
>>> Systems Developer / Administrator
>>>
>>> Computing Services
>>> St. George's, University of London --
>>> You are currently subscribed to [hidden email] as:
>>> [hidden email]
>>> To unsubscribe, change settings or access archives, see
>>> http://www.ja-sig.org/wiki/display/JSG/cas-user
>>>    
>>
>>  
>
>
> --
> Giuseppe Sollazzo
> Systems Developer / Administrator
>
> Computing Services
> St. George's, University of London
>  
> --
> You are currently subscribed to [hidden email] as: [hidden email]
> To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

--
Giuseppe Sollazzo
Systems Developer / Administrator

Computing Services
St. George's, University of London


--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Marvin Addison]

> Here was my misunderstanding: there is a need for fully qualified identifier
> for the user who binds, not for the one we're searching

This is only true if you are using the BindLdapAuthenticationHandler,
but I see you're using FastBind.  I see from the XML snippets you
shared that you are defining manager bind credentials in the context,
then using the FastBind handler which does not need them.  Let me
outline the use cases for Bind and FastBind:

Use BindLdapAuthenticationHandler when you _cannot_ construct the full
DN of a user from the username given in the CAS login screen.  That
is, you must perform a search based on some other attribute, e.g.
mail, in order to determine the DN.  This handler performs
authentication for each user in three steps: admin bind, search, user
bind.

FastBindLdapAuthenticationHandler is more efficient and preferable
when you can construct the DN from the username in the login form,
e.g. uid=%s,ou=People,dc=vt,dc=edu.  The
FastBindLdapAuthenticationHandler will immediately construct the user
DN and use it with the password provided on the login form to perform
an LDAP bind operation.

Hopefully this will clear up what you need to do for your environment.

M

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Giuseppe Sollazzo-2]

Hi Marvin,
as we have many different DNs, for the moment being I cannot use the
FastBindLdapAuthenticationHandler due to limitations on our system.
So that's why I have to use the BindLdap, for which I seem to get to the
point outlined in my last e-mail: an infinite sequence of (incrementally
numbered) "Granting service tickets" that lead to nowhere (on Explorer)
or to a "Redirect loop" error on Firefox.

Is this something happened to anyone?

Thanks,
Giuseppe

Marvin Addison wrote:

>> Here was my misunderstanding: there is a need for fully qualified identifier
>> for the user who binds, not for the one we're searching
>>    
>
> This is only true if you are using the BindLdapAuthenticationHandler,
> but I see you're using FastBind.  I see from the XML snippets you
> shared that you are defining manager bind credentials in the context,
> then using the FastBind handler which does not need them.  Let me
> outline the use cases for Bind and FastBind:
>
> Use BindLdapAuthenticationHandler when you _cannot_ construct the full
> DN of a user from the username given in the CAS login screen.  That
> is, you must perform a search based on some other attribute, e.g.
> mail, in order to determine the DN.  This handler performs
> authentication for each user in three steps: admin bind, search, user
> bind.
>
> FastBindLdapAuthenticationHandler is more efficient and preferable
> when you can construct the DN from the username in the login form,
> e.g. uid=%s,ou=People,dc=vt,dc=edu.  The
> FastBindLdapAuthenticationHandler will immediately construct the user
> DN and use it with the password provided on the login form to perform
> an LDAP bind operation.
>
> Hopefully this will clear up what you need to do for your environment.
>
> M
>
>  

--
Giuseppe Sollazzo
Systems Developer / Administrator

Computing Services
St. George's, University of London


--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Technolithic]

Are you trying to run the CAS on Windows Quick Setup Guide?
http://www.ja-sig.org/wiki/display/CASUM/CAS+on+Windows+Quick+Setup+Guide

This guide was a real serious pain, most notably because of the class  
"AuthenticatedLdapContextSource" doesn't even exist and that a class  
in the Spring package replaces the deprecated fore-mentioned class.  
There were other less significant problems as well, but enough to  
cause substantial discouragement alike.

I have detailed instructions I've drafted since I finally got the  
stuff in the CAS setup guide running and I'm glad to share them with  
you.  I believe them to be accurate, but you could test it out and let  
me know how they did for you.  The document is attached.

Cheers!



Quoting Giuseppe Sollazzo <[hidden email]>:

> Dear all,
> I've just started setting up CAS for our Moodle installation and  
> can't get it to work properly with ldap. I was wondering if anyone  
> had any similar experiences and could give me a hand.
>
> I can connect easily from moodle to ldap without CAS, so what I did  
> is the following:
> 1. I replicated the native moodle LDAP onfiguration into the CAS  
> section of the Authentication settings page and made the same data  
> mapping.
> 2. I changed priority to have CAS to be above LDAP and moodle net auth.
> 3. I set up the deployerConfigContext.xml as explained on  
> http://www.ja-sig.org/wiki/display/CASUM/LDAP:
>    - inserted a <bean> for the LdapContextSource using a valid LDAP  
> user with admin capabilities
>    - added a bean for the BindLdapAuthenticationHandler in the  
> authentication manager section, with <property name="searchBase"  
> value="{same ou=... that I use for my native ldap auth into moodle}"  
> />
> 4. Start tomcat, the deployment goes smoothly (I have DEBUG level  
> for log4j and can see there's absolutely no problem in this phase).
>
> When I try to authenticate, I cannot get in, and the error seems  
> connected to the ldap user I specified:
> Error in object 'credentials': codes  
> [error.authentication.credentials.bad.credentials,error.authentication.credentials.bad]; arguments []; default message [error.authentication.credentials.bad], 'org.springframework.validation.BindException.credentials' -> org.springframework.validation.BindException: org.springframework.validation.BeanPropertyBindingResult: 1  
> errors
> Error in object 'credentials': codes  
> [error.authentication.credentials.bad.credentials,error.authentication.credentials.bad]; arguments []; default message [error.authentication.credentials.bad]], status =  
> Paused]]]]>
>
> I tried different users, and no user at all, and I always get the same error.
>
> Does anyone have any idea or experience on this? I know it's  
> possibly something very simple and I do apologize for increasing the  
> number of messages in the mailing list :)
>
>
> Of course, if anyone could show me a working  
> deployerConfigContext.xml that would also be helpful.
>
> Thanks,
> G
>
>
> --
> Giuseppe Sollazzo
> Systems Developer / Administrator
>
> Computing Services
> St. George's, University of London
>
>
> --
> You are currently subscribed to [hidden email] as:  
> [hidden email]
> To unsubscribe, change settings or access archives, see  
> http://www.ja-sig.org/wiki/display/JSG/cas-user
>
>

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Giuseppe Sollazzo-2]

Thanks, I'll give them a look and let you know what's the outcome.
However, I'm not following the Windows guide as we have a CentOs5 Linux
server.

Thanks,
Giuseppe

[hidden email] wrote:

> Are you trying to run the CAS on Windows Quick Setup Guide?
> http://www.ja-sig.org/wiki/display/CASUM/CAS+on+Windows+Quick+Setup+Guide
>
> This guide was a real serious pain, most notably because of the class  
> "AuthenticatedLdapContextSource" doesn't even exist and that a class  
> in the Spring package replaces the deprecated fore-mentioned class.  
> There were other less significant problems as well, but enough to  
> cause substantial discouragement alike.
>
> I have detailed instructions I've drafted since I finally got the  
> stuff in the CAS setup guide running and I'm glad to share them with  
> you.  I believe them to be accurate, but you could test it out and let  
> me know how they did for you.  The document is attached.
>
> Cheers!
>
>
>
> Quoting Giuseppe Sollazzo <[hidden email]>:
>
>  
>> Dear all,
>> I've just started setting up CAS for our Moodle installation and  
>> can't get it to work properly with ldap. I was wondering if anyone  
>> had any similar experiences and could give me a hand.
>>
>> I can connect easily from moodle to ldap without CAS, so what I did  
>> is the following:
>> 1. I replicated the native moodle LDAP onfiguration into the CAS  
>> section of the Authentication settings page and made the same data  
>> mapping.
>> 2. I changed priority to have CAS to be above LDAP and moodle net auth.
>> 3. I set up the deployerConfigContext.xml as explained on  
>> http://www.ja-sig.org/wiki/display/CASUM/LDAP:
>>    - inserted a <bean> for the LdapContextSource using a valid LDAP  
>> user with admin capabilities
>>    - added a bean for the BindLdapAuthenticationHandler in the  
>> authentication manager section, with <property name="searchBase"  
>> value="{same ou=... that I use for my native ldap auth into moodle}"  
>> />
>> 4. Start tomcat, the deployment goes smoothly (I have DEBUG level  
>> for log4j and can see there's absolutely no problem in this phase).
>>
>> When I try to authenticate, I cannot get in, and the error seems  
>> connected to the ldap user I specified:
>> Error in object 'credentials': codes  
>> [error.authentication.credentials.bad.credentials,error.authentication.credentials.bad]; arguments []; default message [error.authentication.credentials.bad], 'org.springframework.validation.BindException.credentials' -> org.springframework.validation.BindException: org.springframework.validation.BeanPropertyBindingResult: 1  
>> errors
>> Error in object 'credentials': codes  
>> [error.authentication.credentials.bad.credentials,error.authentication.credentials.bad]; arguments []; default message [error.authentication.credentials.bad]], status =  
>> Paused]]]]>
>>
>> I tried different users, and no user at all, and I always get the same error.
>>
>> Does anyone have any idea or experience on this? I know it's  
>> possibly something very simple and I do apologize for increasing the  
>> number of messages in the mailing list :)
>>
>>
>> Of course, if anyone could show me a working  
>> deployerConfigContext.xml that would also be helpful.
>>
>> Thanks,
>> G
>>
>>
>> --
>> Giuseppe Sollazzo
>> Systems Developer / Administrator
>>
>> Computing Services
>> St. George's, University of London
>>
>>
>> --
>> You are currently subscribed to [hidden email] as:  
>> [hidden email]
>> To unsubscribe, change settings or access archives, see  
>> http://www.ja-sig.org/wiki/display/JSG/cas-user
>>
>>
>>    
>
>
>
>  

--
Giuseppe Sollazzo
Systems Developer / Administrator

Computing Services
St. George's, University of London


--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Marvin Addison]

> http://www.ja-sig.org/wiki/display/CASUM/CAS+on+Windows+Quick+Setup+Guide
> ... was a real serious pain, most notably because of the class
> "AuthenticatedLdapContextSource" doesn't even exist and that a class
> in the Spring package replaces the deprecated fore-mentioned class.

I will put on my TODO list to fix that content problem.

> I have detailed instructions I've drafted since I finally got the
> stuff in the CAS setup guide running and I'm glad to share them with
> you.  I believe them to be accurate

There is a significant problem in your guide that we discussed
recently on the list, namely the used of pooled="true" for a context
source used for authentication.  I will say again, pooling of any kind
for authenticated connections is a serious security liability.  Search
the list archives if you need further information; we discussed this
thoroughly in the past week.

I respectfully request that you register for the CASUM Wiki and
contribute to our body of documentation that way.  If you discover a
glaring content error, by all means correct it if you have time.

Thanks,
M

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Scott Battaglia-2]

On Wed, Oct 14, 2009 at 9:13 AM, Marvin Addison <[hidden email]> wrote:

> http://www.ja-sig.org/wiki/display/CASUM/CAS+on+Windows+Quick+Setup+Guide

> ... was a real serious pain, most notably because of the class

> "AuthenticatedLdapContextSource" doesn't even exist and that a class
> in the Spring package replaces the deprecated fore-mentioned class.

I will put on my TODO list to fix that content problem.

> I have detailed instructions I've drafted since I finally got the
> stuff in the CAS setup guide running and I'm glad to share them with
> you.  I believe them to be accurate

There is a significant problem in your guide that we discussed
recently on the list, namely the used of pooled="true" for a context
source used for authentication.  I will say again, pooling of any kind
for authenticated connections is a serious security liability.  Search
the list archives if you need further information; we discussed this
thoroughly in the past week.

I think the reason our original documentation had pooling enabled was that the CAS code explicitly made sure that the second bind didn't get pooled (and only the single user got pooled, which is actually fine).  Spring LDAP did not appear to copy that piece of code (which I had thought they did since they based it off of our code).  We should probably request that they add that as an option at least.

Cheers,
Scott


 

I respectfully request that you register for the CASUM Wiki and
contribute to our body of documentation that way.  If you discover a
glaring content error, by all means correct it if you have time.

Thanks,

M

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

-- 
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Technolithic]

Thanks Marvin, I'll go ahead and register on the wiki.  In response to  
the contribution of documentation, I'm curious to find out what  
everyone thinks of creating a diagram that illustrates the most  
current version of CAS and describes, in detail, the intricacies of  
the relationships between components in a typical SSO solution.  This  
would help solidify my own understanding as well as help and newcomers  
to CAS.  If there is a favorable second to this motion, where should I  
attempt to post this diagram within the wiki?


Quoting Marvin Addison <[hidden email]>:

>> http://www.ja-sig.org/wiki/display/CASUM/CAS+on+Windows+Quick+Setup+Guide
>> ... was a real serious pain, most notably because of the class
>> "AuthenticatedLdapContextSource" doesn't even exist and that a class
>> in the Spring package replaces the deprecated fore-mentioned class.
>
> I will put on my TODO list to fix that content problem.
>
>> I have detailed instructions I've drafted since I finally got the
>> stuff in the CAS setup guide running and I'm glad to share them with
>> you.  I believe them to be accurate
>
> There is a significant problem in your guide that we discussed
> recently on the list, namely the used of pooled="true" for a context
> source used for authentication.  I will say again, pooling of any kind
> for authenticated connections is a serious security liability.  Search
> the list archives if you need further information; we discussed this
> thoroughly in the past week.
>
> I respectfully request that you register for the CASUM Wiki and
> contribute to our body of documentation that way.  If you discover a
> glaring content error, by all means correct it if you have time.
>
> Thanks,
> M
>
> --
> You are currently subscribed to [hidden email] as:  
> [hidden email]
> To unsubscribe, change settings or access archives, see  
> http://www.ja-sig.org/wiki/display/JSG/cas-user
>
>
>

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Marvin Addison]

> diagram that illustrates the most
> current version of CAS and describes, in detail, the intricacies of
> the relationships between components in a typical SSO solution

The best place for a CAS SSO workflow diagram is in the protocol
documents.  I don't believe they contain a diagram currently, but I
agree that a good diagram could be helpful to augment the verbal
description of protocol interactions.

If you would like to discuss SSO workflows in general, which is what I
understand from the phrase "typical SSO solution," then that would be
out of scope of the protocol documents.  I would argue that a general
discussion of SSO belongs on a general reference like Wikipedia, and
that CAS deployers need to come to the CAS wiki with this background
before diving into the details of CAS deployment.  I believe a
thoughtful bibliography of links to general SSO resources would better
serve our audience on the CASUM wiki.

M

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Technolithic]

Thanks, Marvin, I found the protocol documents which helped.  I agree  
with incorporating diagrams into the protocol documents and I agree  
with adding more links if they help to clear up the information  
already provided.

Here is a sequence diagram in as much as I understand about using CAS  
with an SSO solution.  In my scenario the back-end service is an LDAP  
server.  Client is the browser, Service is the WebApp, and Server is  
the CAS Server.  I'm lacking confidence that this is 100% correct.

----------   -----------   ----------   --------------------
| Client |   | Service |   | Server |   | Back-end Service |
----------   -----------   ----------   --------------------
      |Request for webpage       |                 |
      |----------->|             |                 |
      |            |             |                 |
      |Redirect to login url, provides ServiceID   |
      |<-----------|             |                 |
      |            |             |                 |
      |Request login page, sends ServiceID (and ticket granting cookie  
if already logged in)
      |------------------------->|                 |
      |            |             |                 |
      |redirect to requested webpage (if already logged in)
      |<-------------------------|                 |
      |            |             |                 |
      |GET request with service "ticket" as parameter (if already logged in)
      |----------->|             |                 |
      |            |             |                 |
      |Requested webpage (if already logged in)    |
      |<-----------|             |                 |
      |            |             |                 |
      |Login Landing Page (if not logged in) or error page
      |<-------------------------|                 |
      |            |             |                 |
      |POST credentials (username and password)
      |------------------------->|                 |
      |            |             |                 |
      |            |             |Validates Username and Password
      |            |             |---------------->|
      |            |             |                 |
      |            |             |Validation result|
      |            |             |<----------------|
      |Error page (on fail)      |                 |
      |<-------------------------|                 |
      |Redirect to service with service ticket (on success)
      |<-------------------------|                 |
      |            |             |                 |
      |GET request for service "ticket" as parameter (on success)
      |----------->|             |                 |
      |Requested webpage (on success)              |
      |<-----------|             |                 |
      |            |             |                 |
      |            |             |                 |
      |            |             |                 |






Quoting Marvin Addison <[hidden email]>:

>> diagram that illustrates the most
>> current version of CAS and describes, in detail, the intricacies of
>> the relationships between components in a typical SSO solution
>
> The best place for a CAS SSO workflow diagram is in the protocol
> documents.  I don't believe they contain a diagram currently, but I
> agree that a good diagram could be helpful to augment the verbal
> description of protocol interactions.
>
> If you would like to discuss SSO workflows in general, which is what I
> understand from the phrase "typical SSO solution," then that would be
> out of scope of the protocol documents.  I would argue that a general
> discussion of SSO belongs on a general reference like Wikipedia, and
> that CAS deployers need to come to the CAS wiki with this background
> before diving into the details of CAS deployment.  I believe a
> thoughtful bibliography of links to general SSO resources would better
> serve our audience on the CASUM wiki.
>
> M
>
> --
> You are currently subscribed to [hidden email] as:  
> [hidden email]
> To unsubscribe, change settings or access archives, see  
> http://www.ja-sig.org/wiki/display/JSG/cas-user
>
>

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user

[Marvin Addison]

Can you repost this on a new thread?  I can see we're muddying the
waters on solving this LDAP auth problem.

M

--
You are currently subscribed to [hidden email] as: [hidden email]
To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-user