Re: lookupUserFromDN to Active Directory fails after 405 upgrade

"Pascal" <[email protected]> Thu, 27 Jan 2005 17:11:48 +0100
Newsgroups	gmane.comp.cms.jahia.devel
Message-ID	<[email protected]>
no jdk-changes, serge...

The 4.0.4 and 4.0.5 sites are running on the same IBM 1.4.2 JDK-based 
WebSphere app server

regards
pascal

----- Original Message ----- 
From: "Serge Huber" <[email protected]>
To: <[email protected]>
Sent: Thursday, January 27, 2005 4:24 PM
Subject: Re: lookupUserFromDN to Active Directory fails after 405 upgrade


>
> Just a thought Pascal, when you upgraded to 4.0.5 did you also change the 
> JDK ? If so maybe it has something to do with the LDAP implementation ?
>
> Regards,
>  Serge...
>
> Thomas Draier wrote:
>
>> good news, at least we have a workaround !
>> from what i can read in micrososft notes, we should always use global 
>> directory if there are global users/groups, as it transparently follows 
>> the referrals and returns response as if they were in the global 
>> directory. however, i still do not understand why it was working on 
>> 4.0.4. even if many things have changed in the group members 
>> resolutions, the request on ldap server just differs in the search base 
>> and the scope. can you give me the complete dn of some of your users  and 
>> groups (local and global) ? also, do you know if  your users are  the 
>> global or local domain ?
>> thomas
>>
>> Le 27 janv. 05, Ã  10:08, Pascal a Ã©crit :
>>
>>> So what happens when you change the ldap-port from 389 to  3268 is  that 
>>> you
>>> query the Active Directory so-called Global Catalog (as suggested here:
>>> http://forum.java.sun.com/thread.jspa?threadID=365198).
>>>
>>> And then all of a sudden you can query users, groups and group-members 
>>> from
>>> Jahia 4.0.5 without any problem! (Safe for this exception which is - 
>>> sometimes - thrown
>>> when querying groups (and their members) but I can't see the reason 
>>> why. (see the end
>>> of this mail for the exception trace))
>>>
>>> However, I believe this is not entirely good news since although it 
>>> fixes the issues here in
>>> our development-environment, switching the ldap-port from 389 to 3268 
>>> might not be
>>> acceptable for some production environments, especially when you 
>>> consider the
>>> firewall setups/policies in some companies.
>>>
>>> Additional comments and suggestions are appreciated!
>>>
>>> pascal
>>>
>>>
>>>
>>>
>>> "[1/27/05 9:10:29:296 CET] 2c9def81 SystemOut     O 2005-01-27 
>>> 09:10:29,296 WARN  usermanager.JahiaUserManagerLDAPProvide
>>> r getUsers                  - Reconnection required
>>> javax.naming.CommunicationException: connection closed.  Root  exception 
>>> is
>>> java.io.IOException: connection closed
>>>        at com.sun.jndi.ldap.LdapClient.ensureOpen(LdapClient.java:1665)
>>>        at com.sun.jndi.ldap.LdapClient.search(LdapClient.java:611)
>>>        at com.sun.jndi.ldap.LdapCtx.doSearch(LdapCtx.java:1964)
>>>        at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1826)
>>>        at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1751)
>>>        at 
>>> com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirConte 
>>> xt.java:386)
>>>        at 
>>> com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompo 
>>> siteDirContext.java:347)
>>>        at 
>>> com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompo 
>>> siteDirContext.java:332)
>>>        at 
>>> javax.naming.directory.InitialDirContext.search(InitialDirContext.java: 
>>> 252)
>>>        at 
>>> org.jahia.services.usermanager.JahiaUserManagerLDAPProvider.getUsers(Ja 
>>> hiaUserManagerLDAPProvider.java:1492)
>>>        at 
>>> org.jahia.services.usermanager.JahiaUserManagerLDAPProvider.lookupUserF 
>>> romDN(JahiaUserManagerLDAPProvider.jav
>>> a:898)
>>>        at 
>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.getGroupMe 
>>> mbers(JahiaGroupManagerLDAPProvider.ja
>>> va:1328)
>>>        at 
>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.ldapToJahi 
>>> aGroup(JahiaGroupManagerLDAPProvider.j
>>> ava(Compiled Code))
>>>        at 
>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.searchGrou 
>>> ps(JahiaGroupManagerLDAPProvider.java:
>>> 636)"
>>>
>>>
>>> ----- Original Message ----- From: "Pascal" <[email protected]>
>>> To: <[email protected]>
>>> Sent: Wednesday, January 26, 2005 6:46 PM
>>> Subject: Re: lookupUserFromDN to Active Directory fails after 405 
>>> upgrade
>>>
>>>
>>>> To summarize the latest status of the problem:
>>>> - listing users now works
>>>> - listing groups works but users are not shown for Active Directory 
>>>> groups of type "Security Group  - Global".
>>>> The members for Active Directory groups of type "Security Group  - 
>>>> Domain local" *are* shown.
>>>>
>>>> In Jahia 4.0.4 the members for both group types were shown, and all 
>>>> our customers depend on this "feature"
>>>> (whether this is correct or not, I'm no AD-expert)
>>>>
>>>> FYI: In our dev-environment the AD-server is not configured for 
>>>> referral
>>>>
>>>> Using the 4_0_4 LDAPProvider-classes is a no-go, I'm afraid, because 
>>>> of too many compiler errors in Eclipse
>>>> when importing the corresponding source files in my Jahia 4.0.5 
>>>> web-project
>>>>
>>>> I'm going to have a look at what's being suggested over here: 
>>>> http://forum.java.sun.com/thread.jspa?threadID=365198
>>>>
>>>> I'll keep you guys posted.
>>>>
>>>> cheers
>>>> pascal
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> ----- Original Message ----- From: "Thomas Draier" 
>>>> <[email protected]>
>>>> To: <[email protected]>
>>>> Sent: Tuesday, January 25, 2005 4:38 PM
>>>> Subject: Re: lookupUserFromDN to Active Directory fails after 405 
>>>> upgrade
>>>>
>>>>
>>>> do you mean that you still have the same error, but only when 
>>>> accessing
>>>> group members ? you were getting the exact same exception when listing
>>>> all users without the patch ? that is quite strange, as the same
>>>> context is used for all methods in the JahiaUserManagerLDAPProvider 
>>>> ..?
>>>> i don't really know how active directory organize its data - do you
>>>> have any idea of the referrals configuration on your ad server ? it
>>>> looks like jndi cannot follow a reference on another server because of
>>>> an authentication issue. maybe you can try to change your credentials
>>>> as explained in
>>>> http://www-10.lotus.com/ldd/lsforum.nsf/0/
>>>> cd28ce081e3ebc5685256e5c005ce15c?OpenDocument . also i don't know why
>>>> it was working on jahia 4.0.4 - many changes have been made on the
>>>> group members resolution, but not really on the global user/group
>>>> search . if this is the only solution i believe you can use the 4.0.4
>>>> classes for both providers.
>>>> thomas
>>>>
>>>> Le 25 janv. 05, Ã  10:43, Pascal a Ã©crit :
>>>>
>>>>> Thx Thomas!
>>>>>
>>>>> After patching the JahiaUserManagerLDAPProvider (tagged with 
>>>>> JAHIA_4_0_5 in the CVS) and adding "users.ldap.refferal = follow" to 
>>>>> the users.ldap.properties I was able to lookup users in Active 
>>>>> Directory from the Jahia Administration panels.
>>>>>
>>>>> There's still one minor issue when looking up groups that didn't 
>>>>> occur to me until now: the Active Directory groups appear, but the 
>>>>> lookup of users for each group (so that the user list can be 
>>>>> displayed between brackets after each group name) fails with a 
>>>>> similar error (see stack trace below). Adding the 
>>>>> "groups.ldap.refferal = follow" to the groups.ldap.properties and 
>>>>> restarting Jahia does not help.
>>>>>
>>>>> For what it's worth: did I mention user- and group-lookup for Active 
>>>>> Directory were OK in version 4.0.4?
>>>>>
>>>>> thx again for your time
>>>>> pascal
>>>>>
>>>>>
>>>>> 2005-01-25 10:05:33,004 WARN  usermanager.JahiaUserManagerLDAPProvider 
>>>>> lookupUserFromDN - JNDI  warning
>>>>> javax.naming.PartialResultException. Root exception is
>>>>> javax.naming.AuthenticationException: [LDAP: error code 49 - 
>>>>> 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext 
>>>>> error, data  52e, v893
>>>>> at 
>>>>> com.sun.jndi.ldap.LdapReferralContext.<init>(LdapReferralContext.java 
>>>>> : 90)
>>>>> at 
>>>>> com.sun.jndi.ldap.LdapReferralException.getReferralContext(LdapReferr 
>>>>> al Exception.java:148)
>>>>> at 
>>>>> com.sun.jndi.ldap.LdapNamingEnumeration.hasMoreReferrals(LdapNamingEn 
>>>>> um eration.java:350)
>>>>> at 
>>>>> com.sun.jndi.ldap.LdapNamingEnumeration.hasMoreImpl(LdapNamingEnumera 
>>>>> ti on.java:223)
>>>>> at 
>>>>> com.sun.jndi.ldap.LdapNamingEnumeration.hasMore(LdapNamingEnumeration 
>>>>> .j ava:186)
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaUserManagerLDAPProvider.lookupUse 
>>>>> rF romDN(JahiaUserManagerLDAPProvider.java:900)
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.getGroup 
>>>>> Me mbers(JahiaGroupManagerLDAPProvider.java:1327)
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.ldapToJa 
>>>>> hi aGroup(JahiaGroupManagerLDAPProvider.java:1008)
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.searchGr 
>>>>> ou ps(JahiaGroupManagerLDAPProvider.java:636)
>>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>>> at 
>>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl. 
>>>>> ja va:79)
>>>>> at 
>>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces 
>>>>> so rImpl.java(Compiled Code))
>>>>> at java.lang.reflect.Method.invoke(Method.java(Compiled Code))
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaGroupManagerRoutingService.routeC 
>>>>> al l(JahiaGroupManagerRoutingService.java(Compiled Code))
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaGroupManagerRoutingService.search 
>>>>> Gr oups(JahiaGroupManagerRoutingService.java:762)
>>>>> at 
>>>>> org.jahia.data.viewhelper.principal.PrincipalViewHelper.getGroupSearc 
>>>>> hR esult(PrincipalViewHelper.java:385)
>>>>> at 
>>>>> org.jahia.admin.users.ManageGroups.displayGroupList(ManageGroups.java 
>>>>> : 255)
>>>>> at 
>>>>> org.jahia.admin.users.ManageGroups.userRequestDispatcher(ManageGroups 
>>>>> .j ava:144)
>>>>> at org.jahia.admin.users.ManageGroups.<init>(ManageGroups.java:121)
>>>>> at 
>>>>> org.jahia.bin.JahiaAdministration.userRequestDispatcher(JahiaAdminist 
>>>>> ra tion.java:388)
>>>>> at 
>>>>> org.jahia.bin.JahiaAdministration.service(JahiaAdministration.java: 
>>>>> 245)
>>>>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
>>>>> and also
>>>>>
>>>>> 2005-01-25 10:05:33,064 WARN  usermanager.JahiaUserManagerLDAPProvider 
>>>>> lookupUserFromDN - JNDI  warning
>>>>> javax.naming.NoInitialContextException: Need to specify class name  in 
>>>>> environment or system property, or as an applet parameter, or in  an 
>>>>> application resource file: java.naming.factory.initial
>>>>> at 
>>>>> javax.naming.spi.NamingManager.getInitialContext(NamingManager.java: 
>>>>> 652)
>>>>> at  javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java: 
>>>>> 256)
>>>>> at 
>>>>> javax.naming.InitialContext.getURLOrDefaultInitCtx(InitialContext.jav 
>>>>> a: 293)
>>>>> at 
>>>>> javax.naming.directory.InitialDirContext.getURLOrDefaultInitDirCtx(In 
>>>>> it ialDirContext.java:98)
>>>>> at 
>>>>> javax.naming.directory.InitialDirContext.search(InitialDirContext.jav 
>>>>> a: 251)
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaUserManagerLDAPProvider.getUsers( 
>>>>> Ja hiaUserManagerLDAPProvider.java:1492)
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaUserManagerLDAPProvider.lookupUse 
>>>>> rF romDN(JahiaUserManagerLDAPProvider.java:898)
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.getGroup 
>>>>> Me mbers(JahiaGroupManagerLDAPProvider.java:1327)
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.ldapToJa 
>>>>> hi aGroup(JahiaGroupManagerLDAPProvider.java:1008)
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.searchGr 
>>>>> ou ps(JahiaGroupManagerLDAPProvider.java:636)
>>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>>> at 
>>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl. 
>>>>> ja va:79)
>>>>> at 
>>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces 
>>>>> so rImpl.java(Compiled Code))
>>>>> at java.lang.reflect.Method.invoke(Method.java(Compiled Code))
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaGroupManagerRoutingService.routeC 
>>>>> al l(JahiaGroupManagerRoutingService.java(Compiled Code))
>>>>> at 
>>>>> org.jahia.services.usermanager.JahiaGroupManagerRoutingService.search 
>>>>> Gr oups(JahiaGroupManagerRoutingService.java:762)
>>>>> at 
>>>>> org.jahia.data.viewhelper.principal.PrincipalViewHelper.getGroupSearc 
>>>>> hR esult(PrincipalViewHelper.java:385)
>>>>> at 
>>>>> org.jahia.admin.users.ManageGroups.displayGroupList(ManageGroups.java 
>>>>> : 255)
>>>>> at 
>>>>> org.jahia.admin.users.ManageGroups.userRequestDispatcher(ManageGroups 
>>>>> .j ava:144)
>>>>> at org.jahia.admin.users.ManageGroups.<init>(ManageGroups.java:121)
>>>>> at 
>>>>> org.jahia.bin.JahiaAdministration.userRequestDispatcher(JahiaAdminist 
>>>>> ra tion.java:388)
>>>>> at 
>>>>> org.jahia.bin.JahiaAdministration.service(JahiaAdministration.java: 
>>>>> 245)
>>>>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
>>>>>
>>>>>
>>>>> ----- Original Message ----- From: "Thomas Draier" 
>>>>> <[email protected]>
>>>>> To: <[email protected]>
>>>>> Sent: Monday, January 24, 2005 7:06 PM
>>>>> Subject: Re: lookupUserFromDN to Active Directory fails after 405 
>>>>> upgrade
>>>>>
>>>>>
>>>>>> hi pascal,
>>>>>> i've made the change on the JAHIA-4-0-BRANCH and created a patch for
>>>>>> this version, but you can also apply it on the JAHIA_4_0_5. 
>>>>>> strangely
>>>>>> the patch is already applied on JahiaGroupManagerLDAPProvider - you
>>>>>> only need to change JahiaUserManagerLDAPProvider. then try to set 
>>>>>> the
>>>>>> parameter users.ldap.refferal to "follow" instead of the default
>>>>>> "ignore" in your property file.
>>>>>> thomas
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> Le 24 janv. 05, Ã  18:43, Pascal a Ã©crit :
>>>>>
>>>>>> I'll try that, but could you point me to the correct version of the
>>>>>> sourcefiles I should start with when applying the suggested fix?
>>>>>>
>>>>>> I'm guessing these are the right versions, but I'm not sure
>>>>>> http://cvspub.jahia.org/cgi-bin/cvsweb.cgi/jahia/src/java/org/jahia/
>>>>>> services/usermanager/Attic/JahiaGroupManagerLDAPProvider.java?
>>>>>> only_with_tag=JAHIA_4_0_5
>>>>>> http://cvspub.jahia.org/cgi-bin/cvsweb.cgi/jahia/src/java/org/jahia/
>>>>>> services/usermanager/Attic/JahiaUserManagerLDAPProvider.java?
>>>>>> only_with_tag=JAHIA_4_0_5
>>>>>>
>>>>>> tia
>>>>>> pascal
>>>>>>
>>>>>> ----- Original Message ----- From: "Thomas Draier"
>>>>>> <[email protected]>
>>>>>> To: <[email protected]>
>>>>>> Sent: Monday, January 24, 2005 3:29 PM
>>>>>> Subject: Re: lookupUserFromDN to Active Directory fails after 405
>>>>>> upgrade
>>>>>>
>>>>>>
>>>>>> hi,
>>>>>> this may be related to a referral server problem, as described in
>>>>>> http://www.mail-archive.com/[email protected]/msg00235.html . a 
>>>>>> patch
>>>>>> was provided at that time, but it think it's not in 4.0.5, only in 
>>>>>> the
>>>>>> cvs head - you can try to add the parameter described by anton in 
>>>>>> the
>>>>>> connectToPublicDir method . but the complete stack trace would be
>>>>>> useful for a better understanding of the problem.
>>>>>> thomas
>>>>>>
>>>>>> Le 24 janv. 05, Ã  14:40, Pascal a Ã©crit :
>>>>>>
>>>>>>> Both in the administration and in the user rights panels for
>>>>>>> containers, looking up users in Active Directory yields the 
>>>>>>> following
>>>>>>>  errors.
>>>>>>>
>>>>>>> Lookup of Active Directory groups works and login to the site with 
>>>>>>> an
>>>>>>> Active Directory user is no problem. The new settings in
>>>>>>> group-router-config.xml and router-config.xml appear to be 
>>>>>>> configured
>>>>>>> correctly, including the
>>>>>>> <factory>com.sun.jndi.ldap.LdapCtxFactory</factory> setting to 
>>>>>>> which
>>>>>>> the problem seems related.
>>>>>>>
>>>>>>> usermanager.JahiaUserManagerLDAPProvider lookupUserFromDN - JNDI
>>>>>>> warning
>>>>>>> javax.naming.PartialResultException. Root exception is
>>>>>>> javax.naming.AuthenticationException: [LDAP: error code 49 -
>>>>>>> 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext
>>>>>>> error, data  52e, v893
>>>>>>> <snip>
>>>>>>> WARN usermanager.JahiaUserManagerLDAPProvider lookupUserFromDN - 
>>>>>>> JNDI
>>>>>>> warning
>>>>>>> javax.naming.NoInitialContextException: Need to specify class name 
>>>>>>> in
>>>>>>> environment or system property, or as an applet parameter, or in an
>>>>>>> application resource file: java.naming.factory.initial
>>>>>>> at
>>>>>>> javax.naming.spi.NamingManager.getInitialContext(NamingManager.java 
>>>>>>> :
>>>>>>> 652)
>>>>>>>
>>>>>>> Any help is appreciated
>>>>>>> pascal
>>>>>>
>>>>
>>
>>
>
>