Re: lookupUserFromDN to Active Directory fails after 405 upgrade

just an idea - try to remove the groups.ldap.members.attribute.map from  
your properties file.

Le 27 janv. 05, à 16:06, Pascal a écrit :

> Example user DN: CN=JahiaAdministrator,CN=Users,DC=thedomain,DC=com
> Example goup DN: CN=AllJahiaEditors,CN=Users,DC=thedomain,DC=com
>
> Other realted info:
> groups.ldap.search.name = cn=Users,DC=thedomain,DC=com
> groups.ldap.dn.identifier.attribute = cn
> groups.ldap.search.objectclass = group
> groups.ldap.search.objectclass = group
> groups.ldap.members.attribute = member
> groups.ldap.groupname.attribute.map = CN
> groups.ldap.members.attribute.map = member
>
> users.ldap.uid.search.attribute = CN
> users.ldap.uid.search.name = cn=Users,DC=thedomain,DC=com
> users.ldap.dn.identifier.attribute = CN
> users.ldap.search.objectclass = person
>
> In our dev-environment users are in the local domain and the relevant  
> groups are of
> the type "Distribution Group - Global"
>
> regards
> pascal
>
>
> ----- Original Message ----- From: "Thomas Draier"  
> <[email protected]>
> To: <[email protected]>
> Sent: Thursday, January 27, 2005 3:13 PM
> Subject: Re: lookupUserFromDN to Active Directory fails after 405  
> upgrade
>
>
> good news, at least we have a workaround !
> from what i can read in micrososft notes, we should always use global
> directory if there are global users/groups, as it transparently follows
> the referrals and returns response as if they were in the global
> directory. however, i still do not understand why it was working on
> 4.0.4. even if many things have changed in the group members
> resolutions, the request on ldap server just differs in the search base
> and the scope. can you give me the complete dn of some of your users
> and groups (local and global) ? also, do you know if  your users are
> the global or local domain ?
> thomas
>
> Le 27 janv. 05, à 10:08, Pascal a écrit :
>
>> So what happens when you change the ldap-port from 389 to  3268 is   
>> that you
>> query the Active Directory so-called Global Catalog (as suggested  
>> here:
>> http://forum.java.sun.com/thread.jspa?threadID=365198).
>>
>> And then all of a sudden you can query users, groups and  
>> group-members from
>> Jahia 4.0.5 without any problem! (Safe for this exception which is -  
>> sometimes - thrown
>> when querying groups (and their members) but I can't see the reason   
>> why. (see the end
>> of this mail for the exception trace))
>>
>> However, I believe this is not entirely good news since although it   
>> fixes the issues here in
>> our development-environment, switching the ldap-port from 389 to 3268  
>> might not be
>> acceptable for some production environments, especially when you   
>> consider the
>> firewall setups/policies in some companies.
>>
>> Additional comments and suggestions are appreciated!
>>
>> pascal
>>
>>
>>
>>
>> "[1/27/05 9:10:29:296 CET] 2c9def81 SystemOut     O 2005-01-27  
>> 09:10:29,296 WARN  usermanager.JahiaUserManagerLDAPProvide
>> r getUsers                  - Reconnection required
>> javax.naming.CommunicationException: connection closed.  Root   
>> exception is
>> java.io.IOException: connection closed
>>        at  
>> com.sun.jndi.ldap.LdapClient.ensureOpen(LdapClient.java:1665)
>>        at com.sun.jndi.ldap.LdapClient.search(LdapClient.java:611)
>>        at com.sun.jndi.ldap.LdapCtx.doSearch(LdapCtx.java:1964)
>>        at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1826)
>>        at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1751)
>>        at  
>> com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirCont 
>> e xt.java:386)
>>        at  
>> com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialComp 
>> o siteDirContext.java:347)
>>        at  
>> com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialComp 
>> o siteDirContext.java:332)
>>        at  
>> javax.naming.directory.InitialDirContext.search(InitialDirContext.java 
>> : 252)
>>        at  
>> org.jahia.services.usermanager.JahiaUserManagerLDAPProvider.getUsers(J 
>> a hiaUserManagerLDAPProvider.java:1492)
>>        at  
>> org.jahia.services.usermanager.JahiaUserManagerLDAPProvider.lookupUser 
>> F romDN(JahiaUserManagerLDAPProvider.jav
>> a:898)
>>        at  
>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.getGroupM 
>> e mbers(JahiaGroupManagerLDAPProvider.ja
>> va:1328)
>>        at  
>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.ldapToJah 
>> i aGroup(JahiaGroupManagerLDAPProvider.j
>> ava(Compiled Code))
>>        at  
>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.searchGro 
>> u ps(JahiaGroupManagerLDAPProvider.java:
>> 636)"
>>
>>
>> ----- Original Message ----- From: "Pascal" <[email protected]>
>> To: <[email protected]>
>> Sent: Wednesday, January 26, 2005 6:46 PM
>> Subject: Re: lookupUserFromDN to Active Directory fails after 405   
>> upgrade
>>
>>
>>> To summarize the latest status of the problem:
>>> - listing users now works
>>> - listing groups works but users are not shown for Active Directory  
>>> groups of type "Security Group  - Global".
>>> The members for Active Directory groups of type "Security Group  -  
>>> Domain local" *are* shown.
>>>
>>> In Jahia 4.0.4 the members for both group types were shown, and all   
>>> our customers depend on this "feature"
>>> (whether this is correct or not, I'm no AD-expert)
>>>
>>> FYI: In our dev-environment the AD-server is not configured for   
>>> referral
>>>
>>> Using the 4_0_4 LDAPProvider-classes is a no-go, I'm afraid, because  
>>>  of too many compiler errors in Eclipse
>>> when importing the corresponding source files in my Jahia 4.0.5  
>>> web-project
>>>
>>> I'm going to have a look at what's being suggested over here:  
>>> http://forum.java.sun.com/thread.jspa?threadID=365198
>>>
>>> I'll keep you guys posted.
>>>
>>> cheers
>>> pascal
>>>
>>>
>>>
>>>
>>>
>>> ----- Original Message ----- From: "Thomas Draier"  
>>> <[email protected]>
>>> To: <[email protected]>
>>> Sent: Tuesday, January 25, 2005 4:38 PM
>>> Subject: Re: lookupUserFromDN to Active Directory fails after 405  
>>> upgrade
>>>
>>>
>>> do you mean that you still have the same error, but only when   
>>> accessing
>>> group members ? you were getting the exact same exception when  
>>> listing
>>> all users without the patch ? that is quite strange, as the same
>>> context is used for all methods in the JahiaUserManagerLDAPProvider   
>>> ..?
>>> i don't really know how active directory organize its data - do you
>>> have any idea of the referrals configuration on your ad server ? it
>>> looks like jndi cannot follow a reference on another server because  
>>> of
>>> an authentication issue. maybe you can try to change your credentials
>>> as explained in
>>> http://www-10.lotus.com/ldd/lsforum.nsf/0/
>>> cd28ce081e3ebc5685256e5c005ce15c?OpenDocument . also i don't know why
>>> it was working on jahia 4.0.4 - many changes have been made on the
>>> group members resolution, but not really on the global user/group
>>> search . if this is the only solution i believe you can use the 4.0.4
>>> classes for both providers.
>>> thomas
>>>
>>> Le 25 janv. 05, à 10:43, Pascal a écrit :
>>>
>>>> Thx Thomas!
>>>>
>>>> After patching the JahiaUserManagerLDAPProvider (tagged with  
>>>> JAHIA_4_0_5 in the CVS) and adding "users.ldap.refferal = follow"  
>>>> to the users.ldap.properties I was able to lookup users in Active  
>>>> Directory from the Jahia Administration panels.
>>>>
>>>> There's still one minor issue when looking up groups that didn't   
>>>> occur to me until now: the Active Directory groups appear, but the   
>>>> lookup of users for each group (so that the user list can be   
>>>> displayed between brackets after each group name) fails with a   
>>>> similar error (see stack trace below). Adding the   
>>>> "groups.ldap.refferal = follow" to the groups.ldap.properties and   
>>>> restarting Jahia does not help.
>>>>
>>>> For what it's worth: did I mention user- and group-lookup for  
>>>> Active Directory were OK in version 4.0.4?
>>>>
>>>> thx again for your time
>>>> pascal
>>>>
>>>>
>>>> 2005-01-25 10:05:33,004 WARN   
>>>> usermanager.JahiaUserManagerLDAPProvider lookupUserFromDN - JNDI   
>>>> warning
>>>> javax.naming.PartialResultException. Root exception is
>>>> javax.naming.AuthenticationException: [LDAP: error code 49 -   
>>>> 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext   
>>>> error, data 52e, v893
>>>> at  
>>>> com.sun.jndi.ldap.LdapReferralContext.<init>(LdapReferralContext.jav 
>>>> a : 90)
>>>> at  
>>>> com.sun.jndi.ldap.LdapReferralException.getReferralContext(LdapRefer 
>>>> r al Exception.java:148)
>>>> at  
>>>> com.sun.jndi.ldap.LdapNamingEnumeration.hasMoreReferrals(LdapNamingE 
>>>> n um eration.java:350)
>>>> at  
>>>> com.sun.jndi.ldap.LdapNamingEnumeration.hasMoreImpl(LdapNamingEnumer 
>>>> a ti on.java:223)
>>>> at  
>>>> com.sun.jndi.ldap.LdapNamingEnumeration.hasMore(LdapNamingEnumeratio 
>>>> n .j ava:186)
>>>> at  
>>>> org.jahia.services.usermanager.JahiaUserManagerLDAPProvider.lookupUs 
>>>> e rF romDN(JahiaUserManagerLDAPProvider.java:900)
>>>> at  
>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.getGrou 
>>>> p Me mbers(JahiaGroupManagerLDAPProvider.java:1327)
>>>> at  
>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.ldapToJ 
>>>> a hi aGroup(JahiaGroupManagerLDAPProvider.java:1008)
>>>> at  
>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.searchG 
>>>> r ou ps(JahiaGroupManagerLDAPProvider.java:636)
>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>> at  
>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl 
>>>> . ja va:79)
>>>> at  
>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcce 
>>>> s so rImpl.java(Compiled Code))
>>>> at java.lang.reflect.Method.invoke(Method.java(Compiled Code))
>>>> at  
>>>> org.jahia.services.usermanager.JahiaGroupManagerRoutingService.route 
>>>> C al l(JahiaGroupManagerRoutingService.java(Compiled Code))
>>>> at  
>>>> org.jahia.services.usermanager.JahiaGroupManagerRoutingService.searc 
>>>> h Gr oups(JahiaGroupManagerRoutingService.java:762)
>>>> at  
>>>> org.jahia.data.viewhelper.principal.PrincipalViewHelper.getGroupSear 
>>>> c hR esult(PrincipalViewHelper.java:385)
>>>> at  
>>>> org.jahia.admin.users.ManageGroups.displayGroupList(ManageGroups.jav 
>>>> a : 255)
>>>> at  
>>>> org.jahia.admin.users.ManageGroups.userRequestDispatcher(ManageGroup 
>>>> s .j ava:144)
>>>> at org.jahia.admin.users.ManageGroups.<init>(ManageGroups.java:121)
>>>> at  
>>>> org.jahia.bin.JahiaAdministration.userRequestDispatcher(JahiaAdminis 
>>>> t ra tion.java:388)
>>>> at    
>>>> org.jahia.bin.JahiaAdministration.service(JahiaAdministration.java:  
>>>> 245)
>>>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
>>>> and also
>>>>
>>>> 2005-01-25 10:05:33,064 WARN   
>>>> usermanager.JahiaUserManagerLDAPProvider lookupUserFromDN - JNDI   
>>>> warning
>>>> javax.naming.NoInitialContextException: Need to specify class name   
>>>> in environment or system property, or as an applet parameter, or in  
>>>>  an application resource file: java.naming.factory.initial
>>>> at  
>>>> javax.naming.spi.NamingManager.getInitialContext(NamingManager.java: 
>>>>  652)
>>>> at   
>>>> javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:  
>>>> 256)
>>>> at  
>>>> javax.naming.InitialContext.getURLOrDefaultInitCtx(InitialContext.ja 
>>>> v a: 293)
>>>> at  
>>>> javax.naming.directory.InitialDirContext.getURLOrDefaultInitDirCtx(I 
>>>> n it ialDirContext.java:98)
>>>> at  
>>>> javax.naming.directory.InitialDirContext.search(InitialDirContext.ja 
>>>> v a: 251)
>>>> at  
>>>> org.jahia.services.usermanager.JahiaUserManagerLDAPProvider.getUsers 
>>>> ( Ja hiaUserManagerLDAPProvider.java:1492)
>>>> at  
>>>> org.jahia.services.usermanager.JahiaUserManagerLDAPProvider.lookupUs 
>>>> e rF romDN(JahiaUserManagerLDAPProvider.java:898)
>>>> at  
>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.getGrou 
>>>> p Me mbers(JahiaGroupManagerLDAPProvider.java:1327)
>>>> at  
>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.ldapToJ 
>>>> a hi aGroup(JahiaGroupManagerLDAPProvider.java:1008)
>>>> at  
>>>> org.jahia.services.usermanager.JahiaGroupManagerLDAPProvider.searchG 
>>>> r ou ps(JahiaGroupManagerLDAPProvider.java:636)
>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>> at  
>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl 
>>>> . ja va:79)
>>>> at  
>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcce 
>>>> s so rImpl.java(Compiled Code))
>>>> at java.lang.reflect.Method.invoke(Method.java(Compiled Code))
>>>> at  
>>>> org.jahia.services.usermanager.JahiaGroupManagerRoutingService.route 
>>>> C al l(JahiaGroupManagerRoutingService.java(Compiled Code))
>>>> at  
>>>> org.jahia.services.usermanager.JahiaGroupManagerRoutingService.searc 
>>>> h Gr oups(JahiaGroupManagerRoutingService.java:762)
>>>> at  
>>>> org.jahia.data.viewhelper.principal.PrincipalViewHelper.getGroupSear 
>>>> c hR esult(PrincipalViewHelper.java:385)
>>>> at  
>>>> org.jahia.admin.users.ManageGroups.displayGroupList(ManageGroups.jav 
>>>> a : 255)
>>>> at  
>>>> org.jahia.admin.users.ManageGroups.userRequestDispatcher(ManageGroup 
>>>> s .j ava:144)
>>>> at org.jahia.admin.users.ManageGroups.<init>(ManageGroups.java:121)
>>>> at  
>>>> org.jahia.bin.JahiaAdministration.userRequestDispatcher(JahiaAdminis 
>>>> t ra tion.java:388)
>>>> at    
>>>> org.jahia.bin.JahiaAdministration.service(JahiaAdministration.java:  
>>>> 245)
>>>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
>>>>
>>>>
>>>> ----- Original Message ----- From: "Thomas Draier"  
>>>> <[email protected]>
>>>> To: <[email protected]>
>>>> Sent: Monday, January 24, 2005 7:06 PM
>>>> Subject: Re: lookupUserFromDN to Active Directory fails after 405  
>>>> upgrade
>>>>
>>>>
>>>>> hi pascal,
>>>>> i've made the change on the JAHIA-4-0-BRANCH and created a patch  
>>>>> for
>>>>> this version, but you can also apply it on the JAHIA_4_0_5.   
>>>>> strangely
>>>>> the patch is already applied on JahiaGroupManagerLDAPProvider - you
>>>>> only need to change JahiaUserManagerLDAPProvider. then try to set   
>>>>> the
>>>>> parameter users.ldap.refferal to "follow" instead of the default
>>>>> "ignore" in your property file.
>>>>> thomas
>>>>>
>>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> Le 24 janv. 05, à 18:43, Pascal a écrit :
>>>>
>>>>> I'll try that, but could you point me to the correct version of the
>>>>> sourcefiles I should start with when applying the suggested fix?
>>>>>
>>>>> I'm guessing these are the right versions, but I'm not sure
>>>>> http://cvspub.jahia.org/cgi-bin/cvsweb.cgi/jahia/src/java/org/ 
>>>>> jahia/
>>>>> services/usermanager/Attic/JahiaGroupManagerLDAPProvider.java?
>>>>> only_with_tag=JAHIA_4_0_5
>>>>> http://cvspub.jahia.org/cgi-bin/cvsweb.cgi/jahia/src/java/org/ 
>>>>> jahia/
>>>>> services/usermanager/Attic/JahiaUserManagerLDAPProvider.java?
>>>>> only_with_tag=JAHIA_4_0_5
>>>>>
>>>>> tia
>>>>> pascal
>>>>>
>>>>> ----- Original Message ----- From: "Thomas Draier"
>>>>> <[email protected]>
>>>>> To: <[email protected]>
>>>>> Sent: Monday, January 24, 2005 3:29 PM
>>>>> Subject: Re: lookupUserFromDN to Active Directory fails after 405
>>>>> upgrade
>>>>>
>>>>>
>>>>> hi,
>>>>> this may be related to a referral server problem, as described in
>>>>> http://www.mail-archive.com/[email protected]/msg00235.html . a   
>>>>> patch
>>>>> was provided at that time, but it think it's not in 4.0.5, only in  
>>>>>  the
>>>>> cvs head - you can try to add the parameter described by anton in   
>>>>> the
>>>>> connectToPublicDir method . but the complete stack trace would be
>>>>> useful for a better understanding of the problem.
>>>>> thomas
>>>>>
>>>>> Le 24 janv. 05, à 14:40, Pascal a écrit :
>>>>>
>>>>>> Both in the administration and in the user rights panels for
>>>>>> containers, looking up users in Active Directory yields the   
>>>>>> following
>>>>>>  errors.
>>>>>>
>>>>>> Lookup of Active Directory groups works and login to the site  
>>>>>> with  an
>>>>>> Active Directory user is no problem. The new settings in
>>>>>> group-router-config.xml and router-config.xml appear to be   
>>>>>> configured
>>>>>> correctly, including the
>>>>>> <factory>com.sun.jndi.ldap.LdapCtxFactory</factory> setting to   
>>>>>> which
>>>>>> the problem seems related.
>>>>>>
>>>>>> usermanager.JahiaUserManagerLDAPProvider lookupUserFromDN - JNDI
>>>>>> warning
>>>>>> javax.naming.PartialResultException. Root exception is
>>>>>> javax.naming.AuthenticationException: [LDAP: error code 49 -
>>>>>> 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext
>>>>>> error, data  52e, v893
>>>>>> <snip>
>>>>>> WARN usermanager.JahiaUserManagerLDAPProvider lookupUserFromDN -   
>>>>>> JNDI
>>>>>> warning
>>>>>> javax.naming.NoInitialContextException: Need to specify class  
>>>>>> name  in
>>>>>> environment or system property, or as an applet parameter, or in  
>>>>>> an
>>>>>> application resource file: java.naming.factory.initial
>>>>>> at
>>>>>> javax.naming.spi.NamingManager.getInitialContext(NamingManager.jav 
>>>>>> a :
>>>>>> 652)
>>>>>>
>>>>>> Any help is appreciated
>>>>>> pascal