Re: Kerberos Authentication to FreeIPA - web application error
Jonathan Heard <[email protected]> Fri, 29 Jun 2018 17:04:38 +0100
| Newsgroups | gmane.network.opennms.general |
|---|---|
| Message-ID | <[email protected]> |
Hi Shawn,
I use just plain LDAP to authenticate against FreeIPA - I'm wondering
if the LDAP part of your config might need customising.. I don't think
we've customised our schema and you'll note that the users filter is
different from the default. You also need to make sure that the user
exist in the relevant groups - we allow all 'ipausers' to log in as below.
I hope this is helpful.
Cheers
Jonathan
<beans:bean id="userSearch"
class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
<beans:constructor-arg index="0" *value="ou=users"* />
<!-- More complex filters are possible depending on the layout of
your directory -->
<beans:constructor-arg index="1" value="(uid={0})" />
<beans:constructor-arg index="2" ref="contextSource" />
<beans:property name="searchSubtree" value="true" />
</beans:bean>
<beans:bean id="userGroupLdapAuthoritiesPopulator"
class="org.opennms.web.springframework.security.UserGroupLdapAuthoritiesPopulator">
<beans:constructor-arg ref="contextSource"/>
<!-- Common LDAP container for the user and admin groups listed
below -->
<beans:constructor-arg value="cn=groups,cn=accounts" />
<beans:property name="searchSubtree" value="true" />
<beans:property name="convertToUpperCase" value="true" />
<beans:property name="groupRoleAttribute" value="cn" />
<beans:property name="groupSearchFilter" value="member={0}" />
<beans:property name="groupToRoleMap">
<beans:map>
<beans:entry>
<!-- Name of the LDAP group for normal (non-admin) OpenNMS
users -->
<beans:key><beans:value>*ipausers*</beans:value></beans:key>
<beans:list>
<beans:value>ROLE_USER</beans:value>
<beans:value>ROLE_DASHBOARD</beans:value>
</beans:list>
</beans:entry>
<beans:entry>
<!-- Name of the LDAP group for OpenNMS administrators -->
<beans:key><beans:value>monitoring_admins</beans:value></beans:key>
<beans:list>
<beans:value>ROLE_USER</beans:value>
<beans:value>ROLE_ADMIN</beans:value>
</beans:list>
</beans:entry>
</beans:map>
</beans:property>
</beans:bean>
On 29/06/18 14:44, Shawn Southern wrote:
> We're using the sample FreeIPA XML Spring Security file that is included with OpenNMS Horizon. The changes to applicationContext-spring-security.xml have been made exactly as directed in the sso_freeIPA_kerb_ldap.xml file.
>
> We've added the SPN HTTP/[email protected] to the OpenNMS host in FreeIPA, and used ipa-getkeytab to retrieve the keytab.
>
> Authentication appears to work, as we get an error (Your log-in attempt failed, please try again. Reason: Kerberos authentication failed) when we use an incorrect user/password. When we use a correct username/password combination, with a user that is in the opennms_admins or opennms_users groups, the OpenNMS Web User Interface encounters an error. I've posted a screenshot on imgur: https://imgur.com/a/x7DqdNY. We can log in with any native OpenNMS accounts without issue; only FreeIPA accounts encounter this issue.
>
> The web interface error:
>
> The OpenNMS Web User Interface Has Experienced an Error
> The OpenNMS web UI has encountered an error that it does not know how to handle.
> Possible causes could be that the database is not responding, the OpenNMS application has stopped or is not running, or there is an issue with the servlet container.
> Please bring this message to the attention of the person responsible for maintaining OpenNMS for your organization, and have him or her check that OpenNMS, the external servlet container (if applicable), and the database are all running without errors.
> To reveal details of the error encountered and instructions for reporting it, click here.
>
> Error Details
> Please include the information below when reporting problems.
>
> javax.naming.AuthenticationException
> at org.springframework.security.kerberos.client.ldap.KerberosLdapContextSource.login(KerberosLdapContextSource.java:151)
> at org.springframework.security.kerberos.client.ldap.KerberosLdapContextSource.getDirContextInstance(KerberosLdapContextSource.java:110)
> at org.springframework.ldap.core.support.AbstractContextSource.createContext(AbstractContextSource.java:273)
> at org.springframework.ldap.core.support.AbstractContextSource.doGetContext(AbstractContextSource.java:119)
> at org.springframework.ldap.core.support.AbstractContextSource.getReadOnlyContext(AbstractContextSource.java:138)
> at org.springframework.ldap.core.LdapTemplate.executeReadOnly(LdapTemplate.java:791)
> at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleEntry(SpringSecurityLdapTemplate.java:194)
> at org.springframework.security.ldap.search.FilterBasedLdapUserSearch.searchForUser(FilterBasedLdapUserSearch.java:116)
> at org.opennms.web.springframework.security.KerberosLdapAuthenticationProvider.authenticate(KerberosLdapAuthenticationProvider.java:75)
> at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)
> at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:92)
> at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:211)
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
> at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:107)
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
> at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:107)
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
> at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
> at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
> at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
> at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
> at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
> at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
> at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
> at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1621)
> at org.springframework.orm.hibernate3.support.OpenSessionInViewFilter.doFilterInternal(OpenSessionInViewFilter.java:231)
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
> at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1621)
> at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
> at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1613)
> at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:541)
> at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
> at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548)
> at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
> at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:190)
> at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1592)
> at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188)
> at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1239)
> at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168)
> at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:481)
> at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1561)
> at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166)
> at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1141)
> at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
> at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:213)
> at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:118)
> at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
> at org.opennms.netmgt.jetty.MDCHandler.handle(MDCHandler.java:46)
> at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
> at org.eclipse.jetty.server.Server.handle(Server.java:564)
> at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:320)
> at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)
> at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)
> at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:110)
> at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:258)
> at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:147)
> at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:110)
> at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)
> at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:672)
> at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:590)
> at java.lang.Thread.run(Thread.java:748)
>
> Request Details
> Locale en_US
> Method POST
> Path Info null
> Path Info (translated) null
> Protocol HTTP/1.1
> URI /opennms/errors/unknownexception.jsp
> URL https://opennms.mydomain.com/opennms/errors/unknownexception.jsp
> Scheme https
> Server Name opennms.mydomain.com
> Server Port 443
>
> System Details
> OpenNMS Version: 22.0.0
> Java Version: 1.8.0_144 Oracle Corporation
> Java Virtual Machine: 25.144-b01 Oracle Corporation
> Operating System: Linux 3.10.0-862.3.3.el7.x86_64 (amd64)
> Servlet Container: jetty/9.4.2.v20170220 (Servlet Spec 3.1)
> User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
>
> ------------------------------------------
>
> sso_freeIPA_kerb_ldap.xml:
> <beans xmlns="http://www.springframework.org/schema/beans"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
> xmlns:sec="http://www.springframework.org/schema/security"
> xmlns:context="http://www.springframework.org/schema/context"
> xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
> http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
> http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.2.xsd">
>
> <bean id="kerberosAuthenticationProvider"
> class="org.opennms.web.springframework.security.KerberosLdapAuthenticationProvider">
> <property name="kerberosClient">
> <bean class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient">
> <property name="debug" value="true"/>
> </bean>
> </property>
> <property name="ldapUserSearch" ref="kerberosLdapUserSearch"/>
> <property name="ldapAuthoritiesPopulator" ref="kerberosUserGroupLdapAuthoritiesPopulator"/>
> </bean>
>
> <bean id="kerberosServiceAuthenticationProvider"
> class="org.opennms.web.springframework.security.KerberosServiceLdapAuthenticationProvider">
> <property name="ticketValidator">
> <bean
> class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator">
> <!-- Name of the Kerberos service principal designated for the OpenNMS webapp -->
> <property name="servicePrincipal" value="HTTP/[email protected]" />
> <!-- Location of the Kerberos keytab file. Must be of the form file:/path/to/keytab -->
> <property name="keyTabLocation" value="file:/opt/opennms/etc/HTTP_opennms.mydomain.com.keytab" />
> <property name="debug" value="true" />
> </bean>
> </property>
> <property name="ldapUserSearch" ref="kerberosLdapUserSearch"/>
> <property name="ldapAuthoritiesPopulator" ref="kerberosUserGroupLdapAuthoritiesPopulator"/>
> </bean>
>
> <bean id="spnegoEntryPoint"
> class="org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint" >
> <constructor-arg value="/login.jsp" />
> </bean>
>
> <bean id="spnegoAuthenticationProcessingFilter"
> class="org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter">
> <property name="authenticationManager" ref="authenticationManager" />
> </bean>
>
> <bean id="kerberosLdapContextSource"
> class="org.springframework.security.kerberos.client.ldap.KerberosLdapContextSource">
> <constructor-arg>
> <list>
> <!-- List one or more of your LDAP servers here -->
> <!-- <value>ldaps://mydomain.com:636/</value> -->
> <value>ldaps://freeipaserver1.mydomain.com:636/</value>
> <value>ldaps://freeipaserver2.mydomain.com:636/</value>
> </list>
> </constructor-arg>
> <!-- Base DN for LDAP searches. Every group below is relative to this. -->
> <constructor-arg value="dc=entegrus,dc=net" />
> <property name="loginConfig" ref="ldapLoginConfig" />
> </bean>
>
> <bean id="ldapLoginConfig"
> class="org.springframework.security.kerberos.client.config.SunJaasKrb5LoginConfig">
> <!-- Name of the Kerberos service principal designated for the OpenNMS webapp -->
> <property name="servicePrincipal" value="HTTP/[email protected]" />
> <!-- Location of the Kerberos keytab file. Must be of the form file:/path/to/keytab -->
> <property name="keyTabLocation" value="file:/opt/opennms/etc/HTTP_opennms.mydomain.com.keytab" />
> <property name="debug" value="true" />
> <property name="isInitiator" value="true" />
> </bean>
>
> <bean id="kerberosLdapUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
> <!-- Search base for looking up users in the LDAP directory -->
> <constructor-arg index="0" value="cn=users,cn=accounts" />
> <!-- Search filter for user lookups -->
> <constructor-arg index="1" value="(uid={0})" />
> <constructor-arg index="2" ref="kerberosLdapContextSource" />
> <property name="searchSubtree" value="true" />
> </bean>
>
> <bean id="kerberosUserGroupLdapAuthoritiesPopulator" class="org.opennms.web.springframework.security.UserGroupLdapAuthoritiesPopulator">
> <constructor-arg ref="kerberosLdapContextSource" />
> <!-- Search base for looking up groups in the LDAP directory -->
> <constructor-arg value="cn=groups,cn=accounts" />
> <property name="searchSubtree" value="true" />
> <property name="convertToUpperCase" value="true" />
> <property name="groupRoleAttribute" value="cn" />
> <!-- Search filter for groups -->
> <property name="groupSearchFilter" value="member={0}" />
> <property name="groupToRoleMap">
> <map>
> <entry>
> <!-- Name of the LDAP group for normal (non-admin) OpenNMS users -->
> <key><value>opennms_users</value></key>
> <list>
> <value>ROLE_USER</value>
> <!-- <value>ROLE_DASHBOARD</value> -->
> </list>
> </entry>
> <entry>
> <!-- Name of the LDAP group for OpenNMS administrators -->
> <key><value>opennms_admins</value></key>
> <list>
> <value>ROLE_USER</value>
> <value>ROLE_ADMIN</value>
> </list>
> </entry>
> </map>
> </property>
> </bean>
>
> </beans>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Please read the OpenNMS Mailing List FAQ:
> http://www.opennms.org/index.php/Mailing_List_FAQ
>
> opennms-discuss mailing list
>
> To *unsubscribe* or change your subscription options, see the bottom of this page:
> https://lists.sourceforge.net/lists/listinfo/opennms-discuss
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ
opennms-discuss mailing list
To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss