Re: Kerberos Authentication to FreeIPA - web application error

Hi Jonathan.

Thanks for the suggestions.  We've been working with test accounts, both in the opennms_admins and opennms_users groups.  We've also tried LDAP & LDAPS.  We get the same result every time.  We just tested using the ipausers group, and the results are the same as earlier.

I think the authentication itself is working, as when we use an incorrect password, we just get access denied.  The web app error only appears if we use a valid user.

Shawn

From: Jonathan Heard <[email protected]> 
Sent: June 29, 2018 12:05 PM
To: [email protected]
Subject: Re: [opennms-discuss] Kerberos Authentication to FreeIPA - web application error

Hi Shawn,
 I use just plain LDAP to authenticate against FreeIPA - I'm wondering if the LDAP part of your config might need customising.. I don't think we've customised our schema and you'll note that the users filter is different from the default. You also need to make sure that the user exist in the relevant groups - we allow all 'ipausers' to log in as below.

I hope this is helpful.

Cheers
Jonathan

  <beans:bean id="userSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
    <beans:constructor-arg index="0" value="ou=users" />

    <!-- More complex filters are possible depending on the layout of your directory -->
    <beans:constructor-arg index="1" value="(uid={0})" />
    <beans:constructor-arg index="2" ref="contextSource" />
    <beans:property name="searchSubtree" value="true" />
  </beans:bean>

  <beans:bean id="userGroupLdapAuthoritiesPopulator" class="org.opennms.web.springframework.security.UserGroupLdapAuthoritiesPopulator">
    <beans:constructor-arg ref="contextSource"/>
    <!-- Common LDAP container for the user and admin groups listed below -->
    <beans:constructor-arg value="cn=groups,cn=accounts" />
    <beans:property name="searchSubtree" value="true" />
    <beans:property name="convertToUpperCase" value="true" />
    <beans:property name="groupRoleAttribute" value="cn" />
    <beans:property name="groupSearchFilter" value="member={0}" />
    <beans:property name="groupToRoleMap">
      <beans:map>
        <beans:entry>
          <!-- Name of the LDAP group for normal (non-admin) OpenNMS users -->
          <beans:key><beans:value>ipausers</beans:value></beans:key>
          <beans:list>
            <beans:value>ROLE_USER</beans:value>
            <beans:value>ROLE_DASHBOARD</beans:value>
          </beans:list>
        </beans:entry>
        <beans:entry>
          <!-- Name of the LDAP group for OpenNMS administrators -->
          <beans:key><beans:value>monitoring_admins</beans:value></beans:key>
          <beans:list>
            <beans:value>ROLE_USER</beans:value>
            <beans:value>ROLE_ADMIN</beans:value>
          </beans:list>
        </beans:entry>
      </beans:map>
    </beans:property>
  </beans:bean>

On 29/06/18 14:44, Shawn Southern wrote:
We're using the sample FreeIPA XML Spring Security file that is included with OpenNMS Horizon.  The changes to applicationContext-spring-security.xml have been made exactly as directed in the sso_freeIPA_kerb_ldap.xml file.

We've added the SPN mailto:HTTP/[email protected] to the OpenNMS host in FreeIPA, and used ipa-getkeytab to retrieve the keytab.

Authentication appears to work, as we get an error (Your log-in attempt failed, please try again.  Reason: Kerberos authentication failed) when we use an incorrect user/password.  When we use a correct username/password combination, with a user that is in the opennms_admins or opennms_users groups, the OpenNMS Web User Interface encounters an error.  I've posted a screenshot on imgur: https://imgur.com/a/x7DqdNY.  We can log in with any native OpenNMS accounts without issue; only FreeIPA accounts encounter this issue.

The web interface error:

The OpenNMS Web User Interface Has Experienced an Error
The OpenNMS web UI has encountered an error that it does not know how to handle.
Possible causes could be that the database is not responding, the OpenNMS application has stopped or is not running, or there is an issue with the servlet container.
Please bring this message to the attention of the person responsible for maintaining OpenNMS for your organization, and have him or her check that OpenNMS, the external servlet container (if applicable), and the database are all running without errors.
To reveal details of the error encountered and instructions for reporting it, click here.

Error Details
Please include the information below when reporting problems.

javax.naming.AuthenticationException
	at org.springframework.security.kerberos.client.ldap.KerberosLdapContextSource.login(KerberosLdapContextSource.java:151)
	at org.springframework.security.kerberos.client.ldap.KerberosLdapContextSource.getDirContextInstance(KerberosLdapContextSource.java:110)
	at org.springframework.ldap.core.support.AbstractContextSource.createContext(AbstractContextSource.java:273)
	at org.springframework.ldap.core.support.AbstractContextSource.doGetContext(AbstractContextSource.java:119)
	at org.springframework.ldap.core.support.AbstractContextSource.getReadOnlyContext(AbstractContextSource.java:138)
	at org.springframework.ldap.core.LdapTemplate.executeReadOnly(LdapTemplate.java:791)
	at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleEntry(SpringSecurityLdapTemplate.java:194)
	at org.springframework.security.ldap.search.FilterBasedLdapUserSearch.searchForUser(FilterBasedLdapUserSearch.java:116)
	at org.opennms.web.springframework.security.KerberosLdapAuthenticationProvider.authenticate(KerberosLdapAuthenticationProvider.java:75)
	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)
	at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:92)
	at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:211)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1621)
	at org.springframework.orm.hibernate3.support.OpenSessionInViewFilter.doFilterInternal(OpenSessionInViewFilter.java:231)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1621)
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1613)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:541)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:190)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1592)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1239)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:481)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1561)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1141)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
	at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:213)
	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:118)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.opennms.netmgt.jetty.MDCHandler.handle(MDCHandler.java:46)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.Server.handle(Server.java:564)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:320)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:110)
	at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:258)
	at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:147)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:110)
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:672)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:590)
	at java.lang.Thread.run(Thread.java:748)

Request Details
Locale 	en_US
Method 	POST
Path Info 	null
Path Info (translated) 	null
Protocol 	HTTP/1.1
URI 	/opennms/errors/unknownexception.jsp
URL 	https://opennms.mydomain.com/opennms/errors/unknownexception.jsp
Scheme 	https
Server Name 	opennms.mydomain.com
Server Port 	443

System Details
OpenNMS Version: 	22.0.0
Java Version: 	1.8.0_144 Oracle Corporation
Java Virtual Machine: 	25.144-b01 Oracle Corporation
Operating System: 	Linux 3.10.0-862.3.3.el7.x86_64 (amd64)
Servlet Container: 	jetty/9.4.2.v20170220 (Servlet Spec 3.1)
User Agent: 	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0

------------------------------------------

sso_freeIPA_kerb_ldap.xml:
<beans xmlns=http://www.springframework.org/schema/beans
  xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance
  xmlns:sec=http://www.springframework.org/schema/security
  xmlns:context=http://www.springframework.org/schema/context
  xsi:schemaLocation=http://www.springframework.org/schema/securityhttp://www.springframework.org/schema/security/spring-security.xsdhttp://www.springframework.org/schema/beanshttp://www.springframework.org/schema/beans/spring-beans-4.2.xsdhttp://www.springframework.org/schema/contexthttp://www.springframework.org/schema/context/spring-context-4.2.xsd>

  <bean id="kerberosAuthenticationProvider"
    class="org.opennms.web.springframework.security.KerberosLdapAuthenticationProvider">
    <property name="kerberosClient">
      <bean class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient">
        <property name="debug" value="true"/>
      </bean>
    </property>
    <property name="ldapUserSearch" ref="kerberosLdapUserSearch"/>
    <property name="ldapAuthoritiesPopulator" ref="kerberosUserGroupLdapAuthoritiesPopulator"/>
  </bean>

  <bean id="kerberosServiceAuthenticationProvider"
    class="org.opennms.web.springframework.security.KerberosServiceLdapAuthenticationProvider">
    <property name="ticketValidator">
      <bean
        class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator">
        <!-- Name of the Kerberos service principal designated for the OpenNMS webapp -->
        <property name="servicePrincipal" value=mailto:HTTP/[email protected] />
        <!-- Location of the Kerberos keytab file. Must be of the form file:/path/to/keytab -->
        <property name="keyTabLocation" value=file:/opt/opennms/etc/HTTP_opennms.mydomain.com.keytab />
        <property name="debug" value="true" />
      </bean>
    </property>
    <property name="ldapUserSearch" ref="kerberosLdapUserSearch"/>
    <property name="ldapAuthoritiesPopulator" ref="kerberosUserGroupLdapAuthoritiesPopulator"/>
  </bean>

  <bean id="spnegoEntryPoint"
    class="org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint" >
    <constructor-arg value="/login.jsp" />
  </bean>

  <bean id="spnegoAuthenticationProcessingFilter"
    class="org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter">
    <property name="authenticationManager" ref="authenticationManager" />
  </bean>

  <bean id="kerberosLdapContextSource"
    class="org.springframework.security.kerberos.client.ldap.KerberosLdapContextSource">
    <constructor-arg>
      <list>
        <!-- List one or more of your LDAP servers here -->
        <!-- <value>ldaps://mydomain.com:636/</value> -->
        <value>ldaps://freeipaserver1.mydomain.com:636/</value>
        <value>ldaps://freeipaserver2.mydomain.com:636/</value>
      </list>
    </constructor-arg>
    <!-- Base DN for LDAP searches. Every group below is relative to this. -->
    <constructor-arg value="dc=entegrus,dc=net" />
    <property name="loginConfig" ref="ldapLoginConfig" />
  </bean>

  <bean id="ldapLoginConfig"
    class="org.springframework.security.kerberos.client.config.SunJaasKrb5LoginConfig">
    <!-- Name of the Kerberos service principal designated for the OpenNMS webapp -->
    <property name="servicePrincipal" value=mailto:HTTP/[email protected] />
    <!-- Location of the Kerberos keytab file. Must be of the form file:/path/to/keytab -->
    <property name="keyTabLocation" value=file:/opt/opennms/etc/HTTP_opennms.mydomain.com.keytab />
    <property name="debug" value="true" />
    <property name="isInitiator" value="true" />
  </bean>

  <bean id="kerberosLdapUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
    <!-- Search base for looking up users in the LDAP directory -->
    <constructor-arg index="0" value="cn=users,cn=accounts" />
    <!-- Search filter for user lookups -->
    <constructor-arg index="1" value="(uid={0})" />
    <constructor-arg index="2" ref="kerberosLdapContextSource" />
    <property name="searchSubtree" value="true" />
  </bean>

  <bean id="kerberosUserGroupLdapAuthoritiesPopulator" class="org.opennms.web.springframework.security.UserGroupLdapAuthoritiesPopulator">
    <constructor-arg ref="kerberosLdapContextSource" />
    <!-- Search base for looking up groups in the LDAP directory -->
    <constructor-arg value="cn=groups,cn=accounts" />
    <property name="searchSubtree" value="true" />
    <property name="convertToUpperCase" value="true" />
    <property name="groupRoleAttribute" value="cn" />
    <!-- Search filter for groups -->
    <property name="groupSearchFilter" value="member={0}" />
    <property name="groupToRoleMap">
      <map>
        <entry>
          <!-- Name of the LDAP group for normal (non-admin) OpenNMS users -->
          <key><value>opennms_users</value></key>
          <list>
            <value>ROLE_USER</value>
            <!-- <value>ROLE_DASHBOARD</value> -->
          </list>
        </entry>
        <entry>
          <!-- Name of the LDAP group for OpenNMS administrators -->
          <key><value>opennms_admins</value></key>
          <list>
            <value>ROLE_USER</value>
            <value>ROLE_ADMIN</value>
          </list>
        </entry>
      </map>
    </property>
  </bean>

</beans>

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss