Problems with LDAP Authentication
| Newsgroups | gmane.network.opennms.install |
|---|---|
| Message-ID | <ECA14488C4D91B439188E763DE5692980481C924@EX-DB1.heidelberg.bw-online.de> |
Hi everyone,
I just tried to enable LDAP Authentication using the provided tutorial. It seems I made a few mistakes...
Acutually I'm receving the following HTTP Error as I'm using the new "applicationContext-spring-security.xml" file:
HTTP Error: 503
Problem accessing /opennms/index.jsp. Reason:
Service_Unavailable
Powered by Jetty://
I have attached you the file "output_with_new_file.log". As you can see the Webserver isn't starting.
When I'm using the "old" applicationContext-spring-security.xml file the Webserver is starting as you can see in the attached file "output_without_new_file.log".
Therefore I guess my "applicationContext-spring-security.xml" file is a problem.
I attached you my "applicationContext-spring-security.xml" file (ldap.xml), maybe you could tell me if I have some errors in this file ?
Thanking you in anticipation
Alex
------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2dcopy1
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ
opennms-install mailing list
To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-install
output_without_new_file.log
(application/octet-stream, 5.4 KB)
------------------------------------------------------------------------------ Di 4. Okt 14:47:55 CEST 2011 begin ulimit settings: core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 32764 max locked memory (kbytes, -l) 32 max memory size (kbytes, -m) unlimited open files (-n) 10240 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 32764 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited end ulimit settings Executing command: /opt/opennms/bin/runjava -r -- -Djava.endorsed.dirs=/opt/opennms/lib/endorsed -Dopennms.home=/opt/opennms -Dcom.sun.management.jmxremote.port=18980 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false -Xmx256m -Djava.net.preferIPv4Stack=true -XX:MaxPermSize=128m -jar /opt/opennms/lib/opennms_bootstrap.jar start [DEBUG] System property 'opennms.library.jicmp' set to '/usr/lib/libjicmp.so. Attempting to load jicmp library from this location. [INFO] Successfully loaded jicmp library. [DEBUG] System property 'opennms.library.jicmp' set to '/usr/lib/libjicmp.so. Attempting to load jicmp library from this location. [INFO] Successfully loaded jicmp library. 04.10.2011 14:48:43 com.noelios.restlet.http.StreamClientHelper start INFO: Starting the HTTP client 04.10.2011 14:48:46 com.sun.jersey.api.core.PackagesResourceConfig init INFO: Scanning for root resource and provider classes in the packages: org.opennms.web.rest 04.10.2011 14:48:47 com.sun.jersey.api.core.PackagesResourceConfig init INFO: Root resource classes found: class org.opennms.web.rest.NodeRestService class org.opennms.web.rest.AlarmRestService class org.opennms.web.rest.AcknowledgmentRestService class org.opennms.web.rest.OnmsCategoryResource class org.opennms.web.rest.EventRestService class org.opennms.web.rest.OnmsMapRestService class org.opennms.web.rest.NotificationRestService class org.opennms.web.rest.ForeignSourceRestService class org.opennms.web.rest.AssetRecordResource class org.opennms.web.rest.OutageRestService class org.opennms.web.rest.RequisitionRestService class org.opennms.web.rest.SnmpConfigRestService 04.10.2011 14:48:47 com.sun.jersey.api.core.PackagesResourceConfig init INFO: Provider classes found: class org.opennms.web.rest.FormPropertiesReader 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, acknowledgmentRestService, of type org.opennms.web.rest.AcknowledgmentRestService as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, onmsCategoryResource, of type org.opennms.web.rest.OnmsCategoryResource as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, onmsMapRestService, of type org.opennms.web.rest.OnmsMapRestService as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, requisitionRestService, of type org.opennms.web.rest.RequisitionRestService as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, eventRestService, of type org.opennms.web.rest.EventRestService as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, assetRecordResource, of type org.opennms.web.rest.AssetRecordResource as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, snmpConfigRestService, of type org.opennms.web.rest.SnmpConfigRestService as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, notificationRestService, of type org.opennms.web.rest.NotificationRestService as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, foreignSourceRestService, of type org.opennms.web.rest.ForeignSourceRestService as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, nodeRestService, of type org.opennms.web.rest.NodeRestService as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, outageRestService, of type org.opennms.web.rest.OutageRestService as a root resource class 04.10.2011 14:48:47 com.sun.jersey.spi.spring.container.SpringComponentProviderFactory register INFO: Registering Spring bean, alarmRestService, of type org.opennms.web.rest.AlarmRestService as a root resource class 04.10.2011 14:48:49 de.novanic.eventservice.logger.DefaultServerLogger log INFO: Server: Configuration changed - EventServiceConfiguration (Default Configuration) Min.: 0ms; Max.: 20000ms; Timeout: 90000ms
output_with_new_file.log
(application/octet-stream, 1.5 KB)
------------------------------------------------------------------------------ Di 4. Okt 14:42:35 CEST 2011 begin ulimit settings: core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 32764 max locked memory (kbytes, -l) 32 max memory size (kbytes, -m) unlimited open files (-n) 10240 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 32764 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited end ulimit settings Executing command: /opt/opennms/bin/runjava -r -- -Djava.endorsed.dirs=/opt/opennms/lib/endorsed -Dopennms.home=/opt/opennms -Dcom.sun.management.jmxremote.port=18980 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false -Xmx256m -Djava.net.preferIPv4Stack=true -XX:MaxPermSize=128m -jar /opt/opennms/lib/opennms_bootstrap.jar start [DEBUG] System property 'opennms.library.jicmp' set to '/usr/lib/libjicmp.so. Attempting to load jicmp library from this location. [INFO] Successfully loaded jicmp library. [DEBUG] System property 'opennms.library.jicmp' set to '/usr/lib/libjicmp.so. Attempting to load jicmp library from this location. [INFO] Successfully loaded jicmp library.
ldap.xml
(text/xml, 10.4 KB)
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
<http access-denied-page="/accessDenied.jsp" realm="OpenNMS Realm" entry-point-ref="mappedEntryPoint">
<intercept-url pattern="/" access="ROLE_ANONYMOUS,ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/favicon.ice" access="ROLE_ANONYMOUS,ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/logoff.jsp" access="ROLE_ANONYMOUS,ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/login.jsp*" access="ROLE_ANONYMOUS,ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/accessDenied.jsp*" access="ROLE_ANONYMOUS,ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/css/*.css" access="ROLE_ANONYMOUS,ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/js/pngfix.js" access="ROLE_ANONYMOUS,ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/js/global.js" access="ROLE_ANONYMOUS,ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/images/**" access="ROLE_ANONYMOUS,ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/webstart/**" filters="none" />
<intercept-url pattern="/admin/node/add.htm" access="ROLE_PROVISION, ROLE_ADMIN" />
<intercept-url pattern="/admin/**" access="ROLE_ADMIN" />
<intercept-url pattern="/rtc/post/**" access="ROLE_RTC" />
<intercept-url pattern="/rest/**" method="DELETE" access="ROLE_ADMIN"/>
<intercept-url pattern="/rest/**" method="POST" access="ROLE_ADMIN"/>
<intercept-url pattern="/rest/**" method="PUT" access="ROLE_ADMIN"/>
<intercept-url pattern="/rest/**" method="GET" access="ROLE_USER"/>
<intercept-url pattern="/rest/**" method="HEAD" access="ROLE_USER"/>
<intercept-url pattern="/rest/**" method="OPTIONS" access="ROLE_USER"/>
<intercept-url pattern="/frontpage.htm" access="ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/dashboard.jsp" access="ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/gwt.js" access="ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/surveillanceservice.gwt" access="ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/graph/graph.png" access="ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/dashboard/**" access="ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/coreweb/**" access="ROLE_USER,ROLE_DASHBOARD" />
<intercept-url pattern="/**" access="ROLE_USER" />
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=1" />
<anonymous />
<http-basic />
<logout logout-success-url="/logoff.jsp" />
<!--
I have not used auto-config because I am not certain that the remember me service will work with LDAP
If you can get remember-me to work with LDAP then it may be an interesting service to use
Since I'm relying on others help with LDAP I didn't want to have anything here to make it harder for them :-)
<remember-me />
-->
</http>
<authentication-provider user-service-ref="openNMSUserDetailsService">
<password-encoder ref="upperCaseMd5PasswordEncoder" />
</authentication-provider>
<beans:bean id="mappedEntryPoint" class="org.opennms.web.springframework.security.AntPatternBasedAuthenticationEntryPointChain">
<beans:property name="patterns">
<beans:list>
<beans:value>/rss.jsp*</beans:value>
<beans:value>/rest/**</beans:value>
</beans:list>
</beans:property>
<!-- This bean is the entry point defined by the <http-basic> element above -->
<beans:property name="matchingEntryPoint" ref="_basicAuthenticationEntryPoint" />
<!-- This bean is the entry point defined by the <form-login> element above -->
<beans:property name="nonMatchingEntryPoint" ref="_formLoginEntryPoint" />
</beans:bean>
<!-- This filter is used to setup the Hibernate query filtering to authorized nodes only -->
<beans:bean id="authFilterEnabler" class="org.opennms.web.springframework.security.AuthFilterEnabler">
<custom-filter position="LAST"/>
<beans:property name="filterManager" ref="filterManager" />
<beans:property name="groupDao" ref="groupDao" />
</beans:bean>
<!-- We need a mechanism to return the correct entryPoint for rss and restful api's -->
<!-- ===================== USER DAO AUTHENTICATION ==================== -->
<beans:bean id="userDao" class="org.opennms.web.springframework.security.UserDaoImpl">
<beans:property name="magicUsersConfigurationFile" value="${opennms.home}/etc/magic-users.properties" />
<beans:property name="usersConfigurationFile" value="${opennms.home}/etc/users.xml" />
<beans:property name="groupsConfigurationFile" value="${opennms.home}/etc/groups.xml" />
<beans:property name="useGroups" value="false" />
</beans:bean>
<beans:bean id="openNMSUserDetailsService" class="org.opennms.web.springframework.security.OpenNMSUserDetailsService">
<beans:property name="userDao" ref="userDao" />
</beans:bean>
<beans:bean id="upperCaseMd5PasswordEncoder" class="org.opennms.web.springframework.security.UpperCaseMd5PasswordEncoder"/>
<!-- ====================== RADIUS AUTHENTICATION ===================== -->
<!--
To use Radius Authentication, uncomment the following section to enable
the radiusAuthenticationProvider
The first constructor argument to radiusAuthenticationProvider is the
Radius Server to authenticate against, the second constructor argument
is the Shared Secret to use during authentication. The port, timeout,
retries, authTypeClass, and defaultRoles properties are optional and
default to the values shown.
If you would like to use a Radius Attribute to assign roles to users,
set the rolesAttribute property to the name of the attribute. Your
Radius server should be configured to return a comma-separated string of
roles (such as "ROLE_USER, ROLE_ADMIN") in this attribute in the
authentication reply. To specify a locally-defined vendor-specific Radius
Attribute, use "Unknown-VSAttribute(<Vendor ID>:<Attribute Number>)".
If the reply from the radius server does not actually contain the
specified attribute, the user will be assigned the roles specified by
the defaultRoles property.
-->
<!--
<beans:bean id="radiusAuthenticationProvider" class="org.opennms.web.springframework.security.RadiusAuthenticationProvider">
<custom-authentication-provider />
<beans:constructor-arg value="%%% Radius Server %%%"/>
<beans:constructor-arg value="%%% Shared Secret %%%"/>
-->
<!--<beans:property name="port" value="1812"/>-->
<!--<beans:property name="timeout" value="5"/>-->
<!--<beans:property name="retries" value="3"/>-->
<!--<beans:property name="authTypeClass"><beans:bean class="net.jradius.client.auth.PAPAuthenticator"/></beans:property>-->
<!--<beans:property name="defaultRoles" value="ROLE_USER"/>-->
<!--<beans:property name="rolesAttribute" value="Unknown-VSAttribute(%%% Vendor ID %%%:%%% Attribute Number %%%)"/>-->
<!--
</beans:bean>
--><!--> ======================= LDAP AUTHENTICATION
====================== -->
<!-- this defines your ldap server address, userid, password etc. -->
<beans:bean id="contextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
<beans:constructor-arg value="ldap://IP:389/dc=company,dc=orgunit,dc=land" />
<beans:property base="dc=company,dc=bw=orgunit,dc=land" />
<beans:property name="userDn" value="user"/>
<beans:property name="password" value="userpassword"/>
</beans:bean>
<!-- this defines LDAP as an authentication provider -->
<beans:bean id="ldapAuthProvider" class="org.springframework.security.providers.ldap.LdapAuthenticationProvider">
<custom-authentication-provider /> <!-- this adds the ldap authentication method to the ProviderManager -->
<beans:constructor-arg ref="ldapAuthenticator"/>
<beans:constructor-arg ref="UserGroupLdapAuthoritiesPopulator"/>
</beans:bean>
<!-- authenticate the user with ldapAuthenticator using userSearch -->
<beans:bean id="ldapAuthenticator" class="org.springframework.security.providers.ldap.authenticator.BindAuthenticator">
<beans:constructor-arg ref="contextSource"/>
<beans:property name="userSearch" ref="userSearch">
</beans:property>
</beans:bean>
<beans:bean id="userSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
<beans:constructor-arg index="0" value="CN=Users" />
<!-- allow only users belonging to specific groups to get authenticated -->
<beans:constructor-arg index="1" value="value="(sAMAccountName={0})" />
<beans:constructor-arg index="2" ref="contextSource" />
<beans:property name="searchSubtree" value="true" />
</beans:bean>
<beans:bean id="UserGroupLdapAuthoritiesPopulator" class="org.opennms.web.springframework.security.UserGroupLdapAuthoritiesPopulator">
<beans:constructor-arg ref="contextSource"/>
<beans:constructor-arg value="cn=Users"/>
<beans:property name="searchSubtree" value="true" />
<beans:property name="groupRoleAttribute" value="cn" />
<beans:property name="groupSearchFilter" value="member={0}" />
<beans:property name="groupToRoleMap">
<beans:map>
<beans:entry>
<beans:key>
<beans:value>Admin</beans:value>
</beans:key>
<beans:list>
<beans:value>ROLE_USER</beans:value>
<beans:value>opennms_admin</beans:value>
</beans:list>
</beans:entry>
</beans:map>
</beans:property>
</beans:bean>
<!-- this is used to send events on login success and failure -->
<beans:bean class="org.opennms.web.springframework.security.SecurityAuthenticationEventOnmsEventBuilder">
<beans:property name="eventProxy" ref="eventProxy"/>
</beans:bean>
</beans:beans>