opennms LDAP configuration

Hi,

i am new to the opennms / spring / ldap configuration, but i think my
config should work. If somebody could look over my configuration and tell
me if i am wrong.



*system: Debian 7opennms version: 15.0.1-1*
Here is my ldap entry:

# klecnik, People, DOMAIN.lan
dn: uid=klecnik,ou=People,dc=DOMAIN,dc=lan
mail: MAIL
uid: klecnik
givenName: Kristijan
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
sn:: TGXEjW5paw==
cn:: S3Jpc3RpamFuIExlxI1uaWs=
userPassword::

# Sysadmins, Groups, DOMAIN.lan
dn: cn=Sysadmins,ou=Groups,dc=DOMAIN,dc=lan
description: System administrators
objectClass: top
objectClass: groupofuniquenames
objectClass: groupofurls
uniqueMember: uid=klecnik,ou=People,dc=DOMAIN,dc=lan
cn: Sysadmins
memberURL:
ldap:///dc%3dDOMAIN,dc%3dlan??sub?(%26(objectclass%3dperson)(cn%3d*
 ))

my configuration:

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"

  xmlns:beans="http://www.springframework.org/schema/beans"

  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

  xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

              http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">


  <beans:bean id="ldapTemplate"
class="org.springframework.ldap.core.LdapTemplate">

    <beans:constructor-arg ref="contextSource"/>

    <beans:property name="ignorePartialResultException" value="true"/>

  </beans:bean>

  <beans:bean id="contextSource"
class="org.springframework.ldap.core.support.LdapContextSource">

    <beans:property name="urls">

      <beans:list>

        <!-- List one or more of your enterprise's LDAP servers here -->

        <beans:value>ldap://IP_ADDRESS:389/</beans:value>

      </beans:list>

    </beans:property>

    <!-- An optional base DN. Every user and group below is relative to
this. -->

    <beans:property name="base" value="dc=DOMAIN,dc=lan" />

    <beans:property name="authenticationSource" ref="authenticationSource"
/>

  </beans:bean>

  <beans:bean id="authenticationSource"
class="org.springframework.ldap.authentication.DefaultValuesAuthenticationSourceDecorator">

    <beans:property name="target" ref="springSecurityAuthenticationSource"/>

    <!-- Specify the DN of an unprivileged user for initial binding to the
directory -->

    <beans:property name="defaultUser" value="cn=Directory Manager"/>

    <!-- Specify the unprivileged bind user's password here -->

    <beans:property name="defaultPassword" value=“PASSWORD”/>

  </beans:bean>


  <beans:bean id="springSecurityAuthenticationSource"
class="org.springframework.security.ldap.authentication.SpringSecurityAuthenticationSource">

  </beans:bean>


  <beans:bean id="externalAuthenticationProvider"
class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">

    <beans:constructor-arg ref="ldapAuthenticator"/>

    <beans:constructor-arg ref="userGroupLdapAuthoritiesPopulator"/>

  </beans:bean>


  <beans:bean id="ldapAuthenticator"
class="org.springframework.security.ldap.authentication.BindAuthenticator">

    <beans:constructor-arg ref="contextSource"/>

    <beans:property name="userSearch" ref="userSearch"></beans:property>

  </beans:bean>

  <!-- userSearch (alt.: userDnPatterns) -->


  <beans:bean id="userSearch"
class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">

    <beans:constructor-arg index="0" value="ou=People" />


    <!-- More complex filters are possible depending on the layout of your
directory -->

    <beans:constructor-arg index="1" value="(uid={0})" />

    <beans:constructor-arg index="2" ref="contextSource" />

    <beans:property name="searchSubtree" value="true" />

  </beans:bean>


  <beans:bean id="userGroupLdapAuthoritiesPopulator"
class="org.opennms.web.springframework.security.UserGroupLdapAuthoritiesPopulator">

    <beans:constructor-arg ref="contextSource"/>

    <!-- Common LDAP container for the user and admin groups listed below
-->

    <beans:constructor-arg value="ou=People" />

    <beans:property name="searchSubtree" value="true" />

    <beans:property name="convertToUpperCase" value="true" />

    <beans:property name="groupRoleAttribute" value="cn" />

    <beans:property name="groupSearchFilter" value="member={0}" />

    <beans:property name="groupToRoleMap">

      <beans:map>

        <beans:entry>

          <!-- Name of the LDAP group for normal (non-admin) OpenNMS users
-->

          <beans:key><beans:value>users</beans:value></beans:key>

          <beans:list>

            <beans:value>ROLE_USER</beans:value>

            <!-- <beans:value>ROLE_DASHBOARD</beans:value> -->

          </beans:list>

        </beans:entry>

        <beans:entry>

          <!-- Name of the LDAP group for OpenNMS administrators -->

          <beans:key><beans:value>Sysadmins</beans:value></beans:key>

          <beans:list>

            <beans:value>ROLE_USER</beans:value>

            <beans:value>ROLE_ADMIN</beans:value>

          </beans:list>

        </beans:entry>

      </beans:map>

    </beans:property>

  </beans:bean>


</beans:beans>

i can login with my user, but i get:


*Access deniedYou do not have permission to access this page.*

web.log:
*2015-04-07 21:41:18,020 WARN  [qtp953704807-536 -
/opennms/j_spring_security_check]
o.s.s.l.a.SpringSecurityAuthenticationSource: No Authentication object set
in SecurityContext - returning empty String as Principal*
*2015-04-07 21:41:18,020 WARN  [qtp953704807-536 -
/opennms/j_spring_security_check]
o.s.s.l.a.SpringSecurityAuthenticationSource: No Authentication object set
in SecurityContext - returning empty String as Principal*
*2015-04-07 21:41:18,092 INFO  [qtp953704807-536 -
/opennms/j_spring_security_check] o.s.l.c.LdapTemplate: The returnObjFlag
of supplied SearchControls is not set but a ContextMapper is used - setting
flag to true*
*2015-04-07 21:41:18,095 WARN  [qtp953704807-536 -
/opennms/j_spring_security_check]
o.s.s.l.a.SpringSecurityAuthenticationSource: No Authentication object set
in SecurityContext - returning empty String as Principal*
*2015-04-07 21:41:18,095 WARN  [qtp953704807-536 -
/opennms/j_spring_security_check]
o.s.s.l.a.SpringSecurityAuthenticationSource: No Authentication object set
in SecurityContext - returning empty String as Principal*
*2015-04-07 21:41:18,099 INFO  [qtp953704807-536 -
/opennms/j_spring_security_check] o.s.l.c.LdapTemplate: The returnObjFlag
of supplied SearchControls is not set but a ContextMapper is used - setting
flag to true*
*2015-04-07 21:41:18,099 WARN  [qtp953704807-536 -
/opennms/j_spring_security_check]
o.s.s.l.a.SpringSecurityAuthenticationSource: No Authentication object set
in SecurityContext - returning empty String as Principal*
*2015-04-07 21:41:18,099 WARN  [qtp953704807-536 -
/opennms/j_spring_security_check]
o.s.s.l.a.SpringSecurityAuthenticationSource: No Authentication object set
in SecurityContext - returning empty String as Principal*

Best Regards
Kristijan Lecnik

------------------------------------------------------------------------------
BPM Camp - Free Virtual Workshop May 6th at 10am PDT/1PM EDT
Develop your own process in accordance with the BPMN 2 standard
Learn Process modeling best practices with Bonita BPM through live exercises
http://www.bonitasoft.com/be-part-of-it/events/bpm-camp-virtual- event?utm_
source=Sourceforge_BPM_Camp_5_6_15&utm_medium=email&utm_campaign=VA_SF

_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-install mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-install