LDAP problem

bwienhoven

I've tried to install the LDAP functionality.
but I won't get it to work.
I'm able to Discover Attributes from my Active Directory but when I run a simple query to show me all users in the OU it won't result any data.
The log file shows the following wbout the query:

INFO   | jvm 1    | 2009/09/23 08:31:56 | Got XML request <root><query_layout_action query_name='LDAP_Customer' > 
INFO   | jvm 1    | 2009/09/23 08:31:56 | </query_layout_action> 
INFO   | jvm 1    | 2009/09/23 08:31:56 | </root>
INFO   | jvm 1    | 2009/09/23 08:31:56 | WebServlet URL got request with params:
INFO   | jvm 1    | 2009/09/23 08:31:56 | Exception thrown com.bas.connectionserver.server.d Internal error. No Such Object
INFO   | jvm 1    | 2009/09/23 08:31:56 | com.bas.connectionserver.server.d: Internal error. No Such Object
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at com.bas.connectionserver.server.ConnectionFactory.sendMessage(Unknown Source)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at com.bas.webapp.common.WebAppUtils.sendMessageToExecutionEngine(Unknown Source)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at com.bas.webapp.thin.a.c.h.a(Unknown Source)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at com.bas.webapp.thin.a.c.h.a(Unknown Source)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at com.bas.webapp.thin.a.c.h.a(Unknown Source)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at com.bas.webapp.thin.a.b.a(Unknown Source)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at com.bas.webapp.thin.a.b.a(Unknown Source)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at com.bas.webapp.thin.servlets.WebInterfaceURLServlet.doPost(Unknown Source)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:710)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:269)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188-)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:174)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108-)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:174)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:874)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528-)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:689)
INFO   | jvm 1    | 2009/09/23 08:31:56 | 	at java.lang.Thread.run(Unknown Source)
INFO   | jvm 1    | 2009/09/23 08:31:56 | Web server returned error: Internal error. No Such Object

Could it be that TomCat is not yet configured for LDAP?
if so, where or how should I configure TomCat for LDAP?
The user Guide does not return any help on this.

Thanks in advance,
Bas

aware_support

Tomcat is definitely configured for LDAP. When defining an LDAP object it is important to provide correct distinguished names for the object itself AS WELL as specify the DN of the parent node. Have you done this? If not, please provide the DN of the parent node and try again.

bwienhoven

I've given the dn name but it tells me it's an invalid syntax.
the syntax used is:

dc=company,dc=local

The log tells me the following:

INFO   | jvm 1    | 2009/09/28 08:25:59 | Got XML request <root><query_layout_action query_name='Show_TestResults' > 
INFO   | jvm 1    | 2009/09/28 08:25:59 | </query_layout_action> 
INFO   | jvm 1    | 2009/09/28 08:25:59 | </root>
INFO   | jvm 1    | 2009/09/28 08:25:59 | WebServlet URL got request with params:
INFO   | jvm 1    | 2009/09/28 08:25:59 | Exception thrown com.bas.connectionserver.server.d Internal error. Invalid DN Syntax
INFO   | jvm 1    | 2009/09/28 08:25:59 | com.bas.connectionserver.server.d: Internal error. Invalid DN Syntax
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at com.bas.connectionserver.server.ConnectionFactory.sendMessage(Unknown Source)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at com.bas.webapp.common.WebAppUtils.sendMessageToExecutionEngine(Unknown Source)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at com.bas.webapp.thin.a.c.h.a(Unknown Source)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at com.bas.webapp.thin.a.c.h.a(Unknown Source)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at com.bas.webapp.thin.a.c.h.a(Unknown Source)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at com.bas.webapp.thin.a.b.a(Unknown Source)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at com.bas.webapp.thin.a.b.a(Unknown Source)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at com.bas.webapp.thin.servlets.WebInterfaceURLServlet.doPost(Unknown Source)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:710)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:269)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188-)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:174)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108-)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:174)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:874)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528-)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:689)
INFO   | jvm 1    | 2009/09/28 08:25:59 | 	at java.lang.Thread.run(Thread.java:619)
INFO   | jvm 1    | 2009/09/28 08:25:59 | Web server returned error: Internal error. Invalid DN Syntax

hope this information can help finding a solution

I've made a dump of AD and it showed me the dn tyntax ad used.
I couldn't find it on google so the question is now: what is a valid DN syntax?

Greetings

bwienhoven

I'd thought I'd provide the input screen for LDAP 😛

thanx

aware_support

Are you sure dc=company, dc=local is correct? "dc" is repeated twice? Can you check this DN in some other tool that can list your LDAP entries to verify that this is a correct value?

bwienhoven

you were right, my bet.

although I found the correct syntax was simply: ou=users

now the log only returns an oprations error.
so it still doesn't work.

any help on this one.... :oops:

INFO   | jvm 1    | 2009/09/28 10:22:57 | Got XML request <root><query_layout_action query_name='Show_TestResults' > 
INFO   | jvm 1    | 2009/09/28 10:22:57 | </query_layout_action> 
INFO   | jvm 1    | 2009/09/28 10:22:57 | </root>
INFO   | jvm 1    | 2009/09/28 10:22:57 | WebServlet URL got request with params:
INFO   | jvm 1    | 2009/09/28 10:22:57 | Exception thrown com.bas.connectionserver.server.d Internal error. Operations Error
INFO   | jvm 1    | 2009/09/28 10:22:57 | com.bas.connectionserver.server.d: Internal error. Operations Error
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at com.bas.connectionserver.server.ConnectionFactory.sendMessage(Unknown Source)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at com.bas.webapp.common.WebAppUtils.sendMessageToExecutionEngine(Unknown Source)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at com.bas.webapp.thin.a.c.h.a(Unknown Source)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at com.bas.webapp.thin.a.c.h.a(Unknown Source)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at com.bas.webapp.thin.a.c.h.a(Unknown Source)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at com.bas.webapp.thin.a.b.a(Unknown Source)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at com.bas.webapp.thin.a.b.a(Unknown Source)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at com.bas.webapp.thin.servlets.WebInterfaceURLServlet.doPost(Unknown Source)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:710)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:269)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188-)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:174)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108-)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:174)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:874)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528-)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:689)
INFO   | jvm 1    | 2009/09/28 10:22:57 | 	at java.lang.Thread.run(Thread.java:619)
INFO   | jvm 1    | 2009/09/28 10:22:57 | Web server returned error: Internal error. Operations Error

thanks again

aware_support

What's in the output of the Aware IM server and Log Viewer?

bwienhoven

That do you mean?
The code above is from the log file.
the output from the awareIM server is nothing.
it's no returning any values.

bwienhoven

sorry, hadn't noticed there was an AwareIM wrapper log too.

this is the output from the AwareIM server

INFO   | jvm 1    | 2009/09/28 14:22:48 | LDAPPersister:  executeQuery called for homeDrive,directReports,manager,legacyExchangeDN,userPrincipalName,userParameters,msExchPoliciesIncluded,msExchMailboxGuid,logonCount,textEncodedORAddress,securecomputingCom2000-SafeWord-UserID,sAMAccountName,description,primaryGroupID,fen-UM-AllowChargecodeOverride,objectCategory,distinguishedName,fen-UM-AllowedToSendSms,mailNickname,sn,countryCode,objectClass,showInAddressBook,instanceType,pwdLastSet,accountExpires,codePage,cn,telephoneNumber,company,lastLogon,homeMTA,objectGUID,mobile,profilePath,msExchUserAccountControl,department,fen-UM-AllowedToSendSmsInt,lockoutTime,lastLogonTimestamp,givenName,fen-UM-Fileformat,sAMAccountType,memberOf,title,whenChanged,publicDelegates,name,logonHours,proxyAddresses,fen-UM-AllowCoversheetOverride,pager,mail,uSNChanged,ipPhone,whenCreated,objectSid,fen-UM-AllowedToSendFax,badPasswordTime,userAccountControl,msExchHomeServerName,fen-UM-AllowedToSendFaxInt,uSNCreated,fen-UM-Coversheet,homeDirectory,homeMDB,msExchALObjectVersion,badPwdCount,lastLogoff,fen-UM-AllowedToSendTlx,mDBUseDefaults,msExchMailboxSecurityDescriptor,displayName#
INFO   | jvm 1    | 2009/09/28 14:22:48 | LDAPPersister:  base is OU=Users
INFO   | jvm 1    | 2009/09/28 14:22:48 | fillUpRange called true 1 20
INFO   | jvm 1    | 2009/09/28 14:22:48 | fillUpRange: Getting entry 1

aware_support

This is the error returned by LDAP. Please Google for "Operations error LDAP"

bwienhoven

nice support......

RocketRod

Did you manage to get this to work? Have tried everthing I can think of in setting up LDAP authentication to AD but although I can discover attributes I keep having no success. Has anyone set this up successfully? If so maybe they can share what the trick is.

Cheers Rod

tford

Rod,

I have not used LDAP, but the users have to be on the same server that AwareIM is running on.

RocketRod

Mmm. So as my domain controller (Active Directory) is on a different server to the one that AwareIM is installed on it wont work? My DB can be on another server so I had hoped that my AD would be too. Oh well. If anyone has any experience with this would love to hear any success stories and how they got it to work.

Cheers Rod

aware_support

So what is the error you are getting? What is the output of the Aware IM server?

RocketRod

Thanks support. If I leave parent node blank I get this:

Performing LDAP login...

Trying to login through object or group LDAPUser

Trying to login through object LDAPUser

Getting connection to connect to LDAP with operator password LDAPServer 389

Running query to find LDAP object LDAPUser and user name operator

LDAPPersister: executeQuery called for (sAMAccountName=operator)

LDAPPersister: base is

fillUpRange called true 1 1000

fillUpRange: Getting entry 1

LDAP Exception thrown No Such Object 0000208D: NameErr: DSID-03100198, problem 2001 (NO_OBJECT), data 0, best match of:
LDAPException: No Such Object (32) No Such Object
LDAPException: Server Message: 0000208D: NameErr: DSID-03100198, problem 2001 (NO_OBJECT), data 0, best match of:
''
LDAPException: Matched DN:

at com.novell.ldap.LDAPResponse.getResultException(Unknown Source)

at com.novell.ldap.LDAPResponse.chkResultCode(Unknown Source)

at com.novell.ldap.LDAPSearchResults.next(Unknown Source)

at com.bas.basserver.persistence.LDAPPersister$a.if(Unknown Source)

at com.bas.basserver.persistence.LDAPPersister$a.<init>(Unknown Source)

at com.bas.basserver.persistence.LDAPPersister.a(Unknown Source)

at com.bas.basserver.persistence.LDAPPersister.executeQuery(Unknown Source)

at com.bas.basserver.persistence.PersistenceManager.executeQuery(Unknown Source)

at com.bas.basserver.executionengine.s.a(Unknown Source)

at com.bas.basserver.executionengine.s.a(Unknown Source)

at com.bas.basserver.executionengine.ExecutionEngine.doExecuteQuery(Unknown Source)

at com.bas.basserver.executionengine.ExecutionEngine.executeQuery(Unknown Source)

at com.bas.basserver.session.SessionManager.a(Unknown Source)

at com.bas.basserver.session.SessionManager.a(Unknown Source)

at com.bas.basserver.session.SessionManager.a(Unknown Source)

at com.bas.basserver.session.SessionManager.a(Unknown Source)

at com.bas.basserver.session.SessionManager.login(Unknown Source)

at com.bas.basserver.channels.ChannelManager.handleSocketLoginRequest(Unknown Source)

at com.bas.basserver.bsmanager.k.run(Unknown Source)

at java.lang.Thread.run(Unknown Source)

com.bas.basserver.executionengine.ExecutionException: Internal error. No Such Object

If I put in the parent node I get this:

Performing LDAP login...

Trying to login through object or group LDAPUser

Trying to login through object LDAPUser

Getting connection to connect to LDAP with operator password LDAPServer 389

Running query to find LDAP object LDAPUser and user name operator

LDAPPersister: executeQuery called for (sAMAccountName=operator)

LDAPPersister: base is TopLevel

fillUpRange called true 1 1000

fillUpRange: Getting entry 1

LDAP Exception thrown Invalid DN Syntax 0000208F: NameErr: DSID-031001AA, problem 2006 (BAD_NAME), data 8350, best match of:
'TopLevel'

LDAPException: Matched DN:

at com.novell.ldap.LDAPResponse.getResultException(Unknown Source)

at com.novell.ldap.LDAPResponse.chkResultCode(Unknown Source)

at com.novell.ldap.LDAPSearchResults.next(Unknown Source)

at com.bas.basserver.persistence.LDAPPersister$a.if(Unknown Source)

at com.bas.basserver.persistence.LDAPPersister$a.<init>(Unknown Source)

at com.bas.basserver.persistence.LDAPPersister.a(Unknown Source)

at com.bas.basserver.persistence.LDAPPersister.executeQuery(Unknown Source)

at com.bas.basserver.persistence.PersistenceManager.executeQuery(Unknown Source)

at com.bas.basserver.executionengine.s.a(Unknown Source)

at com.bas.basserver.executionengine.s.a(Unknown Source)

at com.bas.basserver.executionengine.ExecutionEngine.doExecuteQuery(Unknown Source)

at com.bas.basserver.executionengine.ExecutionEngine.executeQuery(Unknown Source)

at com.bas.basserver.session.SessionManager.a(Unknown Source)

at com.bas.basserver.session.SessionManager.a(Unknown Source)

at com.bas.basserver.session.SessionManager.a(Unknown Source)

at com.bas.basserver.session.SessionManager.a(Unknown Source)

at com.bas.basserver.session.SessionManager.login(Unknown Source)

at com.bas.basserver.channels.ChannelManager.handleSocketLoginRequest(Unknown Source)

at com.bas.basserver.bsmanager.k.run(Unknown Source)

at java.lang.Thread.run(Unknown Source)

com.bas.basserver.executionengine.ExecutionException: Internal error. Invalid DN Syntax

I've tried different parent nodes by using a branch that the user exists in and always get errors. Not sure what to try next.

Cheers Rod

aware_support

Hi Rod,

not sure what to say... We are pretty confident that the functionality works. The first problem is definitely due to the lack of info about the parent node. Other problems are most probably due to incorrect DN names either in the node itself or in the parent node. Not sure what the correct ones are, though...

RocketRod

WOW oh WOW it works! Well up to 99.99%!

I have just spent a day playing with it and now have it working including automatic logon for my users. The issue was that when you put in the base branch it has to be in LDAP format as well i.e. ou=branchname,dc=domainname,dc=local. I have set up multiple LDAP objects as the user guide suggests and set up a group reference in my user BO. So I now have my users being able to be automatically validated against my active directory. So they don't have to log on!

Now just two questions/problems support:

How do I log in as Admin username as it wants to also validate against LDAP? The Admin account is of course never part of a user BO, so I get an invalid user. I thought it would bypass LDAP.
Having a probem with the user BO. If I have the create user ticked on in the login options it works beautifully. If I have it ticked off and add an instance manually in the user BO I get invalid user. This appears to be because the LDAP references are not set up in the user BO. But of course I don't know them until the user has tried to log on once. Their LDAP BO instance is created on their first attempt and then if I go into my user BO and add the reference details manually it all works. So how do I get the auto logon to work without ticking on the auto create for my user BO? Also if I have the auto create ticked on how do you limit the BS to just a part of your users as everyone who tries to log on gets a user BO instance auto added?

If I can sort these last two items out my users will be very happy and never have to login again to a BS.

Cheers Rod

RocketRod

Comment support? Sorry just very eager to get this great feature completed and as you can see just about there.

aware_support

The admin user also has to go through LDAP. You need to set up rules that would assign access levels based on the info from the LDAP. It is up to you how you do this.
I don't understand the question. Can you explain it in more detail?