Can't get LDAP work for days

[Tom Sunny]

Hello,

I am new to Rundeck ( 3.20.xx) and trying to configure it working with LDAP. I have tried all settings for days based on Google search, but still have no luck. Could any expert light me up? Below is the content of my jaas-ldap.conf which has disabled "ForceBindingLogin":

- I am able to login as "admin"

Thanks very much for any helps.

multiauth {

    com.dtolabs.rundeck.jetty.jaas.JettyCachingLdapLoginModule sufficient

      debug="true"

      contextFactory="com.sun.jndi.ldap.LdapCtxFactory"

      providerUrl="ldap://dc.blur.com:389"

      bindDn="cn=myusername,dc=blur,dc=com"

      bindPassword="mypassword"

      authenticationMethod="simple"

      forceBindingLogin="false"

      userBaseDn="dc=blur,dc=com"

      userRdnAttribute="sAMAccountName"

      userIdAttribute="sAMAccountName"

      userPasswordAttribute="unicodePwd"  --- also tried "userPassword"

      userObjectClass="account"

      userLastNameAttribute="sn"

      userFirstNameAttribute="givenName"

      userEmailAttribute="mail"

      roleBaseDn="ou=Groups,dc=test1,dc=example,dc=com"

      roleNameAttribute="cn"

      roleUsernameMemberAttribute="memberUid"

      roleMemberAttribute="memberUid"

      roleObjectClass="posixGroup"

      cacheDurationMillis="300000"

      supplementalRoles="user"

      reportStatistics="true"

      timeoutRead="10000";

    org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required

      debug="true"

      file="/etc/rundeck/realm.properties";

};

Errors from Rundeck logs

==> /var/log/rundeck/service.log <==

[2020-01-29 13:15:54.584] DEBUG GrailsUsernamePasswordAuthenticationFilter --- [qtp252510665-27] Request is to process authentication

[2020-01-29 13:15:54.587] ERROR JettyCachingLdapLoginModule --- [qtp252510665-27] Naming error

javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580]

        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3154)

        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3100)

        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2886)

        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2800)

        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319)

        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)

        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)

        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:153)

        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:83)

        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)

        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:313)

        at javax.naming.InitialContext.init(InitialContext.java:244)

        at javax.naming.InitialContext.<init>(InitialContext.java:216)

        at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:101)

        at com.dtolabs.rundeck.jetty.jaas.JettyCachingLdapLoginModule.initialize(JettyCachingLdapLoginModule.java:913)

        at sun.reflect.GeneratedMethodAccessor480.invoke(Unknown Source)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

        at java.lang.reflect.Method.invoke(Method.java:498)

        at javax.security.auth.login.LoginContext.invoke(LoginContext.java:736)

        at javax.security.auth.login.LoginContext.access$000(LoginContext.java:195)

        at javax.security.auth.login.LoginContext$4.run(LoginContext.java:682)

        at javax.security.auth.login.LoginContext$4.run(LoginContext.java:680)

        at java.security.AccessController.doPrivileged(Native Method)

        at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)

        at javax.security.auth.login.LoginContext.login(LoginContext.java:587)

        at org.springframework.security.authentication.jaas.AbstractJaasAuthenticationProvider.authenticate(AbstractJaasAuthenticationProvider.java:180)

        at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174)

        at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:94)

        at grails.plugin.springsecurity.web.authentication.GrailsUsernamePasswordAuthenticationFilter.attemptAuthentication(GrailsUsernamePasswordAuthenticationFilter.groovy:53)

        at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)

        at grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter.doFilter(MutableLogoutFilter.groovy:64)

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)

        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)

        at grails.plugin.springsecurity.web.SecurityRequestHolderFilter.doFilter(SecurityRequestHolderFilter.groovy:58)

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)

        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)

        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.grails.web.servlet.mvc.GrailsWebRequestFilter.doFilterInternal(GrailsWebRequestFilter.java:77)

        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.grails.web.filters.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:67)

        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)

        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:96)

        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:103)

        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:542)

        at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)

        at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:536)

        at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)

        at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)

        at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1581)

        at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)

        at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1307)

        at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)

        at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:482)

        at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1549)

        at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)

        at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1204)

        at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)

        at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)

        at org.eclipse.jetty.server.Server.handle(Server.java:494)

        at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:374)

        at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:268)

        at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)

        at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)

        at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:426)

        at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:320)

        at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:158)

        at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)

        at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117)

        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336)

        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313)

        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171)

        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129)

        at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:367)

        at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:782)

        at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:918)

        at java.lang.Thread.run(Thread.java:748)

[2020-01-29 13:15:54.588] DEBUG GrailsUsernamePasswordAuthenticationFilter --- [qtp252510665-27] Authentication request failed: org.springframework.security.authentication.AuthenticationServiceException

org.springframework.security.authentication.AuthenticationServiceException: null

        at org.springframework.security.authentication.jaas.DefaultLoginExceptionResolver.resolveException(DefaultLoginExceptionResolver.java:35)

        at org.springframework.security.authentication.jaas.AbstractJaasAuthenticationProvider.authenticate(AbstractJaasAuthenticationProvider.java:217)

        at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174)

        at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:94)

        at grails.plugin.springsecurity.web.authentication.GrailsUsernamePasswordAuthenticationFilter.attemptAuthentication(GrailsUsernamePasswordAuthenticationFilter.groovy:53)

        at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)

        at grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter.doFilter(MutableLogoutFilter.groovy:64)

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)

        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)

        at grails.plugin.springsecurity.web.SecurityRequestHolderFilter.doFilter(SecurityRequestHolderFilter.groovy:58)

        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)

        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)

        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.grails.web.servlet.mvc.GrailsWebRequestFilter.doFilterInternal(GrailsWebRequestFilter.java:77)

        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.grails.web.filters.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:67)

        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)

        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:96)

        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:103)

        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)

        at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1591)

        at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:542)

        at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)

        at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:536)

        at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)

        at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)

        at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1581)

        at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)

        at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1307)

        at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)

        at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:482)

        at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1549)

        at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)

        at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1204)

        at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)

        at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)

        at org.eclipse.jetty.server.Server.handle(Server.java:494)

        at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:374)

        at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:268)

        at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)

        at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)

        at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:426)

        at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:320)

        at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:158)

        at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)

        at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117)

        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:336)

        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:313)

        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:171)

        at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:129)

        at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:367)

        at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:782)

        at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:918)

        at java.lang.Thread.run(Thread.java:748)

Caused by: javax.security.auth.login.FailedLoginException: null

        at org.eclipse.jetty.jaas.spi.AbstractLoginModule.login(AbstractLoginModule.java:258)

        at sun.reflect.GeneratedMethodAccessor482.invoke(Unknown Source)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

        at java.lang.reflect.Method.invoke(Method.java:498)

        at javax.security.auth.login.LoginContext.invoke(LoginContext.java:755)

        at javax.security.auth.login.LoginContext.access$000(LoginContext.java:195)

        at javax.security.auth.login.LoginContext$4.run(LoginContext.java:682)

        at javax.security.auth.login.LoginContext$4.run(LoginContext.java:680)

        at java.security.AccessController.doPrivileged(Native Method)

        at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)

        at javax.security.auth.login.LoginContext.login(LoginContext.java:587)

        at org.springframework.security.authentication.jaas.AbstractJaasAuthenticationProvider.authenticate(AbstractJaasAuthenticationProvider.java:180)

        ... 62 common frames omitted

[2020-01-29 13:15:54.589] DEBUG GrailsUsernamePasswordAuthenticationFilter --- [qtp252510665-27] Updated SecurityContextHolder to contain null Authentication

[2020-01-29 13:15:54.589] DEBUG GrailsUsernamePasswordAuthenticationFilter --- [qtp252510665-27] Delegating to authentication failure handler grails.plugin.springsecurity.web.authentication.AjaxAwareAuthenticationFailureHandler@6e466fdf

==> /var/log/rundeck/rundeck.access.log <==

[2020-01-29 13:15:54,598] web.requests "GET /user/error" 10.10.107.37 https  form 1 ? [] (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36)

[2020-01-29 13:15:54,637] web.requests "GET /static/images/rundeck-full-logo-black.png" 10.10.107.37 https  form 3 ? [image/png] (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36)

Enter code here...

[Reiner Acuña]

Hi Tom,

Remember that userPasswordAttribute is a user attribute in your LDAP branch (users), like this:

In your case is the password attribute for your users? Make sure that you're pointing well to the user's DN and the right attributes to get users and their passwords (and groups/roles). Here you have a complete explanation here:

https://docs.rundeck.com/docs/administration/security/authentication.html#login-module-configuration

Hope it helps!

[tao sun]

Thanks. Will update

--
You received this message because you are subscribed to the Google Groups "rundeck-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to rundeck-discu...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/rundeck-discuss/79a7f5f0-9fbd-46f4-8e74-ba4656f620ec%40googlegroups.com.