LDAP login issues in dotcms 2.5.1

101 views

Skip to first unread message

Bart Plasmans

unread,

Mar 12, 2014, 7:56:56 AM3/12/14

to dot...@googlegroups.com

Hi,

we are having issues when enabling LDAP on dotCMS 2.5.1.

This is our configuration of the portal-ext.properties file, which worked in previous versions:

# LDAP (LDAP Servers)

# once a user is authenticated, LDAP will query the user and pull a list

# of groups that the user belongs to

# These groups will be created in the CMS on the fly and the CMS user will

# be associated with them.

auth.pipeline.pre=com.dotcms.enterprise.LDAPProxy

auth.impl.ldap.initial.context.factory=com.sun.jndi.ldap.LdapCtxFactory

# Set SSL if you are using LDAPS or leave blank

auth.impl.ldap.security.authentication=

# set path to keystore with root server cert imported or leave blank

auth.impl.ldap.security.keystore.path=

auth.impl.ldap.host=172.17.1.1

auth.impl.ldap.port=389

# should be full dn of user

auth.impl.ldap.userid=xxxxxx

auth.impl.ldap.password=xxxxxx

auth.impl.ldap.domainlookup=OU=Users,OU=ISAAC,DC=isaac,DC=local

auth.impl.build.groups=true

auth.impl.ldap.build.group.name.filter=^ldap_dotCMS_(.*)

# Prefix the dotcms should strip from group name. Leave blank to not strip any prefix.

auth.impl.ldap.build.group.name.filter.strip=ldap_dotCMS_

#If you set to false any user created from LDAP will not be able to log into the dotCMS if LDAP is not availible.

auth.impl.ldap.syncPassword=true

# The following attributes can be used to match up dotCMS user properties to LDAP Attributes. Uncomment all attributes.

# If you leave the attribute blank then it will not be synced from LDAP.

# NOTE: YOU CANNOT HAVE A GROUP NAME WITH A "=" IN IT

auth.impl.ldap.attrib.user=mail

auth.impl.ldap.attrib.firstName=givenName

auth.impl.ldap.attrib.middleName=middleName

auth.impl.ldap.attrib.lastName=sn

auth.impl.ldap.attrib.nickName=

auth.impl.ldap.attrib.email=mail

auth.impl.ldap.attrib.gender=

auth.impl.ldap.attrib.group=memberOf

When we try to login we get the following error in the log:

[12/03/14 09:11:27:761 CET] INFO enterprise.LDAPImpl: User bart.p...@isaac.nl logged in

[12/03/14 09:11:27:817 CET] INFO enterprise.LDAPImpl: User bart.p...@isaac.nl logged in

[12/03/14 09:11:28:045 CET] INFO enterprise.LDAPImpl: User bart.p...@isaac.nl logged in

[12/03/14 09:11:28:075 CET] WARN util.JDBCExceptionReporter: SQL Error: 0, SQLState: 23505

[12/03/14 09:11:28:075 CET] ERROR util.JDBCExceptionReporter: ERROR: duplicate key value violates unique constraint "users_cms_roles_parent1"

Detail: Key (role_id, user_id)=(742c9eb3-8651-4df4-b1dc-00c8c64aee4f, dotcms.org.2836) already exists.

[12/03/14 09:11:28:076 CET] ERROR impl.SessionImpl: Could not synchronize database state with session

[12/03/14 09:11:28:076 CET] ERROR enterprise.LDAPImpl: Unable to add user dotcms.org.2836 to LDAP User role

com.dotmarketing.exception.DotHibernateException: Unable to save Object to Hibernate Session

at com.dotmarketing.db.HibernateUtil.save(HibernateUtil.java:453)

at com.dotmarketing.business.RoleFactoryImpl.addRoleToUser(RoleFactoryImpl.java:236)

at com.dotmarketing.business.RoleAPIImpl.addRoleToUser(RoleAPIImpl.java:178)

at com.dotcms.enterprise.BaseAuthenticator.b(SourceFile:277)

at com.dotcms.enterprise.BaseAuthenticator.a(SourceFile:170)

at com.dotcms.enterprise.BaseAuthenticator.authenticateByEmailAddress(SourceFile:115)

at com.dotcms.enterprise.LDAPProxy.authenticateByEmailAddress(SourceFile:24)

at com.dotcms.enterprise.AuthPipelineImpl.a(SourceFile:103)

at com.dotcms.enterprise.AuthPipelineImpl.a(SourceFile:45)

at com.dotcms.enterprise.AuthPipeProxy.authenticateByEmailAddress(SourceFile:13)

at com.liferay.portal.ejb.UserManagerImpl._authenticate(UserManagerImpl.java:654)

at com.liferay.portal.ejb.UserManagerImpl.authenticateByEmailAddress(UserManagerImpl.java:101)

at com.liferay.portal.ejb.UserManagerUtil.authenticateByEmailAddress(UserManagerUtil.java:70)

at com.liferay.portal.action.LoginAction._login(LoginAction.java:195)

at com.liferay.portal.action.LoginAction.execute(LoginAction.java:100)

at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421)

at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226)

at com.liferay.portal.struts.PortalRequestProcessor.process(PortalRequestProcessor.java:157)

at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164)

at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:415)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)

at com.liferay.portal.servlet.MainServlet.callParentService(MainServlet.java:275)

at com.liferay.portal.servlet.MainServlet.service(MainServlet.java:501)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)