eDirectory Intruder Lockout reset

[sutick]

I've got pwm all up and running, but seem to be having issues getting
it to reset the Intruder Lockout in eDirectory if it's set. I click
the unlock button, but the screen just flashes and the intruder
lockout does not get reset.

I've given the Proxy User rights to the Intruder Lockout setting in
eDirectory.

Any ideas on how to begin getting this to work?

Thanks.

[Jason Rivard]

Set the log level to TRACE and review the log.  Post the trace here if your still not sure what is happening...

--
You received this message because you are subscribed to the Google Groups "pwm-general" group.
To post to this group, send email to pwm-g...@googlegroups.com.
To unsubscribe from this group, send email to pwm-general...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/pwm-general?hl=en.

[sutick]

On May 2, 6:21 pm, Jason Rivard <jriv...@gmail.com> wrote:
> Set the log level to TRACE and review the log.  Post the trace here if your
> still not sure what is happening...

Here is the trace from the logs. I do see that there are error
stating attempt to unlock user account failed: [LDAP: error code 50 -
NDS error: no access (-672) & error testing nmas password: -1659

So, I've obviously missed some rights that my proxy user needs. What
property rights does the proxy user need to correctly unlock an
intruder locked account in a situation like this?

Thanks.


2011-05-03 08:12:05, TRACE, pwm.SessionFilter, {e~} POST request for: /
pwm/public/ForgottenPassword [172.18.2.102]
pwmFormID='lXax5k8AS1rgslFC1DOnOLNkTqFrLkuk11b1433712fb631d776'
PwmResponse_R_1=***removed***
sn='TestAccount'
processAction='checkResponses'
2011-05-03 08:12:05, TRACE, servlet.ForgottenPasswordServlet, {e~}
successful validation of ldap value for 'sn' [172.18.2.102]
2011-05-03 08:12:05, DEBUG, servlet.ForgottenPasswordServlet, {e~}
user 'cn=testaccount,ou=TECHLAB,o=lc_county' has supplied correct
responses [172.18.2.102]
2011-05-03 08:12:05, TRACE, entry.EdirEntries, using active universal
password policy for user cn=testaccount,ou=TECHLAB,o=lc_county at
cn=LC-County-Administrators,cn=Password Policies,cn=Security
2011-05-03 08:12:05, DEBUG, pwm.PwmPasswordPolicy, {e~} discovered
assigned password policy for cn=testaccount,ou=TECHLAB,o=lc_county at
cn=LC-County-Administrators,cn=Password Policies,cn=Security
PwmPasswordPolicy: {MinimumLowerCase=1
, MinimumSpecial=0, MaximumUpperCase=0, MaximumNumeric=0,
MinimumLifetime=0, MinimumUnique=3, DisallowedAttributes=[],
UniqueRequired=TRUE, AllowNumeric=TRUE, CaseSensitive=TRUE,
ChangeMessage=Please enter a password at least 8 characte
rs long. Password must contain at least one number, one Upper case
and one lower case letter. Example -- H3l3naMt,
ExpirationInterval=2592000, MaximumLowerCase=0, AllowSpecial=TRUE,
MaximumLength=512, AllowFirstCharNumeric=TRUE, Mi
nimumLength=8, MaximumSequentialRepeat=4, MinimumNumeric=1,
AllowLastCharSpecial=TRUE, PolicyEnabled=true, MaximumSpecial=0,
MinimumUpperCase=1, AllowFirstCharSpecial=TRUE, DisallowedValues=[],
AllowLastCharNumeric=TRUE} [172.18.2.102]
2011-05-03 08:12:05, DEBUG, pwm.PwmPasswordPolicy, {e~} merged
password policy with PWM configured policy: PwmPasswordPolicy:
{MinimumLowerCase=1, MinimumSpecial=0, MaximumUpperCase=0,
MaximumNumeric=0, EnableWordlist=true, MinimumLifet
ime=0, RegExMatch=, MinimumUnique=3, MinimumNonAlpha=null,
DisallowedAttributes=[sn, cn, givenName], UniqueRequired=true,
MinimumStrength=null, AllowNumeric=true, CaseSensitive=true,
ChangeMessage=Please enter a password at least 8 char
acters long. Password must contain at least one number, one Upper
case and one lower case letter. Example -- H3l3naMt,
ExpirationInterval=2592000, MinimumAlpha=null, MaximumLowerCase=0,
AllowSpecial=true, ADComplexity=false, Maximu
mLength=512, MaximumRepeat=null, AllowFirstCharNumeric=true,
MinimumLength=8, MaximumSequentialRepeat=4, AllowLastCharSpecial=true,
MinimumNumeric=1, MaximumAlpha=null, PolicyEnabled=true,
RegExNoMatch=, MaximumNonAlpha=null, MaximumSpe
cial=0, MinimumUpperCase=1, AllowFirstCharSpecial=true,
AllowLastCharNumeric=true, DisallowedValues=[test, password]}
[172.18.2.102]
2011-05-03 08:12:05, TRACE, pwm.PwmPasswordPolicy, {e~}
createPwmPasswordPolicy completed in 4ms [172.18.2.102]
2011-05-03 08:12:05, TRACE, pwm.UserStatusHelper, {e~} beginning
password status check process for
cn=testaccount,ou=TECHLAB,o=lc_county [172.18.2.102]
2011-05-03 08:12:05, DEBUG, impl.AbstractChaiEntry, user
cn=testaccount,ou=TECHLAB,o=lc_county password expired -60952000
seconds ago (Mon May 02 15:16:13 MDT 2011, marking as expired
2011-05-03 08:12:05, TRACE, pwm.UserStatusHelper, {e~} password for
cn=testaccount,ou=TECHLAB,o=lc_county appears to be expired
[172.18.2.102]
2011-05-03 08:12:05, DEBUG, pwm.UserStatusHelper, {e~} completed user
password status check for cn=testaccount,ou=TECHLAB,o=lc_county
PasswordStatus {expired=true, pre-expired=false, warn=false,
violatesPolicy=false} (3ms) [172.18.2.102
]
2011-05-03 08:12:05, WARN , servlet.ForgottenPasswordServlet, {e~}
attempt to unlock user account failed: [LDAP: error code 50 - NDS
error: no access (-672)] [172.18.2.102]
2011-05-03 08:12:05, TRACE, pwm.AuthenticationFilter, {e~} beginning
auth processes for user with unknown password [172.18.2.102]
2011-05-03 08:12:05, DEBUG, impl.AbstractChaiEntry, error testing nmas
password: -1659
2011-05-03 08:12:05, ERROR, pwm.AuthenticationFilter, {e~} error
retrieving user password from directory; error reading nmas password:
error -1659 [172.18.2.102]
2011-05-03 08:12:05, DEBUG, pwm.AuthenticationFilter, {e~} attempting
to set temporary random password [172.18.2.102]
2011-05-03 08:12:05, TRACE, entry.EdirEntries, using active universal
password policy for user cn=testaccount,ou=TECHLAB,o=lc_county at
cn=LC-County-Administrators,cn=Password Policies,cn=Security
2011-05-03 08:12:05, DEBUG, pwm.PwmPasswordPolicy, {e~} discovered
assigned password policy for cn=testaccount,ou=TECHLAB,o=lc_county at
cn=LC-County-Administrators,cn=Password Policies,cn=Security
PwmPasswordPolicy: {MinimumLowerCase=1
, MinimumSpecial=0, MaximumUpperCase=0, MaximumNumeric=0,
MinimumLifetime=0, MinimumUnique=3, DisallowedAttributes=[],
UniqueRequired=TRUE, AllowNumeric=TRUE, CaseSensitive=TRUE,
ChangeMessage=Please enter a password at least 8 characte
rs long. Password must contain at least one number, one Upper case
and one lower case letter. Example -- H3l3naMt,
ExpirationInterval=2592000, MaximumLowerCase=0, AllowSpecial=TRUE,
MaximumLength=512, AllowFirstCharNumeric=TRUE, Mi
nimumLength=8, MaximumSequentialRepeat=4, MinimumNumeric=1,
AllowLastCharSpecial=TRUE, PolicyEnabled=true, MaximumSpecial=0,
MinimumUpperCase=1, AllowFirstCharSpecial=TRUE, DisallowedValues=[],
AllowLastCharNumeric=TRUE} [172.18.2.102]
2011-05-03 08:12:05, DEBUG, pwm.PwmPasswordPolicy, {e~} merged
password policy with PWM configured policy: PwmPasswordPolicy:
{MinimumLowerCase=1, MinimumSpecial=0, MaximumUpperCase=0,
MaximumNumeric=0, EnableWordlist=true, MinimumLifet
ime=0, RegExMatch=, MinimumUnique=3, MinimumNonAlpha=null,
DisallowedAttributes=[sn, cn, givenName], UniqueRequired=true,
MinimumStrength=null, AllowNumeric=true, CaseSensitive=true,
ChangeMessage=Please enter a password at least 8 char
acters long. Password must contain at least one number, one Upper
case and one lower case letter. Example -- H3l3naMt,
ExpirationInterval=2592000, MinimumAlpha=null, MaximumLowerCase=0,
AllowSpecial=true, ADComplexity=false, Maximu
mLength=512, MaximumRepeat=null, AllowFirstCharNumeric=true,
MinimumLength=8, MaximumSequentialRepeat=4, AllowLastCharSpecial=true,
MinimumNumeric=1, MaximumAlpha=null, PolicyEnabled=true,
RegExNoMatch=, MaximumNonAlpha=null, MaximumSpe
cial=0, MinimumUpperCase=1, AllowFirstCharSpecial=true,
AllowLastCharNumeric=true, DisallowedValues=[test, password]}
[172.18.2.102]

2011-05-03 08:12:05, TRACE, pwm.PwmPasswordPolicy, {e~}
createPwmPasswordPolicy completed in 3ms [172.18.2.102]
2011-05-03 08:12:05, TRACE, wordlist.WordlistManager, {e~}
successfully checked word, result=false, duration=0ms [172.18.2.102]
2011-05-03 08:12:05, DEBUG, util.Helper, {e~} externalJudgeMethod
'password.pwm.PwmPasswordJudge' returned a value of 68 [172.18.2.102]
2011-05-03 08:12:05, TRACE, wordlist.WordlistManager, {e~}
successfully checked word, result=false, duration=0ms [172.18.2.102]
2011-05-03 08:12:05, TRACE, util.RandomPasswordGenerator, {e~}
finished random password generation in 2ms after 1 tries.
[172.18.2.102]
2011-05-03 08:12:05, INFO , pwm.AuthenticationFilter, {e~} user
cn=testaccount,ou=TECHLAB,o=lc_county password has been set to random
value for pwm to use for user authentication [172.18.2.102]
2011-05-03 08:12:05, TRACE, pwm.UserStatusHelper, {e~} username
appears to be a DN; skipping username search [172.18.2.102]
2011-05-03 08:12:05, TRACE, pwm.AuthenticationFilter, {e~} beginning
testCredentials process [172.18.2.102]
2011-05-03 08:12:05, TRACE, pwm.AuthenticationFilter, {e~} attempting
authentication using ldap BIND [172.18.2.102]
2011-05-03 08:12:05, TRACE, pwm.SessionManager, {e~} opened new ldap
connection for null (0ms) [172.18.2.102]
2011-05-03 08:12:05, TRACE, util.Helper, creating new chai provider
using config of ChaiConfiguration: locked=false settings:
{chai.bind.URLs=ldaps://172.18.4.6:636,,
chai.bind.dn=cn=testaccount,ou=TECHLAB,o=lc_county, chai.bind.passwor
d=**stripped**, chai.cache.enable=false, chai.cache.maximumSize=128,
chai.cache.maximumAge=1000, chai.statistics.enable=true,
chai.watchdog.enable=true, chai.watchdog.operationTimeout=60000,
chai.watchdog.idleTimeout=60302, chai.connect
ion.watchdog.frequency=60000, chai.connection.promiscuousSSL=false,
chai.wireDebug.enable=false, chai.failover.enable=true,
chai.failover.failBackTime=90000, chai.failover.connectRetries=4,
chai.ldap.dereferenceAliases=never, chai.ldap.
ldapTimeout=5000,
chai.provider.implementation=com.novell.ldapchai.provider.JNDIProviderImpl,
chai.edirectory.enableNMAS=true,
chai.provider.extendedOperation.failureCache=true,
chai.provider.readonly=false, chai.default.identityAttribu
tes=cn,uid,givenName,initials,sn,mail,telephoneNumber,workforceID,
chai.vendor.default=}
2011-05-03 08:12:08, DEBUG, provider.ChaiProviderFactory, unable to
create connection:
com.novell.ldapchai.exception.ChaiUnavailableException:unable to bind
to ldaps://172.18.4.6:636 as cn=testaccount,ou=TECHLAB,o=lc_county
reason: [LDA
P: error code 53 - NDS error: login lockout (-197)]
2011-05-03 08:12:08, WARN , pwm.AuthenticationFilter, {e~} intruder
lockout detected for user cn=testaccount,ou=TECHLAB,o=lc_county
marking session as locked out [172.18.2.102]
2011-05-03 08:12:08, DEBUG, util.IntruderManager, {e~} incrementing
count user=cn=testaccount,ou=TECHLAB,o=lc_county, attemptCount=1
[172.18.2.102]
2011-05-03 08:12:08, WARN , servlet.ForgottenPasswordServlet,
unexpected error authenticating during forgotten password recovery
process user: 5023 ERROR_INTRUDER_USER
2011-05-03 08:12:17, TRACE, pwm.SessionFilter, {e~} POST request for: /
pwm/public/CommandServlet [172.18.2.102]
button='Continue'
processAction='continue'
2011-05-03 08:12:17, TRACE, servlet.CommandServlet, {e~} received
request for action continue [172.18.2.102]
2011-05-03 08:12:17, TRACE, servlet.CommandServlet, {e~} redirecting
user to forward url: /pwm [172.18.2.102]
2011-05-03 08:12:17, TRACE, pwm.SessionFilter, {e~} GET request for: /
pwm/ (no params) [172.18.2.102]

[Matt Weisberg]

I think this will come through, here is a screen shot of how I have the trustee rights set at one of my customer sites:

Don't worry about the error testing nmas password.  For that to work I believe you would have to give permission to the pwm proxy in the password policy to retrieve the distribution password.  That won't stop anything from working.

Matt

--
You received this message because you are subscribed to the Google Groups "pwm-general" group.
To post to this group, send email to pwm-g...@googlegroups.com.
To unsubscribe from this group, send email to pwm-general...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/pwm-general?hl=en.

--------

Matt Weisberg

Weisberg Consulting, Inc.

ma...@weisberg.net

www.weisberg.net

ofc. 248.685.1970

cell 248.705.1950

fax 248.769.5963

[sutick]

Matt,

The screen shot did not show up.

On May 3, 9:03 am, Matt Weisberg <m...@weisberg.net> wrote:
> I think this will come through, here is a screen shot of how I have the trustee rights set at one of my customer sites:
>

> ...
>
> read more »

[Jason Rivard]

Weird, the picture came through on mine.  

I think the key attributes are:

Locked By Intruder

Login Grace Remaining

Login Intruder Attempts

Login intruder Reset Time

[sutick]

Hmmmm.... I had all of those except Login Grace Remaining. Added
that, but I still get the same error, which I would expect, as that
one doesn't have any thing to do with intruder lockout really.

> ...
>
> read more »

[Jason Rivard]

How about making the proxy admin just for testing to be sure its a rights issue?

> ...
>
> read more »

[sutick]

Yep, if I set the Proxy user as an admin equivalent, it is able to
change the password and unlock the account.

> ...
>
> read more »

[Jason Rivard]

Unfortunatly the error message doesn't really tell us what the error is.  I've changed the current code to improve the error message, but that won't help you for now.  The only other ACL I can think that matters is the Password Management acl, but I'm assuming you already have that.

Best bet then is to look at the eDirectory ldap trace to see if you can spot the reason eDirectory is blocking the change.

> ...
>
> read more »

[Jason Rivard]

This is the code that does the unlock:

http://code.google.com/p/ldapchai/source/browse/trunk/src/com/novell/ldapchai/impl/edir/entry/InetOrgPersonImpl.java#87

You can see its only writing to those 4 attrs.

-jason

[sutick]

OK, feeling REALLY stupid now. I had all the rights added, but had
failed to give "Write" access to Locked by Intruder. Doh!
Changing that, and it works fine.

Thanks for your assistance guys!

On May 3, 11:49 am, Jason Rivard <jriv...@gmail.com> wrote:
> This is the code that does the unlock:
>

> http://code.google.com/p/ldapchai/source/browse/trunk/src/com/novell/...

>
> You can see its only writing to those 4 attrs.
>
> -jason
>

> ...
>
> read more »