Rundeck ldap integration

186 views

Skip to first unread message

devops tools

unread,

Nov 24, 2020, 4:26:06 PM11/24/20

to rundeck-discuss

Hi all,

I'm trying to test the integration between Rundeck and LDAP

I have installed Rundeck and ldap,

I created the jaas-ldap.conf file

--------

ldap {

com.dtolabs.rundeck.jetty.jaas.JettyCachingLdapLoginModule sufficient

debug="true"

contextFactory="com.sun.jndi.ldap.LdapCtxFactory"

providerUrl="ldap://localhost:389"

bindDn="cn=ldapadm,dc=rundeck,dc=fr"

bindPassword="ldppassword"

authenticationMethod="simple"

forceBindingLogin="false"

userBaseDn="ou=People,dc=rundeck,dc=fr"

userRdnAttribute="cn"

userIdAttribute="uid"

userPasswordAttribute="userPassword"

userObjectClass="posixAccount"

userLastNameAttribute="sn"

userFirstNameAttribute="givenName"

userEmailAttribute="mail"

roleBaseDn="ou=Groups,dc=rundeck,dc=fr"

roleNameAttribute="cn"

roleUsernameMemberAttribute="memberUid"

roleMemberAttribute="memberUid"

roleObjectClass="posixGroup"

cacheDurationMillis="300000"

reportStatistics="true"

timeoutRead="10000"

timeoutConnect="20000"

nestedGroups="false";

};

-----

in /var/log/rundeck/services

[2020-11-24T22:08:06,224] DEBUG authentication.GrailsUsernamePasswordAuthenticationFilter - Updated SecurityContextHolder to contain null Authentication

[2020-11-24T22:08:06,224] DEBUG authentication.GrailsUsernamePasswordAuthenticationFilter - Delegating to authentication failure handler grails.plugin.springsecurity.web.authentication.AjaxAwareAuthenticationFailureHandler@6442c2dd

And in Ldap log /var/log/ldap :

-----

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 fd=11 ACCEPT from IP=127.0.0.1:52942 (IP=0.0.0.0:389)

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 op=0 BIND dn="cn=ldapadm,dc=rundeck,dc=fr" method=128

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 op=0 BIND dn="cn=ldapadm,dc=rundeck,dc=fr" mech=SIMPLE ssf=0

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 op=0 RESULT tag=97 err=0 text=

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 op=1 SRCH base="ou=People,dc=rundeck,dc=fr" scope=2 deref=3 filter="(&(objectClass=posixAccount)(uid=user2))"

Nov 24 22:08:06 localhost slapd[4555]: <= bdb_equality_candidates: (uid) not indexed

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 op=2 SRCH base="ou=People,dc=rundeck,dc=fr" scope=2 deref=3 filter="(&(objectClass=posixAccount)(uid=user2))"

Nov 24 22:08:06 localhost slapd[4555]: <= bdb_equality_candidates: (uid) not indexed

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 op=2 SEARCH RESULT tag=101 err=0 nentries=1 text=

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 op=3 SRCH base="ou=Groups,dc=rundeck,dc=fr" scope=2 deref=3 filter="(&(objectClass=posixGroup)(memberUid=user2))"

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 op=3 SRCH attr=cn

Nov 24 22:08:06 localhost slapd[4555]: conn=1017 op=3 SEARCH RESULT tag=101 err=32 nentries=0 text=

Is there any extra config to do ?

but unfortunately I still find connection errors

rac...@rundeck.com

unread,

Nov 24, 2020, 4:29:53 PM11/24/20

to rundeck-discuss

Hi,

Can you post the full service.log content at the moment of connection? (please change any potentially sensitive information). Also, check this little step by step guide.

Regards!

devops tools

unread,

Nov 24, 2020, 4:39:38 PM11/24/20

to rundeck-discuss

[2020-11-24T22:38:33,858] DEBUG authentication.GrailsUsernamePasswordAuthenticationFilter - Request is to process authentication

[2020-11-24T22:38:33,878] INFO jaas.JettyCachingLdapLoginModule - Login attempts: 2, Hits: 0, Ratio: 0%.

[2020-11-24T22:38:33,886] DEBUG jaas.JettyCachingLdapLoginModule - Found user?: true

[2020-11-24T22:38:33,886] DEBUG jaas.JettyCachingLdapLoginModule - Searching for users with filter: '(&(objectClass={0})({1}={2}))' from base dn: ou=People,dc=rundeck,dc=fr

[2020-11-24T22:38:33,892] DEBUG jaas.JettyCachingLdapLoginModule - Found user?: true

[2020-11-24T22:38:33,894] DEBUG jaas.JettyCachingLdapLoginModule - user cred is present: true

[2020-11-24T22:38:33,906] WARN jaas.JettyCachingLdapLoginModule - JettyCachingLdapLoginModule: User 'user1' has no role membership; role query configuration may be incorrect

[2020-11-24T22:38:33,908] DEBUG authentication.GrailsUsernamePasswordAuthenticationFilter - Authentication request failed: org.springframework.security.authentication.AuthenticationServiceException

org.springframework.security.authentication.AuthenticationServiceException: null

at org.springframework.security.authentication.jaas.DefaultLoginExceptionResolver.resolveException(DefaultLoginExceptionResolver.java:35) ~[spring-security-core-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at org.springframework.security.authentication.jaas.AbstractJaasAuthenticationProvider.authenticate(AbstractJaasAuthenticationProvider.java:217) ~[spring-security-core-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:175) ~[spring-security-core-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:94) ~[spring-security-web-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at grails.plugin.springsecurity.web.authentication.GrailsUsernamePasswordAuthenticationFilter.attemptAuthentication(GrailsUsernamePasswordAuthenticationFilter.groovy:53) ~[spring-security-core-4.0.2.jar!/:?]

at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212) ~[spring-security-web-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter.doFilter(MutableLogoutFilter.groovy:64) ~[spring-security-core-4.0.2.jar!/:?]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) ~[spring-security-web-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at grails.plugin.springsecurity.web.SecurityRequestHolderFilter.doFilter(SecurityRequestHolderFilter.groovy:58) ~[spring-security-core-4.0.2.jar!/:?]

at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) ~[spring-security-web-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) ~[spring-security-web-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]

at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) ~[spring-security-web-5.1.11.RELEASE.jar!/:5.1.11.RELEASE]