By: Bruce Tucker user 01 Dec 2022 at 3:27 p.m. CST

7 Responses
Bruce Tucker gravatar
Using https://gluu.org/docs/gluu-server/4.4/operation/faq/ in Manage Authentication When Primary Key is sAMAccountName and Local Key is uid Logins to the GLUU server work with Active Directory users Changing both Primary & Local keys to mail login fails using email address from Active Directory Reverting back, Username logins work again. Am I missing a step for using email address to login ? ==> /opt/gluu-server/opt/gluu/jetty/oxauth/logs/oxauth.log <== 2022-12-01 21:29:51,902 INFO [qtp966739377-14] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:225) - Authentication failed for <redacted email address> ==> /opt/gluu-server/opt/gluu/jetty/oxauth/logs/2022_12_01.jetty.log <== 2022-12-01 21:29:51,902 INFO [qtp966739377-14] [org.gluu.oxauth.auth.Authenticator] (Authenticator.java:225) - Authentication failed for <redacted email address> Default Auth method is CASA looked at https://support.gluu.org/identity-management/9702/change-login-from-uid-to-mail-and-casa-login-fails/ Authentication was already enabled. I disabled, updated, waited a minute, enabled, updated. no change. can't use email for login -- https://support.gluu.org/identity-management/9703/activate-ldap-with-default-settings-cant-login-to-oxtrust-ui/ I will try: "But if the primary key is uid, and the 'default authentication method' is already casa and tested and working, and this is a clean boot, and noone else is using the server - then you change the primary key from uid to email, save, activate, save, test ldap connection, reboot. wait. be patient. wait. now it works!" But this does NOT say change the local key Failed to have a clean boot - server does not survive a reboot or restart Reverted to latest working snapshot GLUU server was in a working state Active Directory authentication w/ username method CASA Everyone logged out host reboot cleared old browser cookies after reboot username login fails wait 20 minutes - Clear cache - refresh browser username (all) logins still fail gluu-serverd restart wait 15 minutes - all logins still fail revert to latest working snapshot username login works gluu-serverd stop wait 2 minutes gluu-serverd start wait 20 minutes (LDAP sync is set to 15 minutes) username (all) logins still fail * I'm certain all settings we're saved but system does not survive a restart revert to latest working snapshot username login works

By Michael Schwartz Account Admin 01 Dec 2022 at 5:49 p.m. CST

Michael Schwartz gravatar
@Md Mostafejur.Rahman maybe you can help?

By Bruce Tucker user 02 Dec 2022 at 9:04 a.m. CST

Bruce Tucker gravatar
revert to latest working snapshot username login works ------- Update ------------------ Organization - System config - SCIM, Passport, SAML, Radius was already checked ON clicked <Update> Person Auth scripts casa, passport, passport_saml are ON clicked <Update> Created OpenID client - SCIM script to pull token works Cache Refresh clicked <update & validate script> instead of just <update> JSON <save configuration> root@gluu:~# gluu-serverd status ● systemd-nspawn@gluu-server.service - Container gluu-server Loaded: loaded (/lib/systemd/system/systemd-nspawn@gluu-server.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2022-11-30 14:06:15 CST; 1 day 18h ago Docs: man:systemd-nspawn(1) Main PID: 854 (systemd-nspawn) Status: "Container running: Startup finished in 1min 30.869s." Tasks: 1 (limit: 14266) Memory: 2.2M CGroup: /machine.slice/systemd-nspawn@gluu-server.service └─854 /usr/bin/systemd-nspawn --quiet --boot --link-journal=try-guest -D /opt/gluu-server --machine=gluu-server Nov 30 14:06:16 gluu.osteopathic.org systemd-nspawn[854]: [ OK ] Started Dispatcher daemon for systemd-networkd. Nov 30 14:06:16 gluu.osteopathic.org systemd-nspawn[854]: [ OK ] Started The Apache HTTP Server. Nov 30 14:06:16 gluu.osteopathic.org systemd-nspawn[854]: [ OK ] Started oxd-server daemon. Nov 30 14:06:20 gluu.osteopathic.org systemd-nspawn[854]: [FAILED] Failed to start Postfix Mail Transport Agent (instance -). Nov 30 14:06:20 gluu.osteopathic.org systemd-nspawn[854]: See 'systemctl status postfix@-.service' for details. Nov 30 14:06:20 gluu.osteopathic.org systemd-nspawn[854]: Starting Postfix Mail Transport Agent... Nov 30 14:06:20 gluu.osteopathic.org systemd-nspawn[854]: [ OK ] Finished Postfix Mail Transport Agent. Nov 30 14:06:22 gluu.osteopathic.org systemd-nspawn[854]: Nov 30 14:06:22 gluu.osteopathic.org systemd-nspawn[854]: Ubuntu 20.04.1 LTS gluu.osteopathic.org console Nov 30 14:06:22 gluu.osteopathic.org systemd-nspawn[854]: chroot@gluu-server:/etc/init.d# systemctl --type=service UNIT LOAD ACTIVE SUB DESCRIPTION apache2.service loaded active running The Apache HTTP Server casa.service loaded active running Casa service console-getty.service loaded active running Console Getty console-setup.service loaded active exited Set console font and keymap cron.service loaded active running Regular background program processing daemon dbus.service loaded active running D-Bus System Message Bus fido2.service loaded active running fido2 service gluu-radius.service loaded active running Gluu Radius service identity.service loaded active running Identity service idp.service loaded active running Idp service keyboard-setup.service loaded active exited Set the console keyboard layout ● motd-news.service loaded failed failed Message of the Day networkd-dispatcher.service loaded active running Dispatcher daemon for systemd-networkd opendj.service loaded active running OpenDJ Directory Service oxauth.service loaded active running Oxauth service oxd-server.service loaded active running oxd-server daemon passport.service loaded active running Passport service postfix.service loaded active exited Postfix Mail Transport Agent ● postfix@-.service loaded failed failed Postfix Mail Transport Agent (instance -) rsyslog.service loaded active running System Logging Service scim.service loaded active running scim service ssh.service loaded active running OpenBSD Secure Shell server systemd-journal-flush.service loaded active exited Flush Journal to Persistent Storage systemd-journald.service loaded active running Journal Service systemd-logind.service loaded active running Login Service systemd-remount-fs.service loaded active exited Remount Root and Kernel File Systems systemd-resolved.service loaded active running Network Name Resolution systemd-sysusers.service loaded active exited Create System Users systemd-tmpfiles-setup-dev.service loaded active exited Create Static Device Nodes in /dev systemd-tmpfiles-setup.service loaded active exited Create Volatile Files and Directories systemd-update-utmp.service loaded active exited Update UTMP about System Boot/Shutdown systemd-user-sessions.service loaded active exited Permit User Sessions user-runtime-dir@0.service loaded active exited User Runtime Directory /run/user/0 user@0.service loaded active running User Manager for UID 0 chroot@gluu-server:/etc/init.d# systemctl stop identity.service chroot@gluu-server:/etc/init.d# systemctl stop oxauth.service chroot@gluu-server:/etc/init.d# systemctl stop idp.service chroot@gluu-server:/etc/init.d# systemctl stop oxd-server.service chroot@gluu-server:/etc/init.d# systemctl start oxd-server.service chroot@gluu-server:/etc/init.d# systemctl start oxauth.service chroot@gluu-server:/etc/init.d# systemctl start identity.service chroot@gluu-server:/etc/init.d# systemctl start idp.service Refreshing Browser w/ existing cookie works (GLUU admin website) new Username login fails (GLUU admin website) <Test LDAP connection> Source backend server = success !! cache Refresh polling interval set to 15 minutes has not refreshed in 30 minutes finally polled after 30 minutes - login fails will wait another 30 minutes and test

By Bruce Tucker user 02 Dec 2022 at 9:19 a.m. CST

Bruce Tucker gravatar
changing Default Authentication method from <casa> to <ActiveDirectory> = new logins work changing Default Authentication method back to <casa> = new logins fail chroot@gluu-server:/etc/init.d# systemctl restart casa.service chroot@gluu-server:/etc/init.d# systemctl status casa.service ● casa.service - Casa service Loaded: loaded (/etc/systemd/system/casa.service; enabled; vendor preset: enabled) Drop-In: /etc/systemd/system/casa.service.d └─override.conf Active: active (running) since Fri 2022-12-02 09:16:43 CST; 39s ago Process: 44172 ExecStart=/opt/dist/scripts/casa start (code=exited, status=0/SUCCESS) Main PID: 44198 (java) CGroup: /system.slice/casa.service └─44198 /opt/jre/bin/java -server -Xms128m -Xmx533m -XX:+DisableExplicitGC -Dgluu.base=/etc/gluu -Dserver.base=/opt/g> Dec 02 09:16:31 gluu.osteopathic.org systemd[1]: Starting Casa service... Dec 02 09:16:32 gluu.osteopathic.org casa[44172]: Starting Jetty: Dec 02 09:16:32 gluu.osteopathic.org casa[44198]: 2022-12-02 15:16:32.047:INFO :oe.jetty:main: Console stderr/stdout captured to| > Dec 02 09:16:43 gluu.osteopathic.org casa[44172]: . . OK Fri Dec 2 09:16:43 CST 2022 Dec 02 09:16:43 gluu.osteopathic.org systemd[1]: Started Casa service. changing Default Authentication method back to <casa> = new logins fail !! casa logins fail after a restart

By Bruce Tucker user 02 Dec 2022 at 9:34 a.m. CST

Bruce Tucker gravatar
https://gluu.org/docs/casa/4.4/administration/faq/ In case of lockout# chroot@gluu-server:/etc/gluu/conf# systemctl stop casa.service chroot@gluu-server:~/tmp# jar -xf /opt/gluu/jetty/casa/webapps/casa.war WEB-INF/classes/org/gluu/casa/misc WEB-INF/lib chroot@gluu-server:~/tmp/WEB-INF/classes# java -cp .:../lib/* org.gluu.casa.misc.ClientReset Detected persistence type ldap Loading /etc/gluu/conf/gluu-ldap.properties Decrypting properties... Obtaining a persistence entry manager... 15:31:30 ERROR LdapConnectionProvider.java:95 - Failed to create connection pool with properties: {} java.lang.NullPointerException: null at org.gluu.persist.ldap.operation.impl.LdapConnectionProvider.init(LdapConnectionProvider.java:110) ~[gluu-orm-ldap-4.4.2.Final.jar:?] at org.gluu.persist.ldap.operation.impl.LdapConnectionProvider.create(LdapConnectionProvider.java:82) ~[gluu-orm-ldap-4.4.2.Final.jar:?] at org.gluu.persist.ldap.impl.LdapEntryManagerFactory.createEntryManager(LdapEntryManagerFactory.java:61) ~[gluu-orm-ldap-4.4.2.Final.jar:?] at org.gluu.casa.misc.ClientReset.main(ClientReset.java:79) ~[classes/:?] Exception in thread "main" org.gluu.persist.exception.operation.ConfigurationException: Failed to create LDAP connection pool! Result code: 'null' at org.gluu.persist.ldap.impl.LdapEntryManagerFactory.createEntryManager(LdapEntryManagerFactory.java:64) at org.gluu.casa.misc.ClientReset.main(ClientReset.java:79) chroot@gluu-server:~/tmp/WEB-INF/classes# systemctl start casa.service chroot@gluu-server:~/tmp/WEB-INF/classes# systemctl status casa.service ● casa.service - Casa service Loaded: loaded (/etc/systemd/system/casa.service; enabled; vendor preset: enabled) Drop-In: /etc/systemd/system/casa.service.d └─override.conf Active: active (running) since Fri 2022-12-02 09:32:53 CST; 13s ago Process: 44567 ExecStart=/opt/dist/scripts/casa start (code=exited, status=0/SUCCESS) Main PID: 44593 (java) CGroup: /system.slice/casa.service └─44593 /opt/jre/bin/java -server -Xms128m -Xmx533m -XX:+DisableExplicitGC -Dgluu.base=/etc/gluu -Dserver.base=/opt/g> Dec 02 09:32:41 gluu.osteopathic.org systemd[1]: Starting Casa service... Dec 02 09:32:42 gluu.osteopathic.org casa[44567]: Starting Jetty: Dec 02 09:32:42 gluu.osteopathic.org casa[44593]: 2022-12-02 15:32:42.028:INFO :oe.jetty:main: Console stderr/stdout captured to| > Dec 02 09:32:53 gluu.osteopathic.org casa[44567]: . . OK Fri Dec 2 09:32:53 CST 2022 Dec 02 09:32:53 gluu.osteopathic.org systemd[1]: Started Casa service. <casa> new logins still Failed

By Bruce Tucker user 02 Dec 2022 at 10:17 a.m. CST

Bruce Tucker gravatar
With Default Authentication method set to <ActiveDirectory> root@gluu:~# gluu-serverd restart New Username logins work Host reboot New Username logins work Primary Key & Local Key set to <mail> New email logins work Original ticket of email logins fixed. Will look into proper install & config of <casa> and create a new ticket for <casa> if logins fail.

By Bruce Tucker user 02 Dec 2022 at 12:42 p.m. CST

Bruce Tucker gravatar
FYI - Update after everything was working with Default Auth <ActiveDirectory> I rebooted Host & took a snapshot email logins worked. Walked away for an hour Added SS Pass reset & Edit Profile to System config. Changed Default ACR ONLY to <casa> could login with email to GLUU server (after 2 minutes) Changed oxTrust ACR to <casa> (now both are casa) could login with email to GLUU server no other changes - I don't get why ?