By: Prabhu R user 23 Jun 2015 at 1:27 a.m. CDT

7 Responses
Prabhu R gravatar
We modified "Manage Authentication" to our organization AD, it updated successfully. **CONFIGURATION** Name = source Bind DN = CN=ldap,OU=Service Accounts,DC=org,DC=com Use SSL = false Max Connections = 100 Server = xx.xx.xxx.x:3268 Base DN = OU=Java Team,OU=Org Users,DC=org,DC=com Primary Key = sAMAccountName Local Primary Key = uid But once after that, we tried to login gluu using one of our organization user ldap credentials. It failed with below error log, **ERROR LOGS** 2015-06-23 06:16:20,474 TRACE [org.xdi.oxauth.service.SessionIdService] Found session_id cookie: '5e88b2cd-018e-497b-8164-33b91faeb849' 2015-06-23 06:16:20,477 TRACE [org.xdi.oxauth.service.SessionIdService] Try to get session by id: 5e88b2cd-018e-497b-8164-33b91faeb849 ... 2015-06-23 06:16:20,477 TRACE [org.xdi.oxauth.service.SessionIdService] Session dn: uniqueIdentifier=5e88b2cd-018e-497b-8164-33b91faeb849,ou=session,o=@!EEC7.2AB9.A031.93F7!0001!D39C.D02F,o=gluu 2015-06-23 06:16:20,478 DEBUG [org.xdi.oxauth.service.AuthenticationService] Authenticating user with LDAP: username: anand.c 2015-06-23 06:16:20,478 DEBUG [org.xdi.oxauth.service.AuthenticationService] Attempting to find userDN by primary key: 'sAMAccountName' and key value: 'anand.c' 2015-06-23 06:16:20,478 DEBUG [org.xdi.oxauth.service.AuthenticationService] Getting user information from LDAP: attributeName = 'sAMAccountName', attributeValue = 'anand.c' 2015-06-23 06:16:20,479 ERROR [org.xdi.oxauth.auth.Authenticator] Failed to find entries with baseDN: OU=Java Team,OU=Org Users,DC=org,DC=com, filter: (&(&(objectClass=top))(&(sAMAccountName=anand.c))) org.gluu.site.ldap.persistence.exception.EntryPersistenceException: Failed to find entries with baseDN: OU=Java Team,OU=Org Users,DC=org,DC=com, filter: (&(&(objectClass=top))(&(sAMAccountName=anand.c))) at org.gluu.site.ldap.persistence.LdapEntryManager.findEntries(LdapEntryManager.java:296) at org.gluu.site.ldap.persistence.LdapEntryManager.findEntries(LdapEntryManager.java:253) at org.xdi.oxauth.service.AuthenticationService.getUserByAttribute(AuthenticationService.java:263) at org.xdi.oxauth.service.AuthenticationService.authenticate(AuthenticationService.java:205) at org.xdi.oxauth.service.AuthenticationService.externalAuthenticate(AuthenticationService.java:159) at org.xdi.oxauth.service.AuthenticationService.authenticate(AuthenticationService.java:120) at sun.reflect.GeneratedMethodAccessor1937.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at org.jboss.seam.util.Reflections.invoke(Reflections.java:22) at org.jboss.seam.intercept.RootInvocationContext.proceed(RootInvocationContext.java:32) at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:56) at org.jboss.seam.transaction.RollbackInterceptor.aroundInvoke(RollbackInterceptor.java:28) at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68) at org.jboss.seam.core.BijectionInterceptor.aroundInvoke(BijectionInterceptor.java:77) at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68) at org.jboss.seam.core.MethodContextInterceptor.aroundInvoke(MethodContextInterceptor.java:44) at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68) at org.jboss.seam.intercept.RootInterceptor.invoke(RootInterceptor.java:107) at org.jboss.seam.intercept.JavaBeanInterceptor.interceptInvocation(JavaBeanInterceptor.java:185) at org.jboss.seam.intercept.JavaBeanInterceptor.invoke(JavaBeanInterceptor.java:103) at org.xdi.oxauth.service.AuthenticationService_$$_javassist_seam_39.authenticate(AuthenticationService_$$_javassist_seam_39.java) at org.xdi.oxauth.auth.Authenticator.userAuthenticationInteractive(Authenticator.java:296) at org.xdi.oxauth.auth.Authenticator.authenticateImpl(Authenticator.java:148) at org.xdi.oxauth.auth.Authenticator.authenticate(Authenticator.java:111) at sun.reflect.GeneratedMethodAccessor1936.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at org.jboss.seam.util.Reflections.invoke(Reflections.java:22) at org.jboss.seam.intercept.RootInvocationContext.proceed(RootInvocationContext.java:32) at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:56) at org.jboss.seam.transaction.RollbackInterceptor.aroundInvoke(RollbackInterceptor.java:28) at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68) at org.jboss.seam.core.BijectionInterceptor.aroundInvoke(BijectionInterceptor.java:77) at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68) at org.jboss.seam.core.MethodContextInterceptor.aroundInvoke(MethodContextInterceptor.java:44) at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68) at org.jboss.seam.intercept.RootInterceptor.invoke(RootInterceptor.java:107) at org.jboss.seam.intercept.JavaBeanInterceptor.interceptInvocation(JavaBeanInterceptor.java:185) at org.jboss.seam.intercept.JavaBeanInterceptor.invoke(JavaBeanInterceptor.java:103) at org.xdi.oxauth.auth.Authenticator_$$_javassist_seam_43.authenticate(Authenticator_$$_javassist_seam_43.java) at sun.reflect.GeneratedMethodAccessor1935.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:335) at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:348) at org.jboss.el.parser.AstPropertySuffix.invoke(AstPropertySuffix.java:58) at org.jboss.el.parser.AstValue.invoke(AstValue.java:96) at org.jboss.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:276) at com.sun.facelets.el.TagMethodExpression.invoke(TagMethodExpression.java:68) at javax.faces.component.MethodBindingMethodExpressionAdapter.invoke(MethodBindingMethodExpressionAdapter.java:88) at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:102) at javax.faces.component.UICommand.broadcast(UICommand.java:387) at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:475) at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:756) at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:82) at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100) at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:118) at javax.faces.webapp.FacesServlet.service(FacesServlet.java:265) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:748) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:486) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:411) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:338) at org.jboss.seam.web.RewriteFilter.process(RewriteFilter.java:98) at org.jboss.seam.web.RewriteFilter.doFilter(RewriteFilter.java:57) at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) at org.jboss.seam.web.LoggingFilter.doFilter(LoggingFilter.java:60) at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:73) at org.jboss.seam.web.IdentityFilter.doFilter(IdentityFilter.java:40) at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) at org.jboss.seam.web.MultipartFilter.doFilter(MultipartFilter.java:90) at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) at org.jboss.seam.web.ExceptionFilter.doFilter(ExceptionFilter.java:64) at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) at org.jboss.seam.web.RedirectFilter.doFilter(RedirectFilter.java:45) at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69) at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:73) at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408) at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:190) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:745) Caused by: LDAPSearchException(resultCode=32 (no such object), numEntries=0, numReferences=0, errorMessage='The entry OU=Java Team,OU=Org Users,DC=org,DC=com specified as the search base does not exist in the Directory Server') at com.unboundid.ldap.sdk.LDAPConnection.search(LDAPConnection.java:3112) at com.unboundid.ldap.sdk.AbstractConnectionPool.search(AbstractConnectionPool.java:1865) at org.gluu.site.ldap.OperationsFacade.search(OperationsFacade.java:204) at org.gluu.site.ldap.OperationsFacade.search(OperationsFacade.java:182) at org.gluu.site.ldap.persistence.LdapEntryManager.findEntries(LdapEntryManager.java:291) ... 99 more 2015-06-23 06:16:20,481 INFO [org.xdi.oxauth.auth.Authenticator] Authentication failed for 'anand.c' 2015-06-23 06:16:20,488 TRACE [org.xdi.oxauth.service.ClientService] Get client from cache by Dn 'inum=@!EEC7.2AB9.A031.93F7!0008!72C3.8BD1,ou=clients,o=@!EEC7.2AB9.A031.93F7!0001!D39C.D02F,o=gluu' 2015-06-23 06:16:20,488 DEBUG [org.xdi.oxauth.service.ClientService] Found 1 entries for client id = @!EEC7.2AB9.A031.93F7!0008!72C3.8BD1 2015-06-23 06:16:20,491 TRACE [org.xdi.oxauth.service.ClientService] Get client from cache by Dn 'inum=@!EEC7.2AB9.A031.93F7!0008!72C3.8BD1,ou=clients,o=@!EEC7.2AB9.A031.93F7!0001!D39C.D02F,o=gluu' 2015-06-23 06:16:20,491 DEBUG [org.xdi.oxauth.service.ClientService] Found 1 entries for client id = @!EEC7.2AB9.A031.93F7!0008!72C3.8BD1 2015-06-23 06:16:20,491 TRACE [org.xdi.oxauth.service.ClientService] Get client from cache by Dn 'inum=@!EEC7.2AB9.A031.93F7!0008!72C3.8BD1,ou=clients,o=@!EEC7.2AB9.A031.93F7!0001!D39C.D02F,o=gluu' 2015-06-23 06:16:20,492 DEBUG [org.xdi.oxauth.service.ClientService] Found 1 entries for client id = @!EEC7.2AB9.A031.93F7!0008!72C3.8BD1 2015-06-23 06:16:37,004 TRACE [org.xdi.service.custom.script.CustomScriptManager] Last finished time '6/23/15 6:16 AM' ^C

By Mohib Zico staff 23 Jun 2015 at noon CDT

Mohib Zico gravatar
>> 2015-06-23 06:16:20,479 ERROR [org.xdi.oxauth.auth.Authenticator] Failed to find entries with baseDN: OU=Java Team,OU=Org Users,DC=org,DC=com, filter: (&(&(objectClass=top))(&(sAMAccountName=anand.c))) There might be two issues... either 'sAMAccountName=anand.c' is not available under 'OU=Java Team,OU=Org Users,DC=org,DC=com' tree or 'OU=Java Team,OU=Org Users,DC=org,DC=com' is not readable.

By Prabhu R user 23 Jun 2015 at 7:53 p.m. CDT

Prabhu R gravatar
Using OpenDJ ldapsearch, I could able to query the exact person and read his information from the gluu-server terminal. I hope opendj is what gluu uses as LDAP, right?? I used, /opt/opendj/bin/ldapsearch {query}

By Mohib Zico staff 24 Jun 2015 at 2:13 a.m. CDT

Mohib Zico gravatar
Ok, then find out the second assumption...... *or 'OU=Java Team,OU=Org Users,DC=org,DC=com' is not readable by your BindDN user*

By Prabhu R user 24 Jun 2015 at 6:41 a.m. CDT

Prabhu R gravatar
That is readable. we tried with admin CN also. It throws the same error log as quoted before. 2015-06-23 06:16:20,479 ERROR [org.xdi.oxauth.auth.Authenticator] Failed to find entries with baseDN: OU=Java Team,OU=Org Users,DC=org,DC=com, filter: (&(&(objectClass=top))(&(sAMAccountName=anand.c))) org.gluu.site.ldap.persistence.exception.EntryPersistenceException: Failed to find entries with baseDN: OU=Java Team,OU=Org Users,DC=org,DC=com, filter: (&(&(objectClass=top))(&(sAMAccountName=anand.c)))

By Mohib Zico staff 24 Jun 2015 at 6:54 a.m. CDT

Mohib Zico gravatar
Well... if everything is okay from your AD side; we have nothing to say. Because this type of error comes up when there is mismatch/some issues between the AD information you provided in Gluu Server and your actual AD tree structure and credential. We faced such issue hundred times for our customer's identity mapping and that's where the problem was.

By Prabhu R user 24 Jun 2015 at 7:25 a.m. CDT

Prabhu R gravatar
So how could it be resolved?

By Mohib Zico staff 24 Jun 2015 at 7:32 a.m. CDT

Mohib Zico gravatar
>> There might be two issues... either 'sAMAccountName=anand.c' is not available under 'OU=Java Team,OU=Org Users,DC=org,DC=com' tree or 'OU=Java Team,OU=Org Users,DC=org,DC=com' is not readable. This is how it can resolved. And I am sure that problem is here.