Authenticate Users Using an LDAP Server

Hi,
I did implement 'Authenticate Users Using an LDAP Server' according the link blow below.
[http://www.oracle.com/technology/products/database/application_express/howtos/how_to_ldap_authenticate.html]
It works OK to specific DN String, example 'cn=%LDAP_USER%,OU=Menahel,OU=Cmp,DC=ho,DC=discount'.
We have a lot of domain rules, mean the users not located at the same DN.
Is it possibale to use general DN string (base root) like 'cn=%LDAP_USER%,*,*,DC=ho,DC=discount?
Thanks in advance,
Shay

Augusto, one thing to check (since it caught me out) is that your LDAP entries conform to the right format, namely
"cn=Bob" etc
When I was integrating HTMLDB LDAP against a Sun One Directory Server, it had me scratching my head for ages, until I realised that the LDAP entries had been created in the format of -
"uid=bob" rather than "cn=bob"
This might not be your problem, but it's worth checking anyway ;)

Similar Messages

Use another LDAP server (OPENLDAP)

Hi:
I really have to use another ldap server than oid... we have an openldap server (ldap v3) under linux and i want urgently to use it with portal...
Anyone here have implemented portal authentication with Openldap under linux ?
Please tell me the way you do it...
thanks

while debugging wwsso_log$, after creating this procedure in portal_sso:
SQL> CREATE OR replace PROCEDURE debug_print (str VARCHAR2) AS
2 PRAGMA autonomous_transaction;
3 BEGIN
4
5 INSERT INTO wwsso_log$ VALUES
6 (wwsso_log_pk_seq.nextval,
7 substr(str, 1, 1000),
8 sysdate,
9 dbms_session.unique_session_id
10 );
11 /
I have saw these exceptions:
PORTALcncn=orcladmin********cn=Login Server (portal_sso),dc=ipb,dc=ptldap.ccom.ipb.pt389
Unknown exception in auth_ldapORA-06520: PL/SQL: Erroao carregar biblioteca externa
ORA-06522: Unable to load DLL
exception: authenticate user
exception authenticate_user: ORA-06520: PL/SQL: Erroao carregar biblioteca externa
ORA-06522: Unable to load DLL
exception generate_redirect: ORA-06520: PL/SQL: Erroao carregar biblioteca externa
ORA-06522: Unable to load DLL
My steps where all done ok:
SQL> create or replace library auth_ext as 'D:\oracle\ora81\bin\ssoxldap.dll';
2 /
Biblioteca criada.
SQL> commit;
Confirmagco conclumda.
The DLL is there:
Directory of D:\oracle\ora81\bin
02-11-00 02:12 48.128 ssoxldap.dll
1 File(s) 48.128 bytes
55.033.856 bytes free
The LSNRCTL is working
D:\oracle\ora81\bin>lsnrctl status extproc_connection_data.sa.ipb.pt
LSNRCTL for 32-bit Windows: Version 8.1.7.3.0 - Production on 17-MAI-2002 17:00:
50
(c) Copyright 1998 Oracle Corporation. All rights reserved.
A ligar a (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC0))(CONNECT_DATA=(SID=PLSExtProc)(PRESENTATION=RO)))
STATUS do LISTENER
Pseud=nimo LISTENER
Verspo TNSLSNR for 32-bit Windows: Version 8.1.7.3.0 - Produc
tion
Data de Infcio 17-MAI-2002 14:23:13
Tempo de funcionamento 0 dias 2 hr. 37 min. 37 seg
Nfvel de Diagn=stico off
Seguranta OFF
SNMP OFF
Fich. Parametros Listener D:\oracle\ora81\network\admin\listener.ora
Fich. Diario do Listener D:\oracle\ora81\network\log\listener.log
Resumo dos Servitos...
PLSExtProc has 1 rotinas de tratamento de servito
dbon has 1 rotinas de tratamento de servico
dbon has 2 rotinas de tratamento de servico
and the LDAPSEARCH is also working:
D:\oracle\ora81\bin>ldapsearch -h ldap.ccom.ipb.pt -p 389 -D cn=orcladmin -b "cn=Login Server (portal_sso),dc=ipb,dc=pt" -v "cn=PORTAL"
ldap_open( ldap.ccom.ipb.pt, 389 )
padrpo de filtro: cn=PORTAL
a devolver: ALL
o filtro T: (cn=PORTAL)
cn=PORTAL, cn=Login Server (portal_sso),dc=ipb,dc=pt
sn=PORTAL
cn=PORTAL
userPassword=xxxxxxxxxx
objectClass=top
objectClass=person
1 correspondencias
What's WRONG ?
Thanks

Make the use of LDAP Server optional

Hi,
we are running an SAP EP 6 SP20 on Windows 2003 Enterprise Server. Our UME Configuration is defined as using an LDAP Server AND the Portal Database. Our portal is mostly used as an information basis used by anonymous access (Guest), some users are able to authenticate themself against the LDAP Server to get more services.
No my question: Is it possible to configure the Portal in that way, that it uses the LDAP Server if available otherwise ignore it and therefore
an authentication of users except the users defined in the portal database is not possible.
At the moment our portal is not available if the LDAP Server is not available our target is to uncouple the strong binding to the LDAP Server.
If the LDAP Server is down or not available no authentication against this UME-Datasource is possible, if available it can be used.
I could not find any parameter or configuration example to configure this behaviour.
The first priority for our portal is being available for information purposes, the second priority is being available for additional services needing authentication.
Is there anyone there having an idea how to solve this?
Regards
Edmund

Hi EG,
As mentioned by GLM above, I share the same view.
One suggestion maybe is to create those users in the Portal UME and then disable your SSO settings in IE (means that your users have to login to Portal). Till you have your LDAP up and running, then re-config your UME seetings in Portal, pointing to your LDAP and have that as your main UME source.
Hope that helps.
Ray

Using an LDAP server as a data source?

I'm evaluating data services and one of our requirements is to be able to retrieve data from an LDAP server. This isn't for authentication.
We store information about users in an LDAP directory. The workflow I'm testing retrieves a customer number from a DB2 database and then retrieves the customer information in the LDAP directory.
Is there a way to do this without having to write a bunch of code? The "import metadata" menu doesn't list LDAP as one of the data providers.
thanks!

There is no point-and-click (Import Data Source Metadata) way to use an LDAP server as a datasource. You have to use the Java Function provided on dev2dev. If you need help with it, please post here.
- Mike

Using IPlanet LDAP Server!!!

Hi, i'm using IPlanet LDAP Server 5.0 and Weblogic 6.0 SP1.
After succeeding in connecting the LDAP server, i want to list all the users
and groups, then the following exception came up. Does anyone know the
reason?
I don't know why we should define the "Users" & "Groups" information when we
try to connect to a LDAP server. Please help me. Thanks!
Exception
weblogic.management.configuration.RealmException: RealmManager.listUsers -
with nested exception:
[weblogic.security.ldaprealm.LDAPException: could not get user list - with
nested exception:
[javax.naming.NameNotFoundException: [LDAP: error code 32 - No Such Object];
remaining name 'dc=crcc,ou=People,cn=eric lu']]
     at
weblogic.management.configuration.RealmManager.listUsers(RealmManager.java:1
63)
     at
weblogic.management.console.pages._domain._usertable._jspService(_usertable.
java:346)
     at weblogic.servlet.jsp.JspBase.service(JspBase.java:27)
     at
weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java
:213)
     at
weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletCo
ntext.java:1265)
     at
weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java
:1622)
     at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:137)
     at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:120)
* Name: Gary Wang
* Tele: 010-65546668-8119
* Mail: [email protected]

When you use the LDAP v1 realms you have to supply four primary sets of information
1) The URL of the LDAP server
2) The principal and credentials you use to bind with ... this will usually be
the distinguished name and user password for a user that is set with administrative
rights
3) The User information that indicates (a) what node to look for users ... for
example ou=People,dc=crcc and (b) the attribute that maps to the login ID (typically,
uid)
4) The Group information that indicates (a) what node to look for groups ... for
exampel ou=Groups,dc=crcc and the attribute in each group that represents the
member dn typically either uniquemember or uniquename
Hope this helps.
"Gary" <[email protected]> wrote:
Hi, i'm using IPlanet LDAP Server 5.0 and Weblogic 6.0 SP1.
After succeeding in connecting the LDAP server, i want to list all the
users
and groups, then the following exception came up. Does anyone know the
reason?
I don't know why we should define the "Users" & "Groups" information
when we
try to connect to a LDAP server. Please help me. Thanks!
Exception
weblogic.management.configuration.RealmException: RealmManager.listUsers
with nested exception:
[weblogic.security.ldaprealm.LDAPException: could not get user list -
with
nested exception:
[javax.naming.NameNotFoundException: [LDAP: error code 32 - No Such Object];
remaining name 'dc=crcc,ou=People,cn=eric lu']]
     at
weblogic.management.configuration.RealmManager.listUsers(RealmManager.java:1
63)
     at
weblogic.management.console.pages._domain._usertable._jspService(_usertable.
java:346)
     at weblogic.servlet.jsp.JspBase.service(JspBase.java:27)
     at
weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java
:213)
     at
weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletCo
ntext.java:1265)
     at
weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java
:1622)
     at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:137)
     at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:120)
* Name: Gary Wang
* Tele: 010-65546668-8119
* Mail: [email protected]

How to use company users on existing ldap server as EP6.0 sp2 Users?

Hi everybody
Our company user data is on a LDAP server we want to connect our EP6 UME to this existing LDAP server so that existing company users can access the Portal with their company id and password. What configuration we should do on the portal ?
thanks and regards
Rajendra

Hi!
Look at Admin Guide:
Administration Guide->Portal Platform->System Administration->User Management Configuration->Configuration of Data Sources Used for User Management->Defining an LDAP Directory as a Data Source
WBR, Lnk

How to enable security with users from an LDAP server

Hello all
My company is using a 10.1.3 Oracle LDAP server and I would like to authenticate users of my application against it.
Can anyone point to the correct documentation?
Thanks in advance
Thanassis

Thanks for your reply
I 've gone through "Introduction to ADF Security in JDeveloper 10.1.3.2" and also Chapter 30 of "Application Development Framework Developer's Guide For Forms/4GL Developers"
There still one thing I cannot understand : Where do I define the mapping between LDAP users and security roles?
THanassis

Authenticate Users against external RADIUS-Server

Hi,
i have some users in the local LDAP database of an 10.5 Server.
Is there a way to store their passwords on an external RADIUS-Server?
Thank you very much,
macservo
Message was edited by: macservo

CryptoCard does this.
We use it at one customer for L2TP VPN authentication.
This way the VPN user get's a yes or no to use the VPN server and then has to give his credentials: name and VPN shared secret or certificate (support for CryptoCard is in the OS X VPN client) to get on the network. The password is in 2 halves, one half is static and the rest is added to it from the Token.
You then have to authenticate to any service you want to use (Kerberos?).
We only had to alter a PPP config file on the OS X server and add a small file to both server (and client) to make it contact their Radius server instead of it using Apples regular internal VPN authentication (not the Radius one). And we had to add a shared secret corresponding to what was setup for the customer at CryptoCard (in the server only) for the OS X Server (Radius client) to CryptoCard server (Radius server) communication. You can't use Server Admin to alter VPN settings afterwards without messing up the PPP settings file.
Maybe possible to us it for Ethernet/Wireless 802.1X authentication too?
For just AFP server auth I don't know.

When WLC authenticate users with secondary RADIUS server?

Hi Sir,
I'm configuring a WLC4404-100. One of the WLANs points to two RADIUS Servers for Authentication and Accounting (please see attached).
I'd like to know, under what circumstances will the WLC authenticate users against the secondary RADIUS Server (in my case, the ACS with IP address 10.200.67.84)?
Please advise.
Thank you.
B.Rgds,
Lim TS

Hi,
I navigated to the following on the WLC:
MANAGEMENT -> SNMP -> Trap Logs
I noticed the following SNMP trap:
Fri Dec 8 11:23:21 2006 No Radius Servers Are Responding
I checked the 2nd ACS server, and true, at around the same time 11:23, the 2nd ACS server was authenticating users.
I checked the 1st ACS server; at around the same time 11:23, there wasn't any service suspension or database replication going on. What's the cause of this WLC authenticating with the 2nd ACS server? The network is robust and I don't expect any latency issue. The two RADIUS servers are serving only wireless users, the number is about 120.
On the WLC, I used the default of 2 seconds Retransmit Timeout for both the RADIUS Authentication Servers. Should I fine-tune it to higher value?
Retransmit Timeout - Specify the time in seconds after which the RADIUS authentication request will timeout and a retransmission will be taken up by the controller. You can specify a value between 2 to 30 seconds.
There are Passed Authentications logged on the 1st ACS server after during & after 11:23. So, I suspect the WLC is doing a kind of load-balancing across the two RADIUS servers.
Please advise.
Thank you.
B.Rgds,
Lim TS

Verify NT User aganist an LDAP Server

Hi,
We would like to authendicate an NT User, running an Applet verified
using LDAP Server.
We would also like to build a SSO (Single Sign ON) based on this.
Can we use JAAS to get the NT user information (using NTLoginModule)
and use BEA JAAS login module to authendicate on the BEA Server?
The LDAP can be configured to the BEA Server (7.0) using the
LDAPRealm.
Have someone tried in these lines before? Any feedbacks ?
Thanks.

Hi Carlo,
Here's a suggestion. Perhaps take a look at "Custom Login Modules" to achieve what you are looking for. There is quite a bit of information on the forums, as well as links to work provided by Frank Nimphius in this area.
You can also consult the Application Server 10.1.3.2.0 book:
"Containers for J2EE Security Guide" for more detailed information.
I hope this helps.
Kenton

Do i need to authenticate when using my mail server

I am trying to send an email using my mail server who i have an account with. When i run the code it returns a connection timed out and could not connect to SMTP host. Do i need to specify my username or password if so how do i do this.
This is my code Thanks in advance
import javax.mail.*;
import javax.mail.internet.*;
import java.util.*;
public class PostMail{
public static void postMail( String subject, String message , String from) throws MessagingException
     String recipients[ ] = {"[email protected]"};
boolean debug = false;
//Set the host smtp address
Properties props = new Properties();
props.put("mail.smtp.host", "mail.btopenworld.com");
// create some properties and get the default Session
Session session = Session.getDefaultInstance(props, null);
session.setDebug(debug);
// create a message
Message msg = new MimeMessage(session);
// set the from and to address
InternetAddress addressFrom = new InternetAddress(from);
msg.setFrom(addressFrom);
InternetAddress[] addressTo = new InternetAddress[recipients.length];
for (int i = 0; i < recipients.length; i++)
addressTo[i] = new InternetAddress(recipients);
msg.setRecipients(Message.RecipientType.TO, addressTo);
// Optional : You can also set your custom headers in the Email if you Want
msg.addHeader("MyHeaderName", "myHeaderValue");
// Setting the Subject and Content Type
msg.setSubject(subject);
msg.setContent(message, "text/plain");
Transport.send(msg);
public static void main(String[] arsg) throws Exception{
     postMail( "Test", "Test", "[email protected]");
     System.out.println("Done");
     System.exit(1);

It depends on your mail server. Most mailservers dont expect you to authenticate while a few do. First, try to telnet to your mail server using the telnet utility.
telnet <mailserver address> <smtp port - 25>
220 blah blah blah...
HELO <your name - dont mind give anything here>
250 blah blah blah....
MAIL FROM <your address>
250 Sender Ok....
RCPT TO <your friend's address>
250 Recipient Ok....
RSET
250 Reset Complete...
QUIT
221 Server closing connection....
If this is not what happens, then your mailserver requires authentication and I dont know how to do it. But from what seems to be the problem, I think you are not able to contact the mail server itself. When you do telnet to mailserver just see how long it takes to connect.

Using external LDAP server for WL JNDI lookups

I'm trying to find out if it is possible to re-direct JNDI calls to the WL
server to an external LDAP server. I know you can install an external LDAP
server for security purposes, but I would like to use an external LDAP
server to handle all JNDI lookups (like for JNDI EJB name location, etc.).
Is this possible?

You typically need to use our JNDI store. We strongly recommend this for
performance reasons..
You can use the JNDI To LDAP bridge which is available from the sun web
site.
Michael Girdley
BEA Systems Inc
"Jack Archer" <[email protected]> wrote in message
news:[email protected]..
I'm trying to find out if it is possible to re-direct JNDI calls to the WL
server to an external LDAP server. I know you can install an external LDAP
server for security purposes, but I would like to use an external LDAP
server to handle all JNDI lookups (like for JNDI EJB name location, etc.).
Is this possible?

Authenticate users using materialised veiw

Hi guys,
I'm wondering if i can authenticate users on login whether or not they exsist in a materialised view?? At the minute im authenticating whether they exist in active directory, but i want to authenticate whether they exist in a materialised view, can i do this so that it display the same error message in the same way.. 'invalid log in credentials' ??
Thanks
Stefan

Just on that note is there anywhere i can find an example of code that check AD groups, at the minute i have a custauthentication function to check if a user exists in LDAP but i havent narrowed it down to specific groups.. is there any hints you can give me or even a link to an example?
cheers guys

Unable to authenticate users using Custom plugins in OAM 11g

We are working on a requirement in which we have to write a custom authentication plugin in OAM 11g.
we were able to import and activate the plugin
we created a new authentication module with steps in the following order
1)UserIdentificationPlugin
2)UserAuthenticationPlugin
3)Our custom plugin to create custom responses(We just created the class with mandatory methods and process method returning success)
but finally when we try to authenticate,authentication fails resulting in OAM-2 error.We had entered valid credentials
Can somebody please help me on resolving this issue.
The plugin code,manifest file and Metadata XML is shared below.
Plugin Code
public class NewPlugin extends AbstractAuthenticationPlugIn {
private static final String CLASS_NAME = "FirstTestClass";
public ExecutionStatus initialize (PluginConfig config){
super.initialize(config);
if(LOGGER.isLoggable(Level.FINE)){
LOGGER.logp(Level.FINE,CLASS_NAME,"initialize","Entering initialize");
return ExecutionStatus.SUCCESS;
@Override
public String getDescription() {
// TODO Auto-generated method stub
return null;
@Override
public Map<String, MonitoringData> getMonitoringData() {
// TODO Auto-generated method stub
return null;
@Override
public String getPluginName() {
// TODO Auto-generated method stub
return null;
@Override
public int getRevision() {
// TODO Auto-generated method stub
return 0;
@Override
public ExecutionStatus process(AuthenticationContext context)
throws AuthenticationException {
if(LOGGER.isLoggable(Level.FINE)){
LOGGER.logp(Level.FINE,CLASS_NAME,"initialize","Entering process");
return ExecutionStatus.SUCCESS;
@Override
public void setMonitoringStatus(boolean arg0) {
// TODO Auto-generated method stub
@Override
public boolean getMonitoringStatus() {
// TODO Auto-generated method stub
return false;
MANIFEST.MF
Manifest-Version: 1.0
Bundle-ManifestVersion: 2
Bundle-Name: NewPlugin Plug-in
Bundle-SymbolicName: NewPlugin
Bundle-Version: 1.0.0
ImportPackage:org.osgi.framework;version="1.3.0",oracle.security.am.plugin,oracle.security.am.plugin.authn,oracle.security.am.plugin.api,oracle.security.am.common.utilities.principal,oracle.security.idm,javax.naming,javax.sql,javax.security.auth
Bundle-RequiredExecutionEnvironment: JavaSE-1.6
METADATA XML
<?xml version="1.0" encoding="UTF-8" ?>
<Plugin name="NewPlugin" type="Authentication">
<author>me</author>
<email>[email protected]</email>
<creationDate>11:40:20,2012-13-02</creationDate>
<version>1</version>
<description>Custom User Authentication Plugin</description>
<interface>oracle.security.am.plugin.authn.AbstractAuthenticationPlugIn</interface>
<implementation>newplugin.NewPlugin</implementation>
<configuration>
<AttributeValuePair>
<Attribute type="String" length="20">DataSource</Attribute>
<mandatory>true</mandatory>
<instanceOverride>false</instanceOverride>
<globalUIOverride>true</globalUIOverride>
<value>jdbc/CISCO</value>
</AttributeValuePair>
</configuration>
</Plugin>

Your search results show that the user "collini" was not found (nentries=0). This could be caused by a number of reasons.
1) The user doesn't exist under "ou=people,dc=our,dc=domain"
2) The user doesn't contain the posixAccount objectclass
3) The user account that performed the search doesn't have access rights to read/search that user account
What user account was used to BIND on the connection that the search was done on?
Try performing the same exact search with an account you know can retrieve the entry. For example:
ldapsearch -D "cn=Directory Manager" -w - -b ou=people,dc=our,dc=domain -s one "(&(objectClass=posixAccount)(uid=collini))"
If the entry doesn't return as a result of the search then either #1 or #2 above is the problem. If the entry does return then #3 is your problem.

Setting up network users using OS X Server: Is there a usable guide somewhere that fully explains how?

I have tried reading through what I can find in Apple’s documentation for OS X Server (as downloaded from the App Store, running on a new OS X 10.9 machine - not an upgrade). And I’ve tried digging through articles on the web and discussions in the forums here.
I still cannot get a working setup for network users hosted on my OS X Server machine.
So, I’m hoping there’s a decent guide somewhere that folks can point me to that covers the entire process, including:
every step involved in setting OS X Server’s various configuration parts (DNS, File Sharing, OD, Users,…),
how to set up the accounts and their file folders on the server,
and every step involved in getting the client machines to use the network accounts to provide user logins.
I’m totally okay with resorting to the command-line if needed.
Ideally, I want:
all of my users’ files (everything in their “home” directories) to be stored on the server.
the users’ to be able to use different machines on our LAN to login.
their names & pictures to show up in the login screen like local users.
From what I’ve seen so far, I’m not optimistic on that last point being doable . However, even if I have to manually add each user in the network login settings on the client machines in order to have their name & picture show up in the login screen, that’s suboptimal, but better than nothing (I have <10 user accounts to worry about, so brute-force is a tolerable option).
Thanks for any direction/tips on this!

I've found apple's guides to be pretty elementary.
OSX Server Essentials, which you can get at amazon is a better basic guide and probably will get you started.
To do anything more advanced, you'll find that apple really has not provided any documentation, but i've found the old series
Enterprise Mac Administrator's Guide
Enterprise Mac Managed Preferences
and
Enterprise Mac Security
to be really useful. I really wish these guys would keep writing books! I'm not sure buying old copies of these texts will offer any encouragement to them, but boy do I hope it does because they have answered a TON of quesions.
For online references, I like:
http://krypted.com/guides/mavericks-server/
This website is at least as good (I'd say twice as good) as the documentation apple provides, and much easier to follow.
http://yesdevnull.net/2013/10/os-x-mavericks-server-open-directory-master/
This website has been incredibly useful for solving all kinds of problems. I can't remember who authors it, but I ought to carry a picture of them around so that I could hug them if I ever saw them on the street. creepy, yes, but so so deserves it.
https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts
For user setup and scripting
Anyway, hope that helps.
I'd start with the krypted guide. Read it twice, then have at it.

Authenticate Users Using an LDAP Server

Similar Messages

Maybe you are looking for