Error in Custom Ldap Authentication

Hi All,
I was trying to use the custom LDAP authentication( [Earlier Post|http://forums.oracle.com/forums/thread.jspa?threadID=2251976&stqc=true] ) but was not successful in making it work with our AD LDAP server. Thats when I came across post [ http://forums.oracle.com/forums/thread.jspa?messageID=916185&#916185|http://forums.oracle.com/forums/thread.jspa?messageID=916185&#916185]
I used the same function
create or replace function authenticate_aduser(
p_username in varchar2,
p_password in varchar2)
return boolean
is
l_user varchar2(256);
l_ldap_server varchar2(256) := '<Hostname>';
l_domain varchar2(256) := '<Domain Name>';
l_ldap_port number := 389;
l_retval pls_integer;
l_session dbms_ldap.session;
l_cnt number;
begin
l_user := p_username||'@'||l_domain;
l_session := dbms_ldap.init( l_ldap_server, l_ldap_port ); -- start session
l_retval := dbms_ldap.simple_bind_s( l_session, l_user, p_password ); -- auth as user
l_retval := dbms_ldap.unbind_s( l_session ); -- unbind
return true;
exception when others then
l_retval := dbms_ldap.unbind_s( l_session );
return false;
end;Test it by giving correct password
     SQL> declare
begin
if authenticate_aduser('<username>','<correct password>') then
dbms_output.put_line('Test Successful');
else
dbms_output.put_line('Test Failed');
end if;
end; 2 3 4 5 6 7 8
9 /
Test Successful
PL/SQL procedure successfully completed.Tested it by giving wrong password
SQL> declare
begin
if authenticate_aduser('<user name>','<wrong password>') then
dbms_output.put_line('Test Successful');
else
dbms_output.put_line('Test Failed');
end if;
end; 2 3 4 5 6 7 8
9 /
Test Failed
PL/SQL procedure successfully completed.So the fundtion is working perfectly with LDAP server.
I am trying to create a custom authentication scheme with the above function.
Shared Components -> Authentication Schemes -> create ->From Scratch ->
In Autentication Function -> return authenticate_aduser(:P101_USERNAME,:P101_PASSWORD);
In Logout URL -> wwv_flow_custom_auth_std.logout?p_this_flow=&APP_ID.&amp;p_next_flow_page_sess=4155:PUBLIC_PAGE
Then after setting this as the current authentication scheme. Whenever I try to login with correct credentials it is giving me error
Invalid Login Credentials
Kindly let me know were I am going wrong here.
Thanks & Regards,
Vikas Krishna

I was able to fix this.
I used the same function authenticate_aduser
and then followed blog http://www.talkapex.com/2009/03/custom-authentication-status.html to create a custom authentication. It worked finally.
Thanks to Martin for his wonderful post.
Thanks & Regards,
Vikas Krishna

Similar Messages

  • Custom ldap authenticator to retrieve user bean ldap profile

    Hi,
    Wondering if we could use a custom ldap authenticator to get the user profile from Ldap and put the data bean into session.
    This will allow to use the same connection to Ldap and to benefit from Bea security authentication configuration.
    Any input on this ?
    Thank you

    Increasing the search limit is the only practical solution. Really, ~2000 entries is not that many.

  • Error in custom OAM authentication plugin

    Hi All
    I am trying to build a custom OAM authentication plugin using JDeveloper. Here are the version information:
    OAM - 11.1.1.5 BP04
    WLS - 10.3.5
    Issue:
    I get the following error in the OAM logs when I try to activate the plugin.
    [2012-11-14T09:39:17.996-08:00] [oam_server1] [WARNING] [] [oracle.oam.extensibility.lifecycle] [tid: DistributedCache:DistributionCache:EventDispatcher] [userId: <anonymous>] [ecid: 0000Jfzyiy6EgKI5qrH7iY1GcxMc000002,0] [APP: oam_server] Activation failed due to felix bundle exception while installing and starting the bundle.Unresolved constraint in bundle oamCustomAuthPlugin [2]: Unable to resolve 2.0: missing requirement [2.0] package; (package=oracle.security.am.plugin.ExecutionStatus)[[
    org.osgi.framework.BundleException: Unresolved constraint in bundle oamCustomAuthPlugin [2]: Unable to resolve 2.0: missing requirement [2.0] package; (package=oracle.security.am.plugin.ExecutionStatus)
    at org.apache.felix.framework.Felix.resolveBundle(Felix.java:3404)
    The names of jar file, class file, plugin xml file etc are all same. My plugin code is very generic and I have the following values in the plugin's manifest and xml file
    Plugin xml file [oamCustomAuthPlugin.xml]:
    <Plugin name="oamCustomAuthPlugin" type="Authentication">
    <author>uid</author>
    <email>[email protected]</email>
    <creationDate>09:32:20, 2011-11-13</creationDate>
    <version>4</version>
    <description>OAM Custom Authentication plugin</description>
    <interface>oracle.security.am.plugin.authn.AbstractAuthenticationPlugIn</interface>
    <implementation>com.company.oam.oamCustomAuthPlugin</implementation>
    <configuration>
    <AttributeValuePair>
    <Attribute type="string" length="20">INPUT_PARAM1</Attribute>
    <mandatory>true</mandatory>
    <instanceOverride>false</instanceOverride>
    <globalUIOverride>true</globalUIOverride>
    <value>Param1</value>
    </AttributeValuePair>
    <AttributeValuePair>
    <Attribute type="string" length="20">INPUT_PARAM2</Attribute>
    <mandatory>true</mandatory>
    <instanceOverride>false</instanceOverride>
    <globalUIOverride>true</globalUIOverride>
    <value>Param2</value>
    </AttributeValuePair>
    </configuration>
    </Plugin>
    Manifest File [MANIFEST.MF]:
    Ant-Version: Apache Ant 1.7.1
    Bundle-Version: 1.0.0.4
    Bundle-Name: oamCustomAuthPlugin
    Bundle-Activator: oamCustomAuthPlugin
    Bundle-ManifestVersion: 2
    Created-By: 17.0-b17 (Sun Microsystems Inc.)
    Import-Package: oracle.security.am.plugin,oracle.security.am.plugin.authn
    Bundle-SymbolicName: oamCustomAuthPlugin
    Bundle-RequiredExecutionEnvironment: JavaSE-1.6
    Please let me know if you have faced a sinilar issues in the past. Please help !!

    Try with Import-Package: org.osgi.framework;version="1.3.0",oracle.security.am.plugin,oracle.security.am.plugin.authn,oracle.security.am.plugin.api If it doesn't work try with - Import-Package: org.osgi.framework;version="1.3.0",oracle.security.am.plugin,oracle.security.am.plugin.authn,oracle.security.am.plugin.api ,oracle.security.am.plugin.ExecutionStatus

  • ERROR: Ldap Authentication failed for dap during installation of iAS 6.0 SP3

    I am attempting to install ias Enterprise Edition (6.0 SP3) on solaris 2.8 using typical in basesetup. I am trying to install new Directory server as I don't have an existing one.
    During the installation I got the following error.
    ERROR: Ldap Authentication failed for url ldap://hostname:389/o=NetScape Root user id admin (151: Unknown Error)
    Fatal Slapd did not add Directory server information to config Server.
    Warning slapd could'nt populate with ldif file Yes error code 151.
    ERROR:Failure installing iPlanet Directory Server.
    Do you want to continue: ( I entered yes )
    Configuring Administration Server Segmentation fault core dumped.
    Error: Failure installing Netscape Administration Server.
    Do you want to continue:( I responded with yes).
    And during the Extraction I got the following
    ERROR:mple_bind: Can't connect to the LDAP server - No route to host
    ERROR: Unable to connect to LDAP Directory Server
    Hostname: hostname
    Port: 389
    User: cn=Directory Manager
    Password: <password-for-cn=Directory Manager
    Please make sure this Directory Server is currently running.
    You might need to run 'stop-slapd' and then
    'start-slapd' in the Directory Server home directory, in order to restart
    LDAP. When finished, press ENTER to continue, or S to skip this step:
    Start registering Bootstrap EJB...
    javax.naming.NameNotFoundException
    at java.lang.Throwable.fillInStackTrace(Native Method)
    at java.lang.Throwable.fillInStackTrace(Compiled Code)
    at java.lang.Throwable.<init>(Compiled Code)
    at java.lang.Exception.<init>(Compiled > Code)
    at javax.naming.NamingException.<init>(NamingException.java:114)
    at javax.naming.NameNotFoundException.<init>(NameNotFoundException.java: 48)
    at com.netscape.server.jndi.RootContext.resolveCtx(Unknown Source)
    "ldaperror" 76 lines, 2944 characters
    at com.netscape.server.jndi.RootContext.resolveCtx(Unknown Source)
    at com.netscape.server.jndi.RootContext.bind(Unknown Source)
    at com.netscape.server.jndi.RootContext.bind(Unknown Source)
    at javax.naming.InitialContext.bind(InitialContext.java:371)
    at com.netscape.server.deployment.EjbReg.deployToNaming(Unknown Source)
    at com.netscape.server.deployment.EjbReg.registerEjbJar(Compiled Code)
    at com.netscape.server.deployment.EjbReg.registerEjbJar(Compiled Code)
    at com.netscape.server.deployment.EjbReg.run(Compiled Code)
    at com.netscape.server.deployment.EjbReg.main(Unknown Source)
    Start registering iAS 60 Fortune Application...
    Start iPlanet Application Server
    Start iPlanet Application Server
    Start Web Server iPlanet-WebServer-Enterprise/6.0SP1 B08/20/200100:58
    warning: daemon is running as super-user
    [LS ls1] http://gedemo1.plateau.com, port 80 ready
    to accept requests
    startup: server started successfully.
    After completion of installation, I tried to start the console. But I got the following error;
    "Cant connect ot the admin server. The url is not correct or the server is not running.
    Finally,when I started the admintool(iASTT),it shows the iAS1
    was registered( marked with a red cross mark) and says "cant login. make sure the user
    name & passwdord are correct" when i click on it.
    Thanks in advance for any help
    Madhavi

    Hi,
    Make sure that the directory server is installed first. If it is running
    ok, then you can try adding an admin user, please check the following
    technote.
    http://knowledgebase.iplanet.com/ikb/kb/articles/4106.html
    regards
    Swami
    madhavi korupolu wrote:
    I am attempting to install ias Enterprise Edition (6.0 SP3) on
    solaris 2.8 using typical in basesetup. I am trying to install new
    Directory server as I don't have an existing one.
    During the installation I got the following error.
    ERROR: Ldap Authentication failed for url
    ldap://hostname:389/o=NetScape Root user id admin (151: Unknown
    Error)
    Fatal Slapd did not add Directory server information to config
    Server.
    Warning slapd could'nt populate with ldif file Yes error code 151.
    ERROR:Failure installing iPlanet Directory Server.
    Do you want to continue: ( I entered yes )
    Configuring Administration Server Segmentation fault core dumped.
    Error: Failure installing Netscape Administration Server.
    Do you want to continue:( I responded with yes).
    And during the Extraction I got the following
    ERROR:mple_bind: Can't connect to the LDAP server - No route to host
    ERROR: Unable to connect to LDAP Directory Server
    Hostname: hostname
    Port: 389
    User: cn=Directory Manager
    Password: <password-for-cn=Directory Manager
    Please make sure this Directory Server is currently running.
    You might need to run 'stop-slapd' and then
    'start-slapd' in the Directory Server home directory, in order to
    restart
    LDAP. When finished, press ENTER to continue, or S to skip this
    step:
    Start registering Bootstrap EJB...
    javax.naming.NameNotFoundException
    at java.lang.Throwable.fillInStackTrace(Native Method)
    at java.lang.Throwable.fillInStackTrace(Compiled Code)
    at java.lang.Throwable.<init>(Compiled Code)
    at java.lang.Exception.<init>(Compiled > Code)
    at javax.naming.NamingException.<init>(NamingException.java:114)
    at
    javax.naming.NameNotFoundException.<init>(NameNotFoundException.java:
    48)
    at com.netscape.server.jndi.RootContext.resolveCtx(Unknown Source)
    "ldaperror" 76 lines, 2944 characters
    at com.netscape.server.jndi.RootContext.resolveCtx(Unknown Source)
    at com.netscape.server.jndi.RootContext.bind(Unknown Source)
    at com.netscape.server.jndi.RootContext.bind(Unknown Source)
    at javax.naming.InitialContext.bind(InitialContext.java:371)
    at com.netscape.server.deployment.EjbReg.deployToNaming(Unknown
    Source)
    at com.netscape.server.deployment.EjbReg.registerEjbJar(Compiled
    Code)
    at com.netscape.server.deployment.EjbReg.registerEjbJar(Compiled
    Code)
    at com.netscape.server.deployment.EjbReg.run(Compiled Code)
    at com.netscape.server.deployment.EjbReg.main(Unknown Source)
    Start registering iAS 60 Fortune Application...
    Start iPlanet Application Server
    Start iPlanet Application Server
    Start Web Server iPlanet-WebServer-Enterprise/6.0SP1 B08/20/200100:58
    warning: daemon is running as super-user
    [LS ls1] http://gedemo1.plateau.com, port 80 ready
    to accept requests
    startup: server started successfully.
    After completion of installation, I tried to start the console. But I
    got the following error;
    "Cant connect ot the admin server. The url is not correct or the
    server is not running.
    Finally,when I started the admintool(iASTT),it shows the iAS1
    was registered( marked with a red cross mark) and says "cant login.
    make sure the user
    name & passwdord are correct" when i click on it.
    Thanks in advance for any help
    Madhavi
    Try our New Web Based Forum at http://softwareforum.sun.com
    Includes Access to our Product Knowledge Base!

  • Custom DB authentication to an application from Oracle Portal not working.

    Hi All,
    We have a Portal customized and integrated to LDAP for SSO.
    From the portal, we have a link that takes to another custom application that requires another level of authentication. We have implemented this authentication as custom Database based authentication.
    When user login to the portal and access this link, he will be directed for authentication again. This custom application has been installed on a different OC4J instance while Oracle Portal is running in a different OC4J instance.
    Issue is though user details are being propagated to the custom application page, we are receiving an error saying authentication failed.
    In the OC4J instance specific for this custom application, we have configured jazn.xml to use custom authentication.
    Below is the code:
    <?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?>
    <!DOCTYPE jazn PUBLIC "JAZN Config" "http://xmlns.oracle.com/ias/dtds/jazn-9_04.dtd">
    <jazn provider="XML" location="./jazn-data.xml" default-realm="jazn.com">
    <property name="role.mapping.dynamic" value="true"/>
    <property name="custom.loginmodule.provider" value="true"/>
    </jazn>
    and in jazn-data.xml, we gave the role mapping.
    But the problem is when the link to the custom application is accessed, it seems like the custom autentication mechanism is not working.
    Can anyone throw light on this?
    Do we need to give the same configuration in the j2ee/home/config directory files also?
    Can we use both LDAP and custom DB authentication with in the same OAS setup. Remember as of now, Portal and custom application are running in different OC4J instances but within the same OAS.
    Any help in this regard will be highely appreciated.
    Thanks,
    Sasi Bhushan

    Hi All,
    We have a Portal customized and integrated to LDAP for SSO.
    From the portal, we have a link that takes to another custom application that requires another level of authentication. We have implemented this authentication as custom Database based authentication.
    When user login to the portal and access this link, he will be directed for authentication again. This custom application has been installed on a different OC4J instance while Oracle Portal is running in a different OC4J instance.
    Issue is though user details are being propagated to the custom application page, we are receiving an error saying authentication failed.
    In the OC4J instance specific for this custom application, we have configured jazn.xml to use custom authentication.
    Below is the code:
    <?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?>
    <!DOCTYPE jazn PUBLIC "JAZN Config" "http://xmlns.oracle.com/ias/dtds/jazn-9_04.dtd">
    <jazn provider="XML" location="./jazn-data.xml" default-realm="jazn.com">
    <property name="role.mapping.dynamic" value="true"/>
    <property name="custom.loginmodule.provider" value="true"/>
    </jazn>
    and in jazn-data.xml, we gave the role mapping.
    But the problem is when the link to the custom application is accessed, it seems like the custom autentication mechanism is not working.
    Can anyone throw light on this?
    Do we need to give the same configuration in the j2ee/home/config directory files also?
    Can we use both LDAP and custom DB authentication with in the same OAS setup. Remember as of now, Portal and custom application are running in different OC4J instances but within the same OAS.
    Any help in this regard will be highely appreciated.
    Thanks,
    Sasi Bhushan

  • LDAP Authentication Failed :user is not a member in any of the mapped group

    Hi,
    I tried to set up the LDAP Authentication but I failed.
    LDAP Server Configuration Summary seems to be well filled.
    I managed to add a Mapped LDAP member Group: This group appears correctly in the Group list. 
    But itu2019s impossible to create a User. Although this user is a member of the mapped group (checked with LDAP Brower) , an error message is displayed when I tried to create it (There was an error while writing data back to the server: Creation of the user User cannot complete because the user is not a member in any of the mapped groups)
    LDAP Hosts: ldapserverip:389
    LDAP Server Type: Custom
    Base LDAP Distinguished Name: dc=vds,dc=enterprise
    LDAP Server Administration Distinguished Name: CN=myAdminUser,OU=System Accounts,OU=ZZ Group Global,ou=domain1,dc=vds,dc=enterprise
    LDAP Referral Distinguished Name:
    Maximum Referral Hops: 0
    SSL Type: Basic (no SSL)
    Single Sign On Type: None
    CMS Log :
    trace message: LDAP: No such attribute: supportedControl, assuming no ranging support.
    trace message: LDAP: LdapQueryForEntries: QUERY base: dc=vds, dc=enterprise, scope: 2, filter: (samaccountname=KR50162), attribute: dn objectclass
    trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 2453 ms
    trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 1
    trace message: GetParents from plugin for cn=huh\,chen, ou=accounts, ou=users, ou=domain1, dc=vds, dc=enterprise.
    trace message: LDAP: De-activating query cache
    trace message: LDAP: LdapQueryForEntries: QUERY base: , scope: 0, filter: (objectClass=*), attribute: supportedControl
    trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 0 ms
    trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 0
    trace message: LDAP: query for DSE root returned 89
    trace message: LdapQueryForEntries: incr. retries to 1
    trace message: LDAP: Updating the graph
    trace message: LDAP: Starting Graph Update...
    trace message: LDAP: LdapQueryForEntries: QUERY base: , scope: 0, filter: (objectClass=*), attribute: supportedControl
    trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 0 ms
    trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 0
    trace message: LDAP: query for DSE root returned 89
    trace message: LdapQueryForEntries: incr. retries to 1
    trace message: LDAP: LdapQueryForEntries: QUERY base: , scope: 0, filter: (objectClass=*), attribute: supportedControl
    trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 0 ms
    trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 1
    assert failure: (.\ldap_wrapper.cpp:3066). (pSetAttributes : no message).
    trace message: LDAP: No such attribute: supportedControl, assuming no ranging support.
    trace message: LDAP: LdapQueryForEntries: QUERY base: dc=enterprise, scope: 2, filter: (&(cn=gp-asia)(objectclass=group)(member=cn=huh
    , chen, ou=accounts, ou=users, ou=domain1, dc=vds, dc=enterprise)), attribute: objectclass
    trace message: LDAP: LdapQueryForEntries: QUERY base: , scope: 0, filter: (objectClass=*), attribute: supportedControl
    trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 0 ms
    trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 1
    assert failure: (.\ldap_wrapper.cpp:3066). (pSetAttributes : no message).
    trace message: LDAP: No such attribute: supportedControl, assuming no ranging support.
    trace message: LDAP: LdapQueryForEntries: QUERY base: dc=enterprise, scope: 2, filter: (cn=gp-asia), attribute: member objectclass samaccountname cn
    trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 3109 ms
    trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 0
    trace message: LDAP: query for DSE root returned 0
    trace message: Failed to commit user 'KR50162'. Reason: user is not a member in any of the mapped groups.
    trace message: [UID=0;USID=0;ID=79243] Update object in database failed
    trace message: Commit failed.+
    Can you please help?
    Joffrey

    Please do this after you verify all permission settings for all the groups the account is associated with. Also, make sure you check the NTFS folder permissions before doing this as well.
    Since the same result happens on multiple computers, it is not the profile.
    I am recommending you delete the AD account (or rename to backup the account).
    It will not effect the users Exchange account, but you will need to link it back to the new AD user account. 
    You can also delete her profile just to remove it, for the "just in case" scenario.
    Don't forget to mark the post that solved your issue as &quot;Answered.&quot; By marking the Answer you are enabling users with similar issues to find what helped you. Lewis Renwick - IT Professional

  • LDAP authenticator setting in Weblogic 10

    Hi there,
    I am a newbie to weblogic. I am migrating an application from OAS to Weblogic 10. The application is using LDAP for login. I am havng a trouble to set up those users in weblogic console.
    Here is what I did:
    in web.xml:
    <security-constraint>
    <display-name>Example Security Constraint</display-name>
    <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <url-pattern>*</url-pattern>
    <http-method>*</http-method>
    </web-resource-collection>
    <auth-constraint>
    <role-name>UserRole</role-name>
    </auth-constraint>
    </security-constraint>
    <security-role>
    <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>RegularUser</realm-name>
    <form-login-config>
    <form-login-page>/login.jsp</form-login-page>
    <form-error-page>/loginerror.jsp</form-error-page>
    </form-login-config>
    </login-config>
    <role-name>UserRole</role-name>
    </security-role>
    In Weblogic.xml
    <?xml version="1.0" encoding="windows-1252"?>
    <weblogic-web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.bea.com/ns/weblogic/weblogic-web-app http://www.bea.com/ns/weblogic/weblogic-web-app/1.0/weblogic-web-app.xsd" xmlns="http://www.bea.com/ns/weblogic/weblogic-web-app">
    <security-role-assignment>
    <role-name>UserRole</role-name>
    <externally-defined/>
    </security-role-assignment>
    </weblogic-web-app>
    In Weblogic console, I created a new realm called RegularUser and setup LDAP authenticator. User Base DN is ou=axxx,dc=bxxx,dc=cxx. I can see those users already in the user list.
    Did I miss any step?
    Thanks

    Thanks, Faisal.
    Here is my config.xml. Do I need to select Custom Roles at the time of deployment? I manually deployed the application in console.
    <?xml version='1.0' encoding='UTF-8'?>
    <domain xmlns="http://xmlns.oracle.com/weblogic/domain" xmlns:sec="http://xmlns.oracle.com/weblogic/security" xmlns:wls="http://xmlns.oracle.com/weblogic/security/wls" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/weblogic/security/xacml http://xmlns.oracle.com/weblogic/security/xacml/1.0/xacml.xsd http://xmlns.oracle.com/weblogic/security/providers/passwordvalidator http://xmlns.oracle.com/weblogic/security/providers/passwordvalidator/1.0/passwordvalidator.xsd http://xmlns.oracle.com/weblogic/domain http://xmlns.oracle.com/weblogic/1.0/domain.xsd http://xmlns.oracle.com/weblogic/security http://xmlns.oracle.com/weblogic/1.0/security.xsd http://xmlns.oracle.com/weblogic/security/wls http://xmlns.oracle.com/weblogic/security/wls/1.0/wls.xsd">
    <name>myTestDomain</name>
    <domain-version>10.3.3.0</domain-version>
    <security-configuration>
    <name>myTestDomain</name>
    <realm>
    <sec:authentication-provider xsi:type="wls:default-authenticatorType"></sec:authentication-provider>
    <sec:authentication-provider xsi:type="wls:default-identity-asserterType">
    <sec:active-type>AuthenticatedUser</sec:active-type>
    </sec:authentication-provider>
    <sec:authentication-provider xsi:type="wls:ldap-authenticatorType">
    <sec:name>RegularUsers</sec:name>
    <sec:control-flag>OPTIONAL</sec:control-flag>
    <wls:host>holdap1.abc.org</wls:host>
    <wls:user-object-class>user</wls:user-object-class>
    <wls:user-name-attribute>sAMAccountName</wls:user-name-attribute>
    <wls:principal>ldapviewsd</wls:principal>
    <wls:user-base-dn>ou=a,dc=b,dc=c</wls:user-base-dn>
    <wls:credential-encrypted>{AES}5dVfr76v1nSUvb8iMBO5e1WxZG5BA/M3MWZvNxDVMO4=</wls:credential-encrypted>
    <wls:user-from-name-filter>(&amp;(sAMAccountName=%u)(objectclass=user))</wls:user-from-name-filter>
    <wls:group-base-dn>ou=a,dc=b,dc=c</wls:group-base-dn>
    <wls:group-from-name-filter>(&amp;(cn=%g)(objectclass=group))</wls:group-from-name-filter>
    <wls:static-group-object-class>group</wls:static-group-object-class>
    <wls:static-member-dn-attribute>member</wls:static-member-dn-attribute>
    <wls:static-group-dns-from-member-dn-filter>(&amp;(member=%M)(objectclass=group))</wls:static-group-dns-from-member-dn-filter>
    </sec:authentication-provider>
    <sec:role-mapper xmlns:xac="http://xmlns.oracle.com/weblogic/security/xacml" xsi:type="xac:xacml-role-mapperType"></sec:role-mapper>
    <sec:authorizer xmlns:xac="http://xmlns.oracle.com/weblogic/security/xacml" xsi:type="xac:xacml-authorizerType"></sec:authorizer>
    <sec:adjudicator xsi:type="wls:default-adjudicatorType"></sec:adjudicator>
    <sec:credential-mapper xsi:type="wls:default-credential-mapperType"></sec:credential-mapper>
    <sec:cert-path-provider xsi:type="wls:web-logic-cert-path-providerType"></sec:cert-path-provider>
    <sec:cert-path-builder>WebLogicCertPathProvider</sec:cert-path-builder>
    <sec:name>myrealm</sec:name>
    <sec:password-validator xmlns:pas="http://xmlns.oracle.com/weblogic/security/providers/passwordvalidator" xsi:type="pas:system-password-validatorType">
    <sec:name>SystemPasswordValidator</sec:name>
    <pas:min-password-length>8</pas:min-password-length>
    <pas:min-numeric-or-special-characters>1</pas:min-numeric-or-special-characters>
    </sec:password-validator>
    </realm>
    <realm>
    <sec:authentication-provider xsi:type="wls:active-directory-authenticatorType">
    <sec:name>RewardsUser</sec:name>
    <sec:control-flag>SUFFICIENT</sec:control-flag>
    <wls:host>holdap1.abc.org</wls:host>
    <wls:user-name-attribute>sAMAccountName</wls:user-name-attribute>
    <wls:principal>ldapviewsd</wls:principal>
    <wls:user-base-dn>ou=a,dc=b,dc=c</wls:user-base-dn>
    <wls:credential-encrypted>{AES}6mfAIvAqFASMkZ4yHygBe3AODqNyzYyLLePzCI2HTE0=</wls:credential-encrypted>
    <wls:user-from-name-filter>(&amp;(sAMAccountName=%u)(objectclass=user))</wls:user-from-name-filter>
    <wls:group-base-dn>ou=a,dc=bdc=c</wls:group-base-dn>
    <wls:max-sid-to-group-lookups-in-cache>1500</wls:max-sid-to-group-lookups-in-cache>
    </sec:authentication-provider>
    <sec:deploy-role-ignored>false</sec:deploy-role-ignored>
    <sec:deploy-policy-ignored>false</sec:deploy-policy-ignored>
    <sec:deploy-credential-mapping-ignored>false</sec:deploy-credential-mapping-ignored>
    <sec:security-dd-model>CustomRoles</sec:security-dd-model>
    <sec:combined-role-mapping-enabled>true</sec:combined-role-mapping-enabled>
    <sec:name>RewardsUser</sec:name>
    <sec:delegate-m-bean-authorization>false</sec:delegate-m-bean-authorization>
    </realm>
    <default-realm>myrealm</default-realm>
    <credential-encrypted>{AES}AOnncmyo+t9U78VAJHcbv8uiDUVggDlU55WY5xh6NukBIg3m2MK0In76UwCRuKdlVzHp9uWx/4uYZpkVQmq9Hqk3fTRZRx4dIuyU07siwupmYdq1UHttcgTIwqqKoaWn</credential-encrypted>
    <node-manager-username>weblogic</node-manager-username>
    <node-manager-password-encrypted>{AES}Yx0pabvYpXxQr7K7YRVB5B0f3Kyy8Lpn0cu1WQCXve8=</node-manager-password-encrypted>
    </security-configuration>
    <server>
    <name>AdminServer</name>
    <server-debug>
    <debug-scope>
    <name>weblogic.security.atn</name>
    <enabled>true</enabled>
    </debug-scope>
    <debug-scope>
    <name>weblogic.security.atz</name>
    <enabled>true</enabled>
    </debug-scope>
    <debug-security-atn>true</debug-security-atn>
    <debug-security-atz>true</debug-security-atz>
    <debug-security-saml-atn>true</debug-security-saml-atn>
    <debug-security-saml2-atn>true</debug-security-saml2-atn>
    </server-debug>
    <listen-address></listen-address>
    </server>
    <embedded-ldap>
    <name>myTestDomain</name>
    <credential-encrypted>{AES}Iidvc9S3UqScbvwktaeOZMYr4V9BQ4aU/T5z+npeFwiYEzUZi6iLF59pfpCNI0DQ</credential-encrypted>
    </embedded-ldap>
    <configuration-version>10.3.3.0</configuration-version>
    <app-deployment>
    <name>rewards</name>
    <target>AdminServer</target>
    <module-type>ear</module-type>
    <source-path>servers\AdminServer\upload\rewards.ear</source-path>
    <security-dd-model>DDOnly</security-dd-model>
    </app-deployment>
    <admin-server-name>AdminServer</admin-server-name>
    </domain>

  • SSO with Custom LDAP

    This is the landscape :-
    Web Application / Portal at Oracle Web Center Suite (WCS).
    SAP BO 4.0
    Authentication using Custom LDAP & SSO with Trusted Authentication.
    Used OpenLDAP for authentication via RadiantOne VDS as the proxy.
    Activities :
    Authenticate the BO users with OpenLDAP via RadiantOne.
    Synchronize the BO user group from OpenLDAP via RadiantOne.
    Used openDocument.jsp to open WEBI reports.
    Problems :
    We configure the LDAP as Custom. Attributes mapping as default.
    When BOE trying to connect the RadiantOne VDS & create user u201Cuser01u201D which already exists in the OpenLDAP server. It throws the exception :
    "An internal error has occurred in the secLdap plugin.u201D
    When trying to create user that does not exist in LDAP. It throws the exception :
    u201CThe secLdap plugin failed to get the dn for the user notuser.u201D
    Please advise us how to resolved this internal error if we want to SSO with custom LDAP !!
    Thanks & regards,
    Herries E

    Hi,
    Herrie, Roland is correct, OpenLDAP is not supported and you can run into problems if you want to escalate issues in the future. The customer must have that into account.
    However, LDAP is pretty standard and usually you just need to make sure that the attribute mappings is correct.
    Are users correctly created when you map an LDAP group?
    Are you able to manually authenticate using LDAP? You can use the CMC page and select authentication LDAP
    When you have confirmed that LDAP manual authentication is working, you can set up Trusted Authentication. Check first that the system is working just using QUERY_STRING:
    https://service.sap.com/sap/support/notes/1593628
    When trusted auth is confirmed to work, you can configure the parameters that Radiant users to pass the user: cookies, web session, etc.
    Regards,
    Julian

  • SharePoint 2010 with LDAP authentication, using NOVELL eDirectory

    One of my customers needs a SharePoint application that allows people to authenticate with either an Active Directory account (internal staff) or a Novell eDirectory account (external customers).
    Using the following article as a base guide (http://blogs.technet.com/b/speschka/archive/2009/11/05/configuring-forms-based-authentication-in-sharepoint-2010.aspx)
    I configured a claims-based test application that had Windows authentication enabled and Forms based authentication (FBA) enabled (this is on a Windows 2008 server and not a domain controller)
    In the Membership provider name text box I entered "LdapMember"
    In the Role provider name  text box I entered "LdapRole"
    In the web.config for the SharePoint Central Admin, I modified/added the following details right before </system.web>
    <membership>
    <providers>
    <add name="LdapMember"
    type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    userDNAttribute="dn"
    userNameAttribute="cn"
    userContainer="OU=people,O=validobject"
    userObjectClass="person"
    userFilter="(ObjectClass=person)"
    scope="Subtree"
    otherRequiredUserAttributes="sn,givenname,cn" />
    </providers>
    </membership>
    <roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider" >
    <providers>
    <add name="LdapRole"
    type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    groupContainer="OU=people,O=validobject"
    groupNameAttribute="cn"
    groupNameAlternateSearchAttribute="samAccountName"
    groupMemberAttribute="member"
    userNameAttribute="sAMAccountName"
    dnAttribute="distinguishedName"
    groupFilter="((ObjectClass=group)"
    userFilter="((ObjectClass=person)"
    scope="Subtree" />
    </providers>
    </roleManager>
    I modified the SecurityTokenServiceApplication web.config with these details
    <system.web>
    <membership>
    <providers>
    <add name="LdapMemebr"
    type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    userDNAttribute="dn"
    userNameAttribute="cn"
    userContainer="OU=people,O=validobject"
    userObjectClass="person"
    userFilter="(ObjectClass=person)"
    scope="Subtree"
    otherRequiredUserAttributes="sn,givenname,cn" />
    </providers>
    </membership>
    <roleManager enabled="true">
    <providers>
    <add name="LdapRole"
    type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    groupContainer="OU=people,O=validobject"
    groupNameAttribute="cn"
    groupNameAlternateSearchAttribute="samAccountName"
    groupMemberAttribute="member"
    userNameAttribute="sAMAccountName"
    dnAttribute="distinguishedName"
    groupFilter="(&amp;(ObjectClass=group))"
    userFilter="(&amp;(ObjectClass=person))"
    scope="Subtree" />
    </providers>
    </roleManager>
    </system.web>
    I modified the web.config of the test application I created with these details
    <roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">
    <providers>
    <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
    <add name="LdapRole" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    groupContainer="OU=people,O=validobject"
    groupNameAttribute="cn"
    groupNameAlternateSearchAttribute="samAccountName"
    groupMemberAttribute="member"
    userNameAttribute="cn"
    dnAttribute="dn"
    groupFilter="(&amp;(ObjectClass=group))"
    userFilter="(&amp;(ObjectClass=person))"
    scope="Subtree" />
    </providers>
    </roleManager>
    <membership defaultProvider="i">
    <providers>
    <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
    <add name="LdapMember" type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    useDNAttribute="true"
    userDNAttribute="dn"
    userNameAttribute="cn"
    userContainer="OU=people,O=validobject"
    userObjectClass="person"
    userFilter="(ObjectClass=person)"
    scope="Subtree"
    otherRequiredUserAttributes="sn,givenname,cn" />
    </providers>
    </membership>
    With all of this configured, I can go to the new test site, I do see the form where I can choose either Windows authentication or Forms authentication. I can successfully login with Windows authentication, but forms authentication gives me me an error.
    The server could not sign you in. Make sure your user name and password are correct, and then try again.
    I can successfully login to a LDAP management tool, using the same credentials I entered on the form, so I know the username and password being submitted are correct. I get the following items in the event viewer
    8306 - SharePoint Foundation - The security token username and password could not be validated.
    in the SharePoint trace logs - Password check on 'testuser' generated exception: 'System.ServiceModel.FaultException`1[Microsoft.IdentityModel.Tokens.FailedAuthenticationException]: The security token username and password could not be validated. and
    then this:
    Request for security token failed with exception: System.ServiceModel.FaultException: The security token username and password could not be validated.
    at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.ReadResponse(Message response)
    at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst, RequestSecurityTokenResponse& rstr)
    at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst)
    at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForContext(Uri context, Boolean bearerToken, SecurityToken onBehalfOf, SecurityToken actAs, SecurityToken delegateTo)
    I monitored the LDAP server and did a packet-trace on the communication happening between the SharePoint server and the LDAP server and it is a bit odd. It goes like this:
    The SharePoint server successfully connects to the LDAP server, binding the ldapserviceid+password
    The LDAP server tells the SharePoint server it is ready to communicate
    the SharePoint server sends an LDAP query to the LDAP server, asking if the name entered in the form authentication page can be found.
    The LDAP server does the query, successfully finds the entered name and sends a success message back to SharePoint
    The LDAP server sends notification that it is done and is closing the connection that was bound to theldapserviceid+password
    The SharePoint server acknowledges the connection is closing
    ... and then nothing happens, except the error on SharePoint
    What I understand is that the SharePoint server, once it gets confirmation that the submitted username exists in LDAP, should attempt to make a new LDAP connection, bound to the username and password submitted in the form (rather than the LDAP service account
    specified in the web.config). That part does not seem to be happening.
    I am at a standstill on this and any help would be greatly appreciated.

    OK, our problem was resolved by removing any information about the ASP.NET role manager. Initially, we had information about a role manager defined in three different web.config files, as well as in the SharePoint Central Administration site, where there
    is the checkbox to Enable Forms Based Authentication (you see this when you first create the new SharePoint app, or afterwards by modifying the Authentication Provider for the app.) In either case, you will see two text boxes, underneath the checkbox item
    for enabling Forms Based Authentication:
    "ASP.NET Membership provider name"
    "ASP.NET Role manager name"
    We entered a name for Membership provider, and left Role manager blank.
    In the web.config for the SharePoint Central Administration site, the SecurityTokenServiceApplication app, and the web app we created with FBA enabled, we entered the following:
    <membership>
    <providers>
    <add name="LdapMember"
    type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword="validpassword"
    useDNAttribute="false"
    userDNAttribute="dn"
    userNameAttribute="cn"
    userContainer="OU=people,O=validobject"
    userObjectClass="person"
    userFilter="(ObjectClass=person)"
    scope="Subtree"
    otherRequiredUserAttributes="sn,givenname,cn" />
    </providers>
    </membership>
    <roleManager>
    <providers>
    </providers>
    </roleManager>
    useDNAttribute="false" turned out to be important as well.
    So, for us to get LDAP authentication working between SharePoint 2010 and Novel eDirectory, we had to:
    leave anything related to the role provider blank
    configure the web.config in three different applications, with the proper connection information to reach our Novel eDir
    Ensure that useDNAttribute="false" was used in all three on the modified web.config files.
    Since our eDir is flat and used pretty much exclusively for external users, we had never done any sort of advanced role management configuration in eDir. So, by having role manager details in the web.config files, SharePoint was waiting for information from
    a non-existent role manager.

  • LDAP Authentication - Multiple Domains

    I want to be able to use the built in LDAP Authentication scheme to allow authentication against multiple AD Domains... each with it's own separate Host IP/Server, and LDAP DN String. The User ID is formated the same among all Domains, so that is not a concern. I am currently authenticating against one Domain and it scans the tree successfully.
    Host: xx.xx.xx.xx
    DN String: %LDAP_USER%@amer.globalco.net
    (amer.globalco.net is the domain)
    How can this be accomplished? Is it possible all you guru's out there?
    I saw one forum thread discussing how to add a drop down list to the login page, then use the value of the page item in the DN String to specify Domain... That makes sense - HOWEVER - I also have to use a different Host Server / IP address for each domain as well.... Now that is 2 fields that need updating based on one select list.
    I can build the select list using "IP/Domain" - but how do I separate the two data bits in the ITEM Value into their own field values?
    Can I use the ldap_dnprep function to do text editing to create two field values from one ITEM value that I can use in the standard LDAP authentication form fields?
    As you can tell - I am not a SQL/PLSQL person... and I want to avoid creating my own LDAP scheme.
    Please include example/suggested SQL -
    Thanks in advance...
    Rich
    Apex v3.2.1
    Oracle 10G Express

    Based on prior post I had similar question and the result was to write custom auth scheme to read the values from the login page, perform auth against appropriate ldap, then return a valid session to proceed with login in apex app. In our case, the issue was having users is different branch nodes on the same ldap server but not being able to search from a common higher-level branch for some reason...
    Another option you could try, not recommended as it would mean multiple pages to maintain, would be a separate login page per ldap/domain, maybe would even have to multiple apps with just a login page and then redirect to the main app... been a really long time since i've tried anything like it, just giving some options to try.

  • Error while adding LDAP group

    Hi, I configured LDAP authentication on BOXI R2 SP3 on IIS. The settings are as given below.
    To change a setting, click on the value to start the LDAP Configuration Wizard.  I have replaced few entries with XXXX and YYYY due to security.
    LDAP Hosts: nccXXX.XXX.YYYY.XX.YY:636
    LDAP Server Type: Novell eDirectory
    Base LDAP Distinguished Name: ou=XXXXX,dc=YY
    LDAP Server Administration Distinguished Name: cn=XXX,o=YYYYY
    LDAP Referral Distinguished Name: ""
    Maximum Referral Hops: 0
    SSL Type: Server Authentication
    Server Side SSL Strength: Always accept server certificate
    Single Sign On Type: None
    When I add any new group then its not added and I get below error message in the Logging directory  for WCA.
    Error: 2009-08-24 14:56:30, Thread:161, WriteData::_Flush catch unexcepted exception, source: System.Web, message: Specified argument was out of the range of valid values.
    Parameter name: offset, stack:    at System.Web.HttpResponseStream.Write(Byte[] buffer, Int32 offset, Int32 count)
       at BusinessObjects.Enterprise.WebComponentAdapter.WriteData._Flush(IntPtr handle)
    Can anyone help to find if LDAP is configured correctly before adding group?
    Thanks,

    Resolved. It was due to wrong LDAP group given to me.
    Thanks,

  • Open LDAP Authenticator Configuration on WLSSP5

    I have problems in the open LDAP authenticator configuration on Weblogic Server with Service Pack 5. I have users on OpenLDAP Server that do not belong to any group. My LDIF file contents are as given below.
    dn: dc=my-domain,dc=com
    dc: my-domain
    objectClass: dcObject
    objectClass: organization
    o: MYABC, Inc
    dn: cn=Manager, dc=my-domain,dc=com
    userPassword:: c2VjcmV0
    objectClass: person
    sn: Manager
    cn: Manager
    dn: cn=myabcsystem, dc=my-domain,dc=com
    userPassword:: dmVuZGF2b3N5c3RlbQ==
    objectClass: person
    sn: myabcsystem
    cn: myabcsystem
    dn: cn=Philippe, dc=my-domain,dc=com
    userPassword:: UGhpbGlwcGU=
    objectClass: person
    sn: Philippe
    cn: Philippe
    dn: cn=mlrick, dc=my-domain,dc=com
    userPassword:: bWxyaWNr
    objectClass: person
    sn: mlrick
    cn: mlrick
    All these users appear in the Users tab after configuration on the console only if LDAP Server is up. While I select group tab, I get errors indicating BAD SEARCH Filter.
    Inspite of me not having any groups in the ldap as indicated in ldif contents.
    While I try to login t the application with this LDAP configuration, I do not get any errors. LDAP authentication is not happening with just the LDAP authenticator in place. Even if I stop the LDAP server, I do nto get any exceptions while trying ot login. The config params for the Open LADP are as given below
    <weblogic.security.providers.authentication.OpenLDAPAuthenticator
    AllGroupsFilter="objectclass=*"
    Credential="{3DES}rGCpYmhaIorI99BjZ2u6Fg=="
    GroupBaseDN="dc=my-domain,dc=com"
    GroupFromNameFilter="(cn=%u)"
    Name="Security:Name=MYABCAuthenticationOpenLDAPAuthenticator"
    Principal="cn=myabcsystem,dc=my-domain,dc=com"
    Realm="Security:Name=MYABCAuthentication"
    StaticGroupDNsfromMemberDNFilter=""
    StaticGroupNameAttribute="" StaticGroupObjectClass=""
    StaticMemberDNAttribute="" UserBaseDN="dc=my-domain, dc=com"/>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <LDAP ATN LoginModule initialized>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <LDAP Atn Login>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <LDAP Atn Login username: bob>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <getConnection return conn:LDAPConnection { ldapVersion:2 bindDN:""}>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <authenticate user:bob>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <getDNForUser search("ou=people,ou=MYABCAuthentication,dc=myabc", "(&(uid=bob)(objectclass=person))", base DN & below)>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <returnConnection conn:LDAPConnection { ldapVersion:2 bindDN:""}>
    CAN ANYONE HELP ME IDENTIFY WHAT IS THE ISSUE. Why is the authentication not happening?

    Hi Amol,
    I've seen this happen at least two times in 11.1.1.1 installs. You can safely restart and then add the service back again. Suggest you reboot after you re-add the service back or cycle all the Hyperion services.
    I was not aware you could install the service with that command.
    I used the below command instead:
    sc create OpenLDAP-slapd start= auto binPath= "D:\Hyperion\...\slapd.exe service" DisplayName= "Hyperion Shared Services OpenLAP"
    Regards,
    -John

  • LDAP Authentication / User-Role in a database (Weblogic Security)

    Hi,
    I would like to configure the Authentication with an LDAP Server (LDAP Authenticator) and the mapping between users and roles in an external database.
    I saw the following post, http://biemond.blogspot.com/2008/12/using-database-tables-as-authentication.html.
    According to the previous post, I created an LDAP Authenticator (trying to use embedded LDAP) and a SQL Authenticator.
    The problem is that it doesn't uses LDAP Authentication, it only uses SQL Authentication.
    I'm looking for a solution where password would remain in the LDAP Server and the username/role mapping would be in the database tables.
    Consider I'm using WLS 10.3 and JDeveloper 11g.
    Any suggestions?
    Thanks in advance,
    Olga

    Hi,
    Check following forum thread.
    Re: custome role maper example
    Regards,
    Kal

  • Solaris 10 and LDAP Authentication

    Were trying to use LDAP authentication with Solaris 10 accounts and Sun One Java Systems Directory Server 5.2, where there won't be no /etc/passwd or /etc/group user entries, ( only entries for system accounts). The Sun One Java Systems Directory Server 5.2 is on a separate machine from the accounts. Both machines are using Solaris 10.
    I first ran the "idsconfig" utility to setup the VLV indexes, but I received an error on the "automountKey" when it was doing the index processing. It showed that the index processing had failed. All the other indexes were configured successfully. What would cause this?
    My next step is initializing the LDAP Client . Then configure the pam.conf file to use pam_ldap. Finally import all the users into LDAP with the required ObjectClasses and attributes for the authentication process, (posixAccount, shadowAccounts etc.). This also includes adding the automount entries into LDAP, which I'm really not sure how to do that. All of our users paths will be under /export/home/username.
    I'am missing any steps?
    Doese anyone have a step by step guide to use LDAP authentication for Solaris 10 accounts, where LDAP will manage the groups, passwords, automounts for each user?
    Message was edited by:
    automount
    Message was edited by:
    automount

    You may follow:
    http://web.singnet.com.sg/~garyttt/
    http://projects.alkaloid.net/content/view/15/26/
    http://blogs.sun.com/roller/resources/raja/ldap-psd.html
    http://jnester.lunarpages.com/howtos/solaris/howToSolarisLDAPAuth.html
    http://www.thebergerbits.com/unix.shtml
    http://blogs.sun.com/roller/page/baban?entry=steps_to_setup_ssl_using (SSL/TLS steps)
    http://blogs.sun.com/roller/page/rohanpinto?entry=nis_to_ldap_migration_guide (NIS to LDAP migration)
    http://blogs.sun.com/roller/page/anupcs?entry=ldap_related_documentation_at_sun
    (LDAP related docs)
    Gary

  • LDAP AUTHENTICATION- PLEASE HELP

    My client wants me use LDAP for authentication. I new to this: I have written a Authentication bean. As follows.
    //Used to authenticate user from LDAP directry.
    import javax.naming.*;
    import javax.naming.directory.*;
    import java.util.*;
    import java.lang.*;
    public class AuthBean {
         private boolean attempted;
         private String userName;
         private String password;
         public AuthBean() {
              attempted = false;
              userName = "";
              password = "";
         //Getter methods.
         public String getUserName() {
              return this.userName;
         public String getPassword() {
              return this.password;
         //Setter methods.
         public void setUserName (String userName) {
              this.userName = userName;
              if (!this.userName.equals("") && !this.password.equals(""))
              attempted = true;
         else
                   attempted = false;
         public void setPassword(String password) {
              this.password = password;
              if (!this.userName.equals("") && !this.password.equals(""))
                   attempted = true;
              else
                   attempted = false;
         //Checks to see if attempted.
         public boolean isAttempted() {
              return this.attempted;
         * Given a username and password, authenticates to the directory
         * Takes a String for username, String for password.
         * Calls getDn for the method.
         public boolean ldapAuthenticate (String username, String pass) {
              if ( username == null || pass == null ) {
                   System.out.println(" im here in the method");
                   System.out.println(" user" + username);
                   System.out.println(" pass" + pass);
                   return false;
              String dn = getDN(username);
                   System.out.println(" dn" + dn);
                   if ( dn == null)
                   return false;
                   dn = dn + ",o=hcfhe";
                   //dn = dn + ",o=mu";
                   System.out.println(dn);
                   String ldap_url = "ldap://10.1.1.199:389/ou=it,o=hcfhe";
                   //set variables for context
                   Hashtable env = new Hashtable();
                   env.put("com.sun.naming.ldap.trace.ber", System.err);
                   env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
                   env.put(Context.PROVIDER_URL, ldap_url);
                   env.put(Context.SECURITY_AUTHENTICATION, "simple");
                   env.put(Context.SECURITY_PRINCIPAL, dn);
                   env.put(Context.SECURITY_CREDENTIALS, pass);
                   DirContext ctx;
                   //make connection, catch errors thrown
                   try {
                        ctx = new InitialDirContext(env);
                   } catch (AuthenticationException e) {
                             System.out.println("Authentication Exception");
                             return false;
                   } catch (NamingException e) {
                        e.printStackTrace();
                        return false;
              //close connection
              try {
                   ctx.close();
              } catch (NamingException ne) {
                        System.out.println(ne);
              return true;
         * This methods cheks for the username from the LDAP directory.
         * Takes a String.
         public String getDN(String username) {
              String dn = "";
              String ldap_url = "ldap://10.1.1.199:389/ou=it,o=hcfhe";
              Hashtable env = new Hashtable();
              env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
              env.put(Context.PROVIDER_URL, ldap_url);
              DirContext ctx;
              try {
                   ctx = new InitialDirContext(env);
                   SearchControls ctls = new SearchControls();
                   ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);
                   String filter = "(uid=" + username + ")"; // Search for objects with these matching attributes
                   NamingEnumeration results = ctx.search("",filter,ctls);
                   if ( results != null && results.hasMoreElements()) {
                        SearchResult sr = (SearchResult)results.nextElement();
                        dn = sr.getName();
                   } else dn = null;
                             ctx.close();
              } catch (AuthenticationException e) {
                        System.out.println("Authentication Exception");
                        return null;
              } catch (NamingException e) {
                        e.printStackTrace();
                        return null;
                   return dn;
    I also done a validate. jsp as follows.
    <%@page import="register.AuthBean"%>
    <jsp:useBean id ="AuthBean" class="register.AuthBean" scope="session"/>
    <%
              //boolean valid = false;
              String username = request.getParameter("user");
              //System.out.println("The username" + username);
              String password = request.getParameter("password");
              //System.out.println("The username" +password);
    %>
         <jsp:setProperty name="AuthBean" property="userName" param="user" />
         <jsp:setProperty name="AuthBean" property="password" param= "password" />
    <%
                   //boolean validate = false;
                   String nn = AuthBean.getUserName();
                   System.out.println(nn);     
                   String dn = AuthBean.getDN(username);
                   System.out.println(dn);
                   boolean validate = AuthBean.ldapAuthenticate(username, password);
                   if(validate) {
                        response.sendRedirect("../admin/Adminindex.jsp");
                   } else {
                        response.sendRedirect("Login.html");
    %>
    At current I keep getting 'false' for validate. But there are no errors. I m using tomcat and apache, do I need to configure any of these to LDAP. If so can you show me some examples.
    Many thanks.

    Hi Irene,
    I am posting my LDAP Authentication code for you to look at. If you have any more questions, please respond to this posting. I have just three days ago implemented this for my client. It works on Web Sphere against Microsoft Active Directory.
    =====================================================================
    import javax.naming.directory.*;
    import javax.naming.ldap.*;
    import javax.naming.*;
    import java.util.*;
    import java.io.*;
    import java.lang.*;
    import java.math.*;
    * Insert the type's description here.
    * Creation date:
    * @author: Sajjad Alam
    public final class LDAPConn {
         public static java.lang.Object Conn;
    * LDAPConn constructor comment.
    public LDAPConn() {
         super();
    * Insert the method's description here.
    * @return java.lang.Object
    public static DirContext getConn() throws Exception {
         //Declarations of variables
         Hashtable env = new Hashtable(11);
         InitialLdapContext ctx = null;
         //==============LDAP Authentication of a given user stored in Active Directory=============
         System.out.println("Entered constructor for Ldap Context");
         //Initialize the Context Factory.
         env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
         env.put(Context.PROVIDER_URL, "ldap://XXX.XXX.XX.XXX:389/dc=domainURL1,dc=domainURL2,dc=com");
         try {
              The following syntax is a standard way of authenticating users stores in LDAP
              when JNDI api is used.
              env.put(Context.SECURITY_AUTHENTICATION, "simple");
              env.put(Context.SECURITY_PRINCIPAL, "[email protected]");
              env.put(Context.SECURITY_CREDENTIALS, "password");
              System.out.println("Issuing request to authenticate the user and create an LDAP context");
              ctx = new InitialLdapContext(env, null);
              System.out.println("Got handle on Ldap Context");
              //==============Completed Authentication of user=============
              //==============Retrieving attribute data about a user stored in Active Directory==========
              //Here we will retrieve attributes of one of the users in LDAP ("cn=");
              //Declarations of variables
              String userInfo = "cn=someUserName ,ou=Users,ou=something,ou=something";
              Attributes userAttr = ctx.getAttributes(userInfo);
              Attribute orgUnitAttr = null;
              //Looping through the enumeration to obtain attribute data
              for (NamingEnumeration ae = userAttr.getAll(); ae.hasMore();) {
                   Attribute attr = (Attribute) ae.next();
                   if (attr.getID().equals("distinguishedName"))
                        orgUnitAttr = attr;
                   System.out.print(" Attribute: " + attr.getID());
                   //Print each value
                   for (NamingEnumeration e = attr.getAll(); e.hasMore();) {
                        System.out.println(" Value: " + e.next());
              //============== Done retrieving attribute data about user==========
              //==============To find which organizational unit a user belongs provided we pass the user==========
              //This section of code uses the value from the "distinguishedName" attribute
              System.out.println("");
              Object parseOutOrgUnit = (Object) orgUnitAttr;
              System.out.println("We can obtain the organizational unit (Role) from the " + parseOutOrgUnit.toString());
              //======================================Done=============================
              // Close the context when we're done or you can close the connection where you are using this object.
              String grInfo = "CN=Sales-Administrator,OU=Java Application Accounts,OU=something,OU=something";
              Attributes grAttr = ctx.getAttributes(grInfo);
              //Looping through the enumeration to obtain attribute data
              for (NamingEnumeration ae = grAttr.getAll(); ae.hasMore();) {
                   Attribute attr = (Attribute) ae.next();
                   System.out.print(" Attribute: " + attr.getID());
                   //Print each value
                   for (NamingEnumeration e = attr.getAll(); e.hasMore();) {
                        System.out.println(" Value: " + e.next());
              //============== Done retrieving attribute data about user==========
              //==============To find which organizational unit a user belongs provided we pass the user==========
              //This section of code uses the value from the "distinguishedName" attribute
              System.out.println("");
              //======================================Done=============================
              ctx.close();
         catch (Exception e) {
              System.out.println(e.getLocalizedMessage());
         return ctx;

Maybe you are looking for