Final Cut Server & Active Directory authentication
Hi all,
This is an older question that was not be answered in the past.
I have a Xserve with Mac OS X server 10.5.6, running Final Cut Server 1.1.1 and a Windows 2003 AD server with hundreds of users.
The issue is FCS is not authenticating against AD even though clients can do it, being binded with Directory Utility without trouble.
Could somebody tell me if is this a known issue?
Did somedody make it work?
Thanks
Same problem here. We couldn't make it work, that is login to FCS using AD users.
Don't remember where but I was reading about it in a forum, somebody said that they talk to someone in Apple and they told him this is a problem and that they were going to fix it in the next FCS update/release.
Hope they do
PS: De donde sos nono??
Similar Messages
-
OS X Server + Active Directory Authentication Issue with Wikis
Hello,
I recently purchased an Apple XServe with Snow Leopard installed. The purpose of this server is to enable students and teachers to create Wikis and Blogs.
The majority of my environment is MS, with Active Directory as our LDAP provider.
I have joined the server to my domain and can add domain accounts to the Wiki creation access list without issue, but whenever I try to login to the server's web interface with one of those accounts the login screen shakes and prompts for another set of credinitals.
What am I doing wrong? Open Directory seems to be setup properly and has been kerberitized as it requested when I joined the box to the domain.
Thank you all for your help,
David
Message was edited by: DHeath_WJCCplease ask in the Snow leopard server forum
http://discussions.apple.com/category.jspa?categoryID=96 -
Integrating Final Cut Server 1.5 with Active Directory
Following the directions in the Final Cut Server Setup Guide and I am running into errors. Fun with Final Cut Server. Fun with Kerberos.
Final Cut Server v.1.5 is running on an Intel Xserve running 10.5.6 Server, joined to AD. Active Directory is running on a Windows Server 2008 setup.
I dropped the ini files on the domain controllers, as directed by Apple KB (http://support.apple.com/kb/HT3688) and I ran the commands directed in the setup guide.
The adprincadd command should be run literally, of course, but there's a mistake straight-away when it should read "./adprincadd.pl", the ".pl" is missing. Also it says "fcsvr/fqdn of fcsvr", so naturally I replaced the fqdn, but the "fcsvr" prefixed threw me off. It gave me errors until I opened Kerberos.app and notcied that the kerb ticket was in ldap/, then the command worked for me. At least no errors, until I checked the ticket and it said I had no permissions and that the keytab entry was invalid. Wheeee.
1. First I tried:
(some info redacted)
node09:sbin root# ./adprincadd.pl -dc dc01.example.com. fcs.example.com.
Getting kerberos principal for computer account
Kerberos principal is ---
Getting computer id...---
Getting AD Domain...---
Base DN is dc=example,dc=com
getting kerb ticket using [email protected] got ticket
SASL-bind to dc01.example.com. successful
Computer record is at CN=---,CN=Computers,DC=example,DC=com
Checking to see if ---.--.---. exists...000020B5: AtrErr: DSID-031529F7, #1:
0: 000020B5: DSID-031529F7, problem 1005 (CONSTRAINTATTTYPE), data 0, Att 90303 (servicePrincipalName)
at ./adprincadd.pl line 165
2. Then I noticed the /ldap in Kerberos.app and changed the adprinadd command:
Everything ran well, with no errors...
Finding kvno...2
Reading /etc/krb5.keytab...done.
Creating new keytab file...done.
Writing out temporary keytab...done.
Making backup of old keytab and moving new keytab into place...done.
Operation Completed. You can verify with "kinit <ad user>; kvno -k /etc/krb5.keytab ldap/---.example.com"
3. Verifying with kinit gave me the keytab errors:
kinit matx; kvno -k /etc/krb5.keytab ldap/fcs.example.com
Please enter the password for [email protected]:
ldap/[email protected]: kvno = 2, keytab entry invalid
kvno: Permission denied while decrypting ticket for 'ldap/[email protected]'
Thoughts?Hello, I'm having issues with the client login after AD integration. I followed the steps from http://support.apple.com/kb/HT3818 and the Terminal output reported a success.
I'm able to add AD groups in Final Cut Server Group Permissions. However, when I try logging in on the FCServer client using credentials associated with AD group I've added, I'm getting an error message from the client stating:
"Please re-enter the username and password or contact the server administrator. Please note that the username and password are case-sensitive."
The FQDN is correct in the Server field of the client.
I'm able to log into the client using locally created user accounts that I've created on the server so I know the client is communicating correctly.
The only thing I can find in the Console for the client machine is this:
11/25/09 10:50:12 AM /Users/*/Desktop/Final Cut Server.app/Contents/MacOS/Final Cut Server[1773] Warning: accessing obsolete X509Anchors.
In the server Console, this is a suspect message: /Library/Application Support/Final Cut Server/Final Cut Server.bundle/Contents/MacOS/fcsvr_stored[77891] pps proxy error: dsDoDirNodeAuth = -14091
Not finding much info out there regarding this. Any guidance is appreciated. -
Active Directory logins from Windows to Final Cut Server
While I did manage to solve my main problem with Integrating AD with Final Cut Server at this one site.... It turns out that there a typo in the kerberos config file. Ooops. Now logins in from Mac OS using AD credentials works well. Unfortunately, I am still seeing some minor issues, like certain groups in AD not being able to login, and for some reason the Windows users can't login (only the Macs using AD credentials). Any seeing anything like this? Of course I enabled certain groups in Final Cut Server pref pane to match certain AD groups, but in the end only the BuiltIn groups worked, not the Domain Users, Domain Admin groups. Strange. And not sure why Windows users can't login. Same domain. Fun times.
It seems like I read the inital Kb article wrong. The Windows clients get the krb5.ini file, not the Domain Controller. LOL. Thanks to drew for pointing that out to me.
http://support.apple.com/kb/HT3688
In order for Active Directory bound Windows Final Cut Server client systems to successfully authenticate to Final Cut Server, you must create a custom Kerberos configuration file on the Windows client system. -
WLS 7.0 Active Directory authenticator - problems starting managed server (Solaris 8)
Has anyone managed to setup a WLS 7.0 Active Directory authenticator and booted
a managed server using the node manager? I can boot the server without the AD
authenticator and I can also boot the server using a script and successfully authenticate
through AD. My AD control flag is set to OPTIONAL and I have also setup a default
authenticator to boot weblogic - the control flag here is set to SUFFICIENT. This
configuration works fine with weblogic running on W2K, but not on Solaris (it
looks like the control flag is being ignored). Errors as follows
####<Oct 1, 2002 1:59:08 PM BST> <Info> <Logging> <mymachine> <server01> <main>
<kernel identity> <> <000000> <FileLo
gger Opened at /opt/app/live/appserver/domains/test/NodeManager/server01/server01.log>
####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01> <main>
<kernel identity> <> <000415> <System
has file descriptor limits of - soft: 1,024, hard: 1,024>
####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01> <main>
<kernel identity> <> <000416> <Using e
ffective file descriptor limit of: 1,024 open sockets/files.>
####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01> <main>
<kernel identity> <> <000418> <Allocat
ing: 3 POSIX reader threads>
####<Oct 1, 2002 1:59:19 PM BST> <Critical> <WebLogicServer> <mymachine> <server01>
<main> <kernel identity> <> <0003
64> <Server failed during initialization. Exception:weblogic.security.service.SecurityServiceRuntimeException:
Problem instantiating
Authentication Providerjavax.management.RuntimeOperationsException: RuntimeException
thrown by the getAttribute method of the Dynam
icMBean for the attribute Credential>
weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
Authentication Providerjavax.management.RuntimeOper
ationsException: RuntimeException thrown by the getAttribute method of the DynamicMBean
for the attribute Credential
at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
at weblogic.Server.main(Server.java:31)
####<Oct 1, 2002 1:59:19 PM BST> <Emergency> <WebLogicServer> <mymachine> <server01>
<main> <kernel identity> <> <000
342> <Unable to initialize the server: Fatal initialization exception
Throwable: weblogic.security.service.SecurityServiceRuntimeException: Problem
instantiating Authentication Providerjavax.management.
RuntimeOperationsException: RuntimeException thrown by the getAttribute method
of the DynamicMBean for the attribute Credential
weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
Authentication Providerjavax.management.RuntimeOper
ationsException: RuntimeException thrown by the getAttribute method of the DynamicMBean
for the attribute Credential
at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
at weblogic.Server.main(Server.java:31)Solved the problem. The 'domain root' directory specified in the remote start configuration,
must contain a copy of the file 'SerializedSystemIni.dat' that was created along
with the domain, in order to boot when an AD authenticator is configured. If an
AD authenticator is not configured, no file is required. This was not a platform
specific issue; on Win2K I had configured the 'domain root' remote start parameter
to point to an existing domain root and not a new directory.
"Andrew Walker" <[email protected]> wrote:
>
Has anyone managed to setup a WLS 7.0 Active Directory authenticator
and booted
a managed server using the node manager? I can boot the server without
the AD
authenticator and I can also boot the server using a script and successfully
authenticate
through AD. My AD control flag is set to OPTIONAL and I have also setup
a default
authenticator to boot weblogic - the control flag here is set to SUFFICIENT.
This
configuration works fine with weblogic running on W2K, but not on Solaris
(it
looks like the control flag is being ignored). Errors as follows
####<Oct 1, 2002 1:59:08 PM BST> <Info> <Logging> <mymachine> <server01>
<main>
<kernel identity> <> <000000> <FileLo
gger Opened at /opt/app/live/appserver/domains/test/NodeManager/server01/server01.log>
####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01>
<main>
<kernel identity> <> <000415> <System
has file descriptor limits of - soft: 1,024, hard: 1,024>
####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01>
<main>
<kernel identity> <> <000416> <Using e
ffective file descriptor limit of: 1,024 open sockets/files.>
####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01>
<main>
<kernel identity> <> <000418> <Allocat
ing: 3 POSIX reader threads>
####<Oct 1, 2002 1:59:19 PM BST> <Critical> <WebLogicServer> <mymachine>
<server01>
<main> <kernel identity> <> <0003
64> <Server failed during initialization. Exception:weblogic.security.service.SecurityServiceRuntimeException:
Problem instantiating
Authentication Providerjavax.management.RuntimeOperationsException:
RuntimeException
thrown by the getAttribute method of the Dynam
icMBean for the attribute Credential>
weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
Authentication Providerjavax.management.RuntimeOper
ationsException: RuntimeException thrown by the getAttribute method of
the DynamicMBean
for the attribute Credential
at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
at weblogic.Server.main(Server.java:31)
####<Oct 1, 2002 1:59:19 PM BST> <Emergency> <WebLogicServer> <mymachine>
<server01>
<main> <kernel identity> <> <000
342> <Unable to initialize the server: Fatal initialization exception
Throwable: weblogic.security.service.SecurityServiceRuntimeException:
Problem
instantiating Authentication Providerjavax.management.
RuntimeOperationsException: RuntimeException thrown by the getAttribute
method
of the DynamicMBean for the attribute Credential
weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
Authentication Providerjavax.management.RuntimeOper
ationsException: RuntimeException thrown by the getAttribute method of
the DynamicMBean
for the attribute Credential
at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
at weblogic.Server.main(Server.java:31) -
Can't login to Final Cut Server with AD group...
I just setup the Final Cut server and I also linked it to Active Directory so we could use the groups on it. I opened up the preferences and added a group to that from AD and then set them with admin. However, when I login with a user who is a member of that group it won't let me in. The only user I can get on with is the local admin. Does anyone know how I can use the members of the AD group so if their password changes or the group membership changes I don't always have to go and update it?
now when I run:
./adprincadd.pl -dc <fully qualified hostname of AD server> fcsvr/<fully qualified hostname of FCSVR machine>
I get:
No Kerberos TGT!
You must have kerberos ticket that allows writing to the computer record in AD. Use kinit to get a ticket
but kinit give me: Cannot find KDC for requested realm
How can I correct this so I can get the kerberos ticket and resolve this? -
Final cut server not serving java client application
weird situation. today i went to download the java client for final cut server 1.5.1 at my normal address and the webpage came up welcome.. with the ability to download the client application as normal but when i pressed the button to download nothing happened.
anyone have any ideas how to resolve this? manually removed all of the client java cache on the client machine and also reinstalled fcs 1.5.1 on the server with a restore of the database without any change in functionality. any ideas?hello ben,
thanks for taking your time to help me with the issue i am seeing here. I will do my best to read into what you said and explain.
1. Network User Permissions Problems.
maybe you can explain, but i have not authenticated against anything at this point, just went to the normal.. "http://FQDN/finalcutserver"... the normal fcserver webpage comes up but when i click download it does not give me the ability to download the java applet or run a script that maybe delivers the java applet.
maybe i am not understanding, but what about what i am experiencing looks like a permission issue? permission for fcserver to distribute the java applet to a user who goes to the final cut server web page to download the client?
If that is the case, would you know where to start looking for permission issues?
2. Verfy the web server services and comb through the user permissions and services on the server.
The web services, service is on and when i look at the logs with any reference of final cut server, this is what i see right after when i try to download the client app.
File does not exist:/Library/WebServer/Documents/FinalCutServer, referer: http://FQDN/~localadmin/webstart/content.php
as far as the user permissions, what should i look for? there are very few users, the local admin, the open directory admin and 1 other user in od.
with regard to services running on server 10.6.1 and how they affect final cut server.. checked use of how i would use AFP, DNS lookups, OpenDirectory & network homes, and Web services and appear to be working as far as i can tell.
hope the above information helps. thanks in advance for helping troubleshoot. -
BO XI 3.1 : Active Directory Authentication failed to get the Active Directory groups
Dear all
In our environment, there are 2 domain (domain A and B); it works well all the time. Today, all the user belong to domain A are not logi n; for user in domain B, all of them can log in but BO server response is very slowly. and there is error message popup when opening Webi report for domain B user. Below are the error message:
" Active Directory Authentication failed to get the Active Directory groups for the account with ID:XXXX; pls make sure this account is valid and belongs to an accessible domain"
Anyone has encountered similar issue?
BO version: BO XI 3.1 SP5
Authenticate: Windows AD
Thanks and RegardsPlease get in touch with your AD team and verify if there are any changes applied to the domain controller and there are no network issues.
Also since this is a multi domain, make sure you have 2 way transitive forest trust as mentioned in SAP Note : 1323391 and FQDN for Directory servers are maintained in registry as per 1199995
http://service.sap.com/sap/support/notes/1323391
http://service.sap.com/sap/support/notes/1199995
-Ambarish- -
Weblogic with Active Directory Authentication provider problem: DN for user ....: null
I have a java application (SSO via SAML2) that uses Weblogic as a Identity Service Provider. All works well using users created directly in Weblogic. However, I need to add support for Active Directory. So, as per documentation:
- I defined an Active Directory Authentication provider
- changed it's order in the Authentication Providers list so that it comes first
- set the control flag to SUFFICIENT and configured the Provider Specific; here's the concerned part in config.xml:
<sec:authentication-provider xsi:type="wls:active-directory-authenticatorType">
<sec:name>MyOwnADAuthenticator</sec:name>
<sec:control-flag>SUFFICIENT</sec:control-flag>
<wls:propagate-cause-for-login-exception>true</wls:propagate-cause-for-login-exception>
<wls:host>10.20.150.4</wls:host>
<wls:port>5000</wls:port>
<wls:ssl-enabled>false</wls:ssl-enabled>
<wls:principal>CN=tadmin,CN=wl,DC=at,DC=com</wls:principal>
<wls:user-base-dn>CN=wl,DC=at,DC=com</wls:user-base-dn>
<wls:credential-encrypted>{AES}deleted</wls:credential-encrypted>
<wls:cache-enabled>false</wls:cache-enabled>
<wls:group-base-dn>CN=wl,DC=at,DC=com</wls:group-base-dn>
</sec:authentication-provider>
I configured a AD LDS instance(Active Directory Lightweight Directory Services) on a Windows Server 2008 R2. I created users and one admin user "tadmin" which was added to Administrators members. I also made sure to set msDS-UserAccountDisabled property to FALSE.
After restarting Weblogic I can see that the AD LDS's users and groups are correctly fetched in Weblogic. But, when I try to connect with my application, using Username:tadmin and Password:<...> it does not work.
Here's what I see in the log file:
<BEA-000000> <LDAP Atn Login username: tadmin>
<BEA-000000> <authenticate user:tadmin>
<BEA-000000> <getConnection return conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
<BEA-000000> <getDNForUser search("CN=wl,DC=at,DC=com", "(&(&(cn=tadmin)(objectclass=user))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))", base DN & below)>
<BEA-000000> <DN for user tadmin: null>
<BEA-000000> <returnConnection conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
<BEA-000000> <getConnection return conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
<BEA-000000> <getDNForUser search("CN=wl,DC=at,DC=com", "(&(&(cn=tadmin)(objectclass=user))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))", base DN & below)>
<BEA-000000> <DN for user tadmin: null>
<BEA-000000> <returnConnection conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
<BEA-000000> <javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User tadmin denied
at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:229)
at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
So, I tried to look why do I have: <DN for user tadmin: null>. Using Apache Directory Studio I reproduced the ldap search request used in Weblogic and, sure enough, I get no results. But, changing the filter to only "(&(cn=tadmin)(objectclass=user))" (NOTICE, no userAccountControl), it works; here's the result from Apache Directory Studio:
#!SEARCH REQUEST (145) OK
#!CONNECTION ldap://10.20.150.4:5000
#!DATE 2014-01-23T14:52:09.324
# LDAP URL : ldap://10.20.150.4:5000/CN=wl,DC=at,DC=com?objectClass?sub?(&(cn=tadmin)(objectclass=user))
# command line : ldapsearch -H ldap://10.20.150.4:5000 -x -D "[email protected]" -W -b "CN=wl,DC=at,DC=com" -s sub -a always -z 1000 "(&(cn=tadmin)(objectclass=user))" "objectClass"
# baseObject : CN=wl,DC=at,DC=com
# scope : wholeSubtree (2)
# derefAliases : derefAlways (3)
# sizeLimit : 1000
# timeLimit : 0
# typesOnly : False
# filter : (&(cn=tadmin)(objectclass=user))
# attributes : objectClass
#!SEARCH RESULT DONE (145) OK
#!CONNECTION ldap://10.20.150.4:5000
#!DATE 2014-01-23T14:52:09.356
# numEntries : 1
(the "[email protected]" is defined as userPrincipalName in the tadmin user on AD LDS)
As you can see, "# numEntries : 1" (and I can see as result the entry "CN=tadmin,CN=wl,DC=at,DC=com" in Apache Directory Studio's interface); if I add the userAccountControl filter I get 0.
I've read that the AD LDS does not use userAccountControl but "uses several individual attributes to hold the information that is contained in the flags of the userAccountControl attribute"; among those attributes is msDS-UserAccountDisabled which, as I said, I already set to FALSE.
So, my question is, how do I make it work? Why do I have "<DN for user tadmin: null>" ? Is it the userAccountControl ? If it is, do I need to do some other configuration on my AD LDS ? Or, how can I get rid of the userAccountControl filter in Weblogic?
I didn't seem to find it in config files or in the interface: I only have "User From Name Filter: (&(cn=%u)(objectclass=user))", there's no userAccountControl.
Another difference I noticed is that, even though in Weblogic I have set ssl-enabled flag to false, in the logs I see ldaps and not ldap ( I'm not looking to setup something production-ready and I don't want SSL for the moment ).
Here are some other things I tried but did not change anything:
- the other "msDS-" attributes were not set so I tried initializing them to some value
- I tried other users defined in AD LDS, not tadmin
- in Weblogic I added users that were imported from AD LDS in Roles and Policies> Realm Roles > Global Roles > Roles > Admin
- I removed all userAccountControl occurrences that I found in xml files in Weblogic (schema.ms.xml, schema.msad2003.xml)
Any thoughts?
Thanks.I managed to narrow it down: the AD LDS does not support the userAccountControl.
Anyone knows how I can configure my Active Directory Authentication Provider in Weblogic so that it does not implicitly use userAccountControl as filter?
<BEA-000000> <getDNForUser search("CN=wl,DC=at,DC=com", "(&(&(cn=tadmin)(objectclass=user))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))", base DN & below)> -
Unable to find user list in Active Directory Authenticator
Hi all,
I am using weblogic 10.3 and want to configure ActiveDirectory Authenticator for my weblogic application. We have one managed srever under admin server . I have configured a Active Directory Authenticator named "ADAuthenticator" and made following changes as per the below values:
I set the control flag to "OPTIONAL" .
Security Realms-->myrealm-->Providers-->ADAuthenticator-->Provider Specific
UserName Attribute : ServiceBEA
Principal : ServiceBEA
Host : xxxxxx
User Search Scope : subtree
Group From Name Filter : (&(ServiceBEA=%g)(objectclass=group))
Credential : xxxxxx
Confirm Credential : xxxxxx
User From Name Filter : (&(ServiceBEA=%u)(objectclass=user))
Static Group Name Attribute : ServiceBEA
User Base DN : values provided as per requirement
Port : 389
User Object Class : user
Use Retrieved User Name as Principal : checked
Group Base DN : same values as per User Base DN
Static Group Object Class : group
Group Membership Searching : unlimited
Max Group Membership Search Level : 0
These are my AD settings. After doing this i click on save and then activate changes and then restarted the admin server.
But the problem is when i login to weblogic console to check the user list under "User and Group" i am unble to find any Active Directory users.
I don't know where i made the mistake. Can some make me out of this trouble.
Any help is highly appreciated.
Thanks in advance !Hi Sean,
Actually we have already a Active Directory with username "ServiceBEA" in our windows server. So i used this "ServiceBEA" as UserName Attribute in weblogic console while creating a Active Directory Authenticator.
You mean to say that we should go for "sAMAccountName" or what? If that is the case then i have also tested with following values, but still no luck.
UserName Attribute : sAMAccountName
Principal : ServiceBEA
Host : xxxxxx
User Search Scope : subtree
Group From Name Filter : (&(sAMAccountName=%g)(objectclass=group))
Credential : xxxxxx
Confirm Credential : xxxxxx
User From Name Filter : (&(sAMAccountName=%u)(objectclass=user))
Static Group Name Attribute : sAMAccountName
User Base DN : values provided as per requirement
Port : 389
User Object Class : user
Use Retrieved User Name as Principal : checked
Group Base DN : same values as per User Base DN
Static Group Object Class : group
Group Membership Searching : unlimited
Max Group Membership Search Level : 0
Please advise what to be place in case of User Name Attribute.
Any help is highly appreciated.
Thanks in advance ! -
Active Directory Authentication in Weblogic 8.1
Hi,
We want to do authentication from Microsoft Active Directory using weblogic 8.1.
I have created a Active directory and
configured weblogic from console to use it. But it is still not working. Your
help with these question would be highly
appreciated.
1. Is there anyone in group who have tried this before. Please let me know how
to proceed.
2. Is there any tool by which I can get to know the different attribute asked
for configuration in Weblogic?
3. I am not able to login to my application after configuration. Is there any
other way to come to know whether it is working
or not?
There could be plethora of reason but nothing which can come to my mind. Everything
seems to be configured correctly. Here is
portion of my config.xml related with authentication:
<FileRealm Name="wl_default_file_realm"/>
<PasswordPolicy Name="wl_default_password_policy"/>
<Realm FileRealm="wl_default_file_realm" Name="wl_default_realm"/>
<Security GuestDisabled="false" Name="vendavo-dev"
PasswordPolicy="wl_default_password_policy"
Realm="wl_default_realm" RealmSetup="true">
<weblogic.security.providers.authentication.DefaultAuthenticator
ControlFlag="SUFFICIENT"
Name="Security:Name=myrealmDefaultAuthenticator" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.authentication.DefaultIdentityAsserter
ActiveTypes="AuthenticatedUser"
Name="Security:Name=myrealmDefaultIdentityAsserter" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.authorization.DefaultRoleMapper
Name="Security:Name=myrealmDefaultRoleMapper" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.authorization.DefaultAuthorizer
Name="Security:Name=myrealmDefaultAuthorizer" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.authorization.DefaultAdjudicator
Name="Security:Name=myrealmDefaultAdjudicator" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.credentials.DefaultCredentialMapper
Name="Security:Name=myrealmDefaultCredentialMapper" Realm="Security:Name=myrealm"/>
<weblogic.management.security.authentication.UserLockoutManager
Name="Security:Name=myrealmUserLockoutManager" Realm="Security:Name=myrealm"/>
<weblogic.management.security.Realm
Adjudicator="Security:Name=myrealmDefaultAdjudicator"
AuthenticationProviders="Security:Name=myrealmDefaultAuthenticator|Security:Name=myrealmDefaultIdentityAsserter|Security:Name
=myrealmADAuthenticator"
Authorizers="Security:Name=myrealmDefaultAuthorizer"
CredentialMappers="Security:Name=myrealmDefaultCredentialMapper"
DefaultRealm="true" DisplayName="myrealm"
Name="Security:Name=myrealm"
RoleMappers="Security:Name=myrealmDefaultRoleMapper"
UserLockoutManager="Security:Name=myrealmUserLockoutManager"/>
<weblogic.security.providers.pk.DefaultKeyStore
Name="Security:Name=myrealmDefaultKeyStore" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.authentication.ActiveDirectoryAuthenticator
ControlFlag="SUFFICIENT" Credential="{3DES}hvEo4sy7g1E="
DisplayName="ADAuthenticator" FollowReferrals="false"
GroupBaseDN="ou=ou=Groups,dc=devdc,dc=com" Host="venper5"
Name="Security:Name=myrealmADAuthenticator"
Principal="vendev" Realm="Security:Name=myrealm" UserBaseDN="ou=Users,dc=devdc,dc=com"/>
</Security>
First, of all is it possible to use Active Directory authentication in Weblogic
without writing any custom code. If yes, how?
Thanks in advance,
Amit TyagiAmit,
We have successfully used WLS 8.1 sp1 with AD - but not without our share of ups
and downs though.
|
|
1) First, make sure you are sending right LDAP queries to AD. To verify this,
we used free 3rd party LDAP browser from Softerra. There is also java based free
browser from Univ of Michigan. Personally, I like Softerra's LDAP browser better.
Play with your LDAP settings using this and make sure AD is returning the right
data.
|
2) AD has some default settings that makes it return only the top 1000 users.
Use ntdsutil.exe to modify these default settings
|
3) AD needs to have the right set of users and groups. To configure this, refer
to WLS docs. This is very well documented in WLS docs. Also refer to this article
http://dev2dev.bea.com/products/wlportal/whitepapers/wlp70_MSADS.jsp as additional
reference
|
4) Also, there are some bugs with 8.1 portal sp1 and AD. It cannot take more than
one Authentication provider. sp2 is supposed to have fixed it. For sp1 we used
another product AD/AM (AD in Application Mode) in combination with MIIS server.
But if you are using sp2, you shouldn't be worry about this.
|
5) In your providers, you might want to get rid of the DefaultAuthentication provider,
once you are able to establish a connection with your ActiveDirectoryAuthentication
provider. The DefaultAuthentication provider causes some problems and does not
let ActiveDirectoryAuthentication provider to behave properly. We haven't fully
investgated the root of this prob. When we deleted DefaultAuthentication provider,
everything worked normally - so we didn't really care that much :-)
|
6) Make sure you have your JAAS options set to OPTIONAL initially and make sure
your are able to authenticate talk to your AD.
|
These are the ones I could think of. Hope this helps..
Regards,
Anant
"Amit" <[email protected]> wrote:
>
Hi,
We want to do authentication from Microsoft Active Directory using weblogic
8.1.
I have created a Active directory and
configured weblogic from console to use it. But it is still not working.
Your
help with these question would be highly
appreciated.
1. Is there anyone in group who have tried this before. Please let me
know how
to proceed.
2. Is there any tool by which I can get to know the different attribute
asked
for configuration in Weblogic?
3. I am not able to login to my application after configuration. Is there
any
other way to come to know whether it is working
or not?
There could be plethora of reason but nothing which can come to my mind.
Everything
seems to be configured correctly. Here is
portion of my config.xml related with authentication:
<FileRealm Name="wl_default_file_realm"/>
<PasswordPolicy Name="wl_default_password_policy"/>
<Realm FileRealm="wl_default_file_realm" Name="wl_default_realm"/>
<Security GuestDisabled="false" Name="vendavo-dev"
PasswordPolicy="wl_default_password_policy"
Realm="wl_default_realm" RealmSetup="true">
<weblogic.security.providers.authentication.DefaultAuthenticator
ControlFlag="SUFFICIENT"
Name="Security:Name=myrealmDefaultAuthenticator" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.authentication.DefaultIdentityAsserter
ActiveTypes="AuthenticatedUser"
Name="Security:Name=myrealmDefaultIdentityAsserter" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.authorization.DefaultRoleMapper
Name="Security:Name=myrealmDefaultRoleMapper" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.authorization.DefaultAuthorizer
Name="Security:Name=myrealmDefaultAuthorizer" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.authorization.DefaultAdjudicator
Name="Security:Name=myrealmDefaultAdjudicator" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.credentials.DefaultCredentialMapper
Name="Security:Name=myrealmDefaultCredentialMapper" Realm="Security:Name=myrealm"/>
<weblogic.management.security.authentication.UserLockoutManager
Name="Security:Name=myrealmUserLockoutManager" Realm="Security:Name=myrealm"/>
<weblogic.management.security.Realm
Adjudicator="Security:Name=myrealmDefaultAdjudicator"
AuthenticationProviders="Security:Name=myrealmDefaultAuthenticator|Security:Name=myrealmDefaultIdentityAsserter|Security:Name
=myrealmADAuthenticator"
Authorizers="Security:Name=myrealmDefaultAuthorizer"
CredentialMappers="Security:Name=myrealmDefaultCredentialMapper"
DefaultRealm="true" DisplayName="myrealm"
Name="Security:Name=myrealm"
RoleMappers="Security:Name=myrealmDefaultRoleMapper"
UserLockoutManager="Security:Name=myrealmUserLockoutManager"/>
<weblogic.security.providers.pk.DefaultKeyStore
Name="Security:Name=myrealmDefaultKeyStore" Realm="Security:Name=myrealm"/>
<weblogic.security.providers.authentication.ActiveDirectoryAuthenticator
ControlFlag="SUFFICIENT" Credential="{3DES}hvEo4sy7g1E="
DisplayName="ADAuthenticator" FollowReferrals="false"
GroupBaseDN="ou=ou=Groups,dc=devdc,dc=com" Host="venper5"
Name="Security:Name=myrealmADAuthenticator"
Principal="vendev" Realm="Security:Name=myrealm" UserBaseDN="ou=Users,dc=devdc,dc=com"/>
</Security>
First, of all is it possible to use Active Directory authentication in
Weblogic
without writing any custom code. If yes, how?
Thanks in advance,
Amit Tyagi -
Final Cut Server: Cannot connect to Java Web Start with a web browser
I get this exact error http://support.apple.com/kb/TS1610, but their steps do not fix it.
sudo cp /etc/apache2/sites/0000any_80.conf.default /etc/apache2/sites/0000any_80.conf
has me validate and then goes back to the prompt the other:
Xserve:~ admin$ sudo /Library/Application\ Support/Final\ Cut\ Server/Final\ Cut\ Server.bundle/Contents/Resources/sbin/post-install.sh
Stopping Final Cut Server services ...
launchctl: Error unloading: com.apple.FinalCutServer.fcsvr_ldsd
launchctl: Error unloading: com.apple.FinalCutServer.fcsvr_stored
Starting postgresql ...
Initializing database ...
could not connect to server: No such file or directory
Is the server running locally and accepting
connections on Unix domain socket "/tmp/.s.PGSQL.8820"?
connection failed, retrying (1) ...
-- updating: pxtraitclass
-- updating: pxperm
-- updating: pxgroup
-- updating: pxschema
-- updating: pxentitylinktype
-- updating: pxenum
-- updating: pxenumentry
-- updating: pxmdfield
-- updating: pxtrait
-- updating: pxmdgroup
-- updating: pxmdgrouphasfield
-- updating: pxeventstatus
-- initializing config package: base
-- updating: enum
-- updating: enumentry
-- updating: mdfield
-- updating: mdgroup
-- updating: mdgrouphasfield
-- updating: mdmap
Settings plist already present, not overwriting.
Starting Final Cut Server services ...
Configuring webstart for OS X Server on default site ...
web:Modules:array_id:php5module:enabled = yes
web:Modules:array_id:userdirmodule:enabled = yes
web:Modules:array_id:apple_userdirmodule:enabled = yes
web:Sites:array_id:*:80_:IfModule:_array_id:mod_rewrite.c:RewriteCond:_arrayindex:0 = "%{REQUEST_METHOD} ^TRACE"
web:Sites:array_id:*:80_:IfModule:_array_id:modrewrite.c:RewriteEngine = yes
web:Sites:array_id:*:80_:IfModule:_array_id:mod_rewrite.c:RewriteRule:_arrayindex:0 = ".* - [F]"
web:Sites:array_id:*:80_:IfModule:_array_id:mod_rewrite.c:RewriteRule:_arrayindex:1 = "^/FinalCutServer$ /~fcsvr/Sites/webstart/index.php [NC,L]"
service: This command still works, but it is deprecated. Please use launchctl(8) instead.
service: This command still works, but it is deprecated. Please use launchctl(8) instead.
Xserve:~ admin$
Help? I should point out this is my first experience with OSXserver and I am not exactly an advanced user.
Message was edited by: otterholtHi, this dind't help.
I can resolve host name, so it looks like DNS works:
If I typed: <IP address> or localhost or localhostname.local or hostname I stiil get the default OS X web page with services, but no service is available not I can't connect to FCS web start page.
I didn't change DNS records - it is default as it was after installation of system and FCs. -
Final Cut Server + Media Manager Best Practices
Is anyone using Final Cut Server to organize FCP Media Manager?
I don`t want MM and it`s individual contains cataloged by FCS, only a "bundle" from the directory of MM (that has the project and a sub-directory called Media with all medias from that project).
I`ve tried different solutions but always get stuck in some way.
1- Get the directory from MM and put on a Device being watched by a scan production. A production with the name from the directory is created and the project and medias are catalogued as well.
But I don`t want those medias and projects catalogued by FCS. I`ve tried to set the recursion limit to 0 or 1 but the production is not created, neither the bundle (from the directory) asset. Nevertheless you can`t archive productions (with MatrixStore you can), so a workaround would be to archive only the bundle inside the production (if you managed to get only the directory as a bundle inside the production). But to get worse, if you update the directory as a bundle (regardless if it`s inside a production or not) and your archive device is a FTP device it says "ERROR: E_NOTSUPP Sorry, copying a bundle to an ftp server is not supported".
2- Zip with "ditto" (because the 2GB problem with normal zip) the MM directory and put on a device being watched. This won`t be scanned by a scan production to create a production with the name of it contents because it`s not a directory it`s a zip file and even if I forget about productions and only uploads the zip files to get each MM directory created as a zip takes too long and much cpu power so it`s not possible with many MM directories (the case). And to get things worse (always murphy), before I`ve deleted those directories I checked the integrity of zip files and to my surprise some of them were ruined. So I don`t trust compressing anything for my backup. I`ve tried Tar, ditto, archive from finder (that`s the same as ditto) but it takes too long or break the file.
The bottom line: I just want a MM as directory bundle in FCS (preferentially inside a production automatically created) AND being able to archive it to a FTP device.
Thanks in advanceWell it sounds like you have two problems: getting a successful scan production to work and archiving. I think I can help with the first one.
When you set up your device make sure that it is one directory level up from each folder you want turned into a production. So for example - XSAN/Show1/MM/ - if you make XSAN the device and set the recursion limit to 0, Show1 will become a production and Show2, Show3, etc for example. Set the recursion limit to 1 and MM becomes a production - Show2/MM/ and Show3/MM, etc for example.
Here's what I would do. Device 1 = XSAN/Show1 with recursion = 0. In the production info section of the scan production response set the title = Show1_[0]. The [0] will automatically fill in the name of the directory, ie - MM. This way each folder within Show1 becomes a production and the name is preceded by Show1 for easy sorting. This way you can isolate your MM folder and treat it differently.
That should get your productions scanning correctly. I'm not sure about archiving to an FTP device, zipping bundles, or automatically adding bundled assets to productions with a scan. As far as I know, the only way to add a bundled asset is to manually upload a folder. I might be wrong about this though.
Hope this helps even a little.
Message was edited by: Franbot -
DNxHD footage transcode in Final Cut Server?
I'm looking at setting up a directory watcher which will automatically transcode footage from HDV to Avid DNxHD.
Is this possible at all within Final Cut Server? It seems Final Cut support all of the codecs I have installed except that one.The codec doesn't show up as a valid codec in the list when I try to make the custom transcode setting.
I'm doing the following:
SysPrefs -> Final Cut Server -> Automations -> "plus" -> File System Watcher -> Set up the watcher filter -> Responses -> "plus" -> Copy Response -> Transcode source to -> NO AVID CODEC in list.
Am I in the right place to be setting this up, or is there somewhere else I can make sure the codec appears?
We have set the threadsafe bit to see if that made a difference but there is still nothing from Avid in the list.
It shows up just fine in the other apps on the mac, is it an incompatibility with FCS and that codec?
Your help is greatly appreciated,
Chris.
Message was edited by: witchrinser
Message was edited by: witchrinser -
Final Cut Server 1.5: G5 clients won't launch from icon
So I upgraded my client from FCServer 1.1.1 to 1.5. They have a mix of G5 and Mac Pro stations. The 4 Mac Pros are all working fine after some fiddling and Java cache deleting. The G5s, however, won't run the client launched from the saved icon.
Scenario:
Access the client download from (IP address)/finalcutserver in a web browser - this works.
The applet downloads and saves - this works.
SOMETIMES it asks where to save the app - sometimes works.
The client app runs, logs in, all working fine - great.
BUT...if you quit and try to relaunch from that icon, it doesn't work. Purged Java caches, emptied the cache in the client, etc. - nothing. Updated from 10.5.7 to 10.5.8, same problem.
The Intel boxes all work, none of the G5s do - seems entirely platform specific.
-mikeHeh... I solved this... in a manner of speaking. I really appreciate the input from Nicholas, Andy, RadUS, and everyone else, but nothing worked.
Weird. May be actually a Java problem, not a FCSvr problem, maybe something in the Java implementation of 10.5.7 and later. But who knows? No word on this from Apple. There's a surprise.
Here's the solution I ended up with. It's a cop-out I know, but it works!
My solution was to put the Final Cut Server.jnlp file on my desktop and just launch it from there. You can even make it look like the desktop app if you want. Here's how:
First you have to get the Final Cut Server.jnlp file on your desktop. It's not easy to find, because it's located in some weird temp directory somewhere buried in the recesses of the OS. If you don't know where it is, look through your browser's download history and find it. You can always redownload it by going to your server (yourserver.com/finalcutserver) and redownloading it. When you find it, move it to your desktop. Then do a Get Info on both the desktop app and jnlp file. Click on the icon for the app (the tray with the balls) and press Command C to copy the icon. Then click on the jnlp icon (the document with the cup of java) and press Command V to paste the FCSvr desktop app icon to the jnlp. Then check "hide extension" in the jnlp's get info window. Voila. You now have a "fake" desktop app. Yes, it's fake. Get over it! You won't be able to tell a difference. This is the only solution I came up with and I reinstalled Leopard twice.
Hope this helps others too!
Jason
Message was edited by: nylonoxygen77
Message was edited by: nylonoxygen77
Maybe you are looking for
-
I have an imac G5 connected to the internet with an airport extreme and my new roommate has the misfortune to own a pc laptop running windows XP that she'd like to connect to my network. Basically I have been surfing for ages and looking in all the b
-
Dynamic creation of fields in a UI Map
Is there a possibility of dynamically creating fields in a UI Map with orafield values populated ?
-
Page window blacks out for a moment when clicking on links?
So I was working on a layout/theme for my tumblr, changing css and stuff around, when about an hour ago, whenever I clicked on a link on the site, the window would go black for a second. The page would then load normally. This isn't happening in Safa
-
Create a tree node and show the report on the same page
Hi, I have created a tree for our organization and each node represents a unit. The top one is office level and followed by division and brach. I have created a reprot on the same page as the tree node. What I want to do is: I would like to click a s
-
IPhoto albums lost overnight...
This is a little bizarre... Yesterday, I imported a number of new images into my iPhoto (8.1.1) library. Then I created three new albums and spent a couple of hours organising pix into them. I then decided to upload some of these images to PhotoBox t