LDAP authentication issue for Admin Console 7.0U5

Question

Here is what I'm trying to do:
In Unix LDAP Server, there are 2 identities already been created
dn: cn=group1,     ou=group,ou=na,dc=XYZ,dc=com (gidNumber: 937)
dn: uid=bai,     ou=People,ou=na,dc=XYZ,dc=com (gidNumber: 937)
dn: cn=group1,ou=group,ou=na,dc=XYZ,dc=com+
memberUid: user1+
memberUid: bai+
memberUid: user2+
gidNumber: 937+
objectClass: top+
objectClass: posixgroup+
objectClass: groupofuniquenames+
dn: uid=bai,ou=People,ou=na,dc=XYZ,dc=com*
loginShell: /bin/ksh*
homeDirectory: /export/home/bai*
gidNumber: 937*
cn: Lastname, Firstname*
sn:*
uid: bai*
uidNumber: 10091*
objectClass: top*
objectClass: inetOrgPerson*
objectClass: posixAccount*
objectClass: shadowaccount*
objectClass: organizationalPerson*
objectClass: person*
++shadowFlag: 0+
User "bai" is a member of Group "group1" and will also be used as bind-dn (connection tested successfully)
There are also other members (user1, user2) in the Group "group1".
Goal: all individual users in "group1" will have access to Admin Console. (allow_group=group1)
settings as follows
--ldap-url=ldap://ldapsever.XYZ.com:389/dc=XYZ,dc=com*+
--bind-dn=uid=bai,ou=People,ou=na,dc=XYZ,dc=com*+
--bind-password=xxxx*+
--group-search-filter=gidNumber*+
--group-search-attr=cn*+
--allow-group=group1*+
--search-filter=uid*+
It appears that I got authenticated by LDAP, please see messages from the ldap log
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=0 msgId=1 - BIND dn="uid=bai,ou=People,ou=na,dc=XYZ,dc=com"
method=128 version=3*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0
dn="uid=bai,ou=people,ou=na,dc=XYZ,dc=com"*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=1 msgId=2 - SRCH base="dc=XYZ,dc=com" scope=2
filter="(uid=bai)" attrs="c"*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=2 msgId=3 - BIND dn="uid=bai,ou=People,ou=na,dc=XYZ,dc=com"
method=128 version=3*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=2 msgId=3 - RESULT err=0 tag=97 nentries=0 etime=0
dn="uid=bai,ou=people,ou=na,dc=XYZ,dc=com"*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=3 msgId=4 - BIND dn="uid=bai,ou=People,ou=na,dc=XYZ,dc=com"
method=128 version=3*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=3 msgId=4 - RESULT err=0 tag=97 nentries=0 etime=0
dn="uid=bai,ou=people,ou=na,dc=XYZ,dc=com"*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=4 msgId=5 - SRCH base="dc=XYZ,dc=com" scope=2
filter="(uid=bai)" attrs="c"*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=4 msgId=5 - RESULT err=0 tag=101 nentries=1 etime=0*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=5 msgId=6 - SRCH base="dc=XYZ,dc=com" scope=2 filter="(|(&(objectClass=groupofuniquenames)(|(gidNumber=uid=bai,ou=People,ou=na,dc=XYZ,dc=com)))(&(objectClass=group)(|(member=uid=bai,ou=People,ou=na,dc=XYZ,dc=com)))(&(objectClass=groupofnames)(|(member=uid=bai,ou=People,ou=na,dc=XYZ,dc=com))))"
attrs="cn"*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=5 msgId=6 - RESULT err=0 tag=101 nentries=0 etime=0*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=6 msgId=7 - SRCH base="dc=XYZ,dc=com" scope=2
filter="(&(objectClass=groupOfURLs)(memberURL=*))" attrs="cn
memberURL"*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=6 msgId=7 - RESULT err=0 tag=101 nentries=0 etime=0*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=7 msgId=8 - SRCH base="dc=XYZ,dc=com" scope=2
filter="(uid=bai)" attrs="c"*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=7 msgId=8 - RESULT err=0 tag=101 nentries=1 etime=0*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=8 msgId=9 - SRCH base="dc=XYZ,dc=com" scope=2
filter="(|(&(objectClass=groupofuniquenames)(|(gidNumber=uid=bai,ou=People,ou=na,dc=XYZ,dc=com)))(&(objectClass=group)(|(member=uid=bai,ou=People,ou=na,dc=XYZ,dc=com)))(&(objectClass=groupofnames)(|(member=uid=bai,ou=People,ou=na,dc=XYZ,dc=com))))"
attrs="cn"*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=8 msgId=9 - RESULT err=0 tag=101 nentries=0 etime=0*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=9 msgId=10 - SRCH base="dc=XYZ,dc=com" scope=2
filter="(&(objectClass=groupOfURLs)(memberURL=*))" attrs="cn
memberURL"*+
+*[03/Nov/2009:10:00:54
-0500] conn=10858 op=9 msgId=10 - RESULT err=0 tag=101 nentries=0 etime=0
However, I'm still getting errors from Admin Console
WarningAccess Denied+
Access to the Administrative UI has been denied.+
Your user permissions do not allow you to view or edit data in this area. If you need access, contact the system administrator.+
Not sure where the problem is with? LDAP or ACL?
Any help will be highly appreciated, Thanks a lot!
- Langbaam
Edited by: langbaam on Nov 3, 2009 7:58 AM
Edited by: langbaam on Nov 3, 2009 8:29 AM
Edited by: langbaam on Nov 3, 2009 8:33 AM

Answer 1

Can you check if your admin-server's server.xml (admin-server/config/server.xml) has the following settings?
<default-auth-db-name>ldap</default-auth-db-name>
<auth-db>
    <name>ldap</name>
    <url>ldap://<hostname>:<port>/<base-dn></url>
    <property>
      <name>bindpw</name>
      <value><passwd></value>
      <encoded>true</encoded>
    </property>
    <property>
      <name>binddn</name>
      <value><binddn-value></value>
    </property>
  </auth-db>Can you also verify if the file under admin-server/config/default-sun-web.xml has the following settings?
# cat default-sun-web.xml
<?xml version="1.0" encoding="UTF-8"?>
<!--
Copyright 2004 Sun Microsystems, Inc. All rights reserved.
SUN PROPRIETARY/CONFIDENTIAL. Use is subject to license terms.
-->
<sun-web-app>
  <security-role-mapping>
    <role-name>admin</role-name>
    <group-name><your_group></group-name>
  </security-role-mapping>
</sun-web-app>- Amit