OID + WebLogic ..Authentication denied

Question

Dear Guys,
I use OID 11.1.1.6.0 and WebLogic 10.3.6.
Just created a simple WLS Domain and added the OIDAuthenticator to my realm. Added all the required parameters to the provide specific tab. I see the users and groups from OID are populating into myrealm->Users and Groups tab.
When I try to login into the WebLogic Console through OIDAuthenticator, it says 'Authentication denied'. Kindly see the config.xml entry below and appreciate your help. Thanks much.
<name>testdomain</name>
<domain-version>10.3.6.0</domain-version>
<security-configuration>
<name>testdomain</name>
<realm>
<sec:authentication-provider xsi:type="wls:oracle-internet-directory-authenticatorType">
<sec:name>OIDAuthenticator</sec:name>
<sec:control-flag>SUFFICIENT</sec:control-flag>
<wls:host>oracle3.cla.ca</wls:host>
<wls:port>3060</wls:port>
<wls:principal>cn=orcladmin</wls:principal>
<wls:user-base-dn>cn=Users, dc=cla,dc=ca</wls:user-base-dn>
<wls:credential-encrypted>{AES}jB+R2WyufH9tVPKJZgHhgToJmGdUYef0bs+If8jrMb8=</wls:credential-encrypted>
<wls:user-from-name-filter>(&amp;(cn=%u)(objectclass=Person))</wls:user-from-name-filter>
<wls:all-users-filter>(&amp;(cn=*)(objectclass=Person))</wls:all-users-filter>
<wls:group-base-dn>cn=Groups, dc=cla,dc=ca </wls:group-base-dn>
<wls:group-from-name-filter>(&amp;(cn=%g)(objectclass=groupOfNames)) or (|(&amp;(cn=%g)(objectclass=groupofUniqueNames))(&amp;(cn=%g)(objectclass=groupOfNames)))</wls:group-from-name-filter>
<wls:all-groups-filter>(&amp;(cn=*)(objectclass=groupOfNames)) or (&amp;(cn=*)(|(objectclass=groupofUniqueNames)(objectclass=groupOfNames)))</wls:all-groups-filter>
<wls:static-member-dn-attribute>member</wls:static-member-dn-attribute>
<wls:static-group-dns-from-member-dn-filter>(&amp;(member=%M)(objectclass=groupOfNames))</wls:static-group-dns-from-member-dn-filter>
</sec:authentication-provider>
<sec:authentication-provider xsi:type="wls:default-authenticatorType">
<sec:control-flag>SUFFICIENT</sec:control-flag>
</sec:authentication-provider>
<sec:authentication-provider xsi:type="wls:default-identity-asserterType">
<sec:active-type>AuthenticatedUser</sec:active-type>
</sec:authentication-provider>
<sec:role-mapper xmlns:xac="http://xmlns.oracle.com/weblogic/security/xacml" xsi:type="xac:xacml-role-mapperType"></sec:role-mapper>
<sec:authorizer xmlns:xac="http://xmlns.oracle.com/weblogic/security/xacml" xsi:type="xac:xacml-authorizerType"></sec:authorizer>
<sec:adjudicator xsi:type="wls:default-adjudicatorType"></sec:adjudicator>
<sec:credential-mapper xsi:type="wls:default-credential-mapperType"></sec:credential-mapper>
<sec:cert-path-provider xsi:type="wls:web-logic-cert-path-providerType"></sec:cert-path-provider>
<sec:cert-path-builder>WebLogicCertPathProvider</sec:cert-path-builder>
<sec:name>myrealm</sec:name>
<sec:password-validator xmlns:pas="http://xmlns.oracle.com/weblogic/security/providers/passwordvalidator" xsi:type="pas:system-password-validatorType">
<sec:name>SystemPasswordValidator</sec:name>
<pas:min-password-length>8</pas:min-password-length>
<pas:min-numeric-or-special-characters>1</pas:min-numeric-or-special-characters>
</sec:password-validator>
</realm>
<default-realm>myrealm</default-realm>
<credential-encrypted>{AES}ZTjORSL/MHimWcm5Rt55/2hH8MCu3B8dLGvcYwMRAAE4Bv7xRVVI3neSugUngEhoXaIWNRFsSi4o58rTMTjxQnd9gPDhBV/VqRFijEWs3tDy/P8ZOPg6DVmEg4WBsYev</credential-encrypted>
<node-manager-username>weblogic</node-manager-username>
<node-manager-password-encrypted>{AES}PzBQK1IYj3Oq2BETmxFoqDlCNAt8n7Kl8fstbPVdKlc=</node-manager-password-encrypted>
</security-configuration>
<server>
<name>AdminServer</name>
<listen-port>10000</listen-port>
<listen-address></listen-address>
</server>
<embedded-ldap>
<name>testdomain</name>
<credential-encrypted>{AES}vLrGPaH6W5D7vYZlMYWjLeXaERMGbzBvX81Up4A37deegWImtQ67rY73IuQeFK9H</credential-encrypted>
</embedded-ldap>
<configuration-version>10.3.6.0</configuration-version>
<admin-server-name>AdminServer</admin-server-name>
</domain>
~

Answer 1

And I see the below error at log after enabling debug for security
####<Mar 21, 2012 12:33:47 PM EDT> <Debug> <SecurityAtn> <oracle5.xx.yy> <AdminServer> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1332347627783> <BEA-000000> <javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User john denied
at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:229)
at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
at java.security.AccessController.doPrivileged(Native Method)
at com.bea.common.security.internal.service.LoginModuleWrapper.login(LoginModuleWrapper.java:106)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
at com.bea.common.security.internal.service.JAASLoginServiceImpl.login(JAASLoginServiceImpl.java:113)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57)
at $Proxy16.login(Unknown Source)
at weblogic.security.service.internal.WLSJAASLoginServiceImpl$ServiceImpl.login(WLSJAASLoginServiceImpl.java:89)
at com.bea.common.security.internal.service.JAASAuthenticationServiceImpl.authenticate(JAASAuthenticationServiceImpl.java:82)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57)
at $Proxy34.authenticate(Unknown Source)
Edited by: user11112257 on 21-Mar-2012 09:37