Problem in LDAP Authentication

Hi All,
Iam new in LDAP.I developed a web application using Form Based Authentication. I deployed the web application in Weblogic R3 Application Server. I want my web application to authenticate using LDAP Users. I configured LDAP V3 in weblogic server. I am getting LDAP users as "orcladmin" and "PUBLIC" through LDAP Authenticator in the console. But when iam authenticating using "orcladmin" in web application, i am unable to authenticate. I defined the principal name "orcladmin" in weblogic.xml. Can any solve my problem or suggest me any link regarding how to design the webapplication to authenticate using LDAP Users or Any tutorial to learn LDAP and use it in the web application. Thanks in Advance for the help.

If you are using ADF Security, you must do the mapping in the jazn-data.xml by "creating" OCS_PORTAL_USERS role in jazn-data realm, and mapping it to application role CN.
You should also have something like this in web.xml
<security-constraint>
        <web-resource-collection>
            <web-resource-name>adfAuthentication</web-resource-name>
            <url-pattern>/adfAuthentication</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>valid-users</role-name>
        </auth-constraint>
    </security-constraint>
    <security-role>
        <role-name>valid-users</role-name>
    </security-role>
{code}
- and in weblogic.xml
{code:xml}
<security-role-assignment>
    <role-name>valid-users</role-name>
    <principal-name>users</principal-name>
  </security-role-assignment>
{code}
And, regarding creating users in OID, check out the  [Java API for Oracle Internet Directory|http://lbdwww.epfl.ch/f/teaching/courses/oracle9i/network.920/a96577/oid_java.htm], and search the forums for 'create user in OID' or something similar, you could find some info.
Pedja                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

Similar Messages

  • Problem with LDAP authentication for users in a group

    I've gone through several forums attempting to find a solution, but I still can't get authentication to work for users in a particular group within AD. Our ASA is running 9.1(2), and the domain controller is a Windows Server 2012 R2.
    I can configure the VPN connection, so that all users can authenticate just fine; however, when I setup the group, there appears to be success, but I'm reprompted to authenticate, and it eventually fails:
    [6707]  memberOf: value = CN=VPN Access,OU=COMPANY Groups,DC=COMPANY,DC=com
    [6707]          mapped to IETF-Radius-Class: value = GroupPolicy_COMPANY_SSL_VPN
    [6707]          mapped to LDAP-Class: value = GroupPolicy_COMPANY_SSL_VPN
    [6707]  msNPAllowDialin: value = TRUE
    I'd be grateful if anyone can point me into the right direction and show me what I'm doing wrong. Thank you.
    ldap attribute-map AuthUsers
      map-name  memberOf IETF-Radius-Class
      map-value memberOf "CN=VPN Access,OU=COMPANY Groups,DC=COMPANY,DC=com" GroupPolicy_COMPANY_SSL_VPN
    aaa-server LDAP protocol ldap
    aaa-server LDAP (COMPANY_PROD_INTERNAL) host 10.10.100.110
     ldap-base-dn DC=COMPANY,DC=com
     ldap-scope subtree
     ldap-naming-attribute sAMAccountName
     ldap-login-password *****
     ldap-login-dn CN=LDAPAuth,CN=Users,DC=COMPANY,DC=com
     server-type microsoft
     ldap-attribute-map AuthUsers
    group-policy NOACCESS internal
    group-policy NOACCESS attributes
     vpn-simultaneous-logins 0
     vpn-tunnel-protocol ikev1 ssl-client ssl-clientless
     webvpn
      anyconnect ask none default anyconnect
    group-policy GroupPolicy_COMPANY_SSL_VPN internal
    group-policy GroupPolicy_COMPANY_SSL_VPN attributes
     wins-server none
     dns-server value 10.10.100.102
     vpn-tunnel-protocol ikev1 ikev2 ssl-client
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value SPLIT-TUNNEL
     default-domain value net.COMPANY.com
     webvpn
      anyconnect profiles value COMPANY_SSL_VPN_client_profile type user
    tunnel-group COMPANY_SSL_VPN type remote-access
    tunnel-group COMPANY_SSL_VPN general-attributes
     address-pool COMPANY-SSL-VPN-POOL
     authentication-server-group LDAP
     authorization-server-group LDAP
     authorization-server-group (COMPANY_PROD_INTERNAL) LDAP
     default-group-policy NOACCESS
     authorization-required
    tunnel-group COMPANY_SSL_VPN webvpn-attributes
     group-alias COMPANY_SSL_VPN enable
    tunnel-group COMPANY_SSL_VPN ipsec-attributes
     ikev1 pre-shared-key *****

    I just figured it out. Under "group-policy GroupPolicy_COMPANY_SSL_VPN attributes", I had to add "vpn-simultaneous-logins 15". Apparently, it was using the value "vpn-simultaneous-logins 0" under the NOACCESS group policy.

  • Built-in LDAP Authentication Problem

    Hi All,
    I have used Built-in LDAP Authentication Method for my application authentication which works fine,but i need to have an database authentication as well in combination to LDAP one.
    I tried putting a database authentication function (Returning Boolean) in the post authentication process but without success.
    Please suggest how to go about this.
    cheers
    Dhrubo

    You really didn't explain much more than in your first post.
    For Example ,LDAP verifies all users now,but i would like to enable persons with their role as managers to have access priviledge for my application.Right now, managers do have access privilege so that requirement does not make sense.
    For this Manager problem i need a database level authentication.What does that mean? You can't just make up terms like that.
    I think you are mixing up authentication and authorization. Please search this forum and read the User's Guide for more info about how these are differrent.
    We can show you how to do both authentication and authorization, you just need to work harder stating your exact requirements.
    Scott

  • Problem with WLS LDAP Authentication Provider

    We have configured WLS LDAP Authentication provider on an Oracle Service Bus domain, which is used to authenticate WS-Security Username Token and SAML Tokens against an external LDAP Directory (Sun Directory Server). After configuring this, we see that the "Users & Groups" page on the WLS Admin console is getting populated with all the user ids available in LDAP. The organization corporate directory has thousands of user ids, and WLS is executing a generic query against LDAP to fetch all the users. This query would have a major performance impact on the LDAP Directory? Is there any way to prevent this generic query from happening? Any suggestions would help.
    Edited by: Ramakrishnan Venkataraman on Feb 1, 2011 11:46 AM

    Yes, you can apply filters on the Providers configuration, also u can select the DN from where to feth the users, you can fetch users with special attributes.
    Whole lot of things can be done, review the options under providers.
    Let me know if you have any doubts.
    HTH,
    -Faisal
    http://www.weblogic-wonders.com

  • SharePoint 2010 with LDAP authentication, using NOVELL eDirectory

    One of my customers needs a SharePoint application that allows people to authenticate with either an Active Directory account (internal staff) or a Novell eDirectory account (external customers).
    Using the following article as a base guide (http://blogs.technet.com/b/speschka/archive/2009/11/05/configuring-forms-based-authentication-in-sharepoint-2010.aspx)
    I configured a claims-based test application that had Windows authentication enabled and Forms based authentication (FBA) enabled (this is on a Windows 2008 server and not a domain controller)
    In the Membership provider name text box I entered "LdapMember"
    In the Role provider name  text box I entered "LdapRole"
    In the web.config for the SharePoint Central Admin, I modified/added the following details right before </system.web>
    <membership>
    <providers>
    <add name="LdapMember"
    type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    userDNAttribute="dn"
    userNameAttribute="cn"
    userContainer="OU=people,O=validobject"
    userObjectClass="person"
    userFilter="(ObjectClass=person)"
    scope="Subtree"
    otherRequiredUserAttributes="sn,givenname,cn" />
    </providers>
    </membership>
    <roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider" >
    <providers>
    <add name="LdapRole"
    type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    groupContainer="OU=people,O=validobject"
    groupNameAttribute="cn"
    groupNameAlternateSearchAttribute="samAccountName"
    groupMemberAttribute="member"
    userNameAttribute="sAMAccountName"
    dnAttribute="distinguishedName"
    groupFilter="((ObjectClass=group)"
    userFilter="((ObjectClass=person)"
    scope="Subtree" />
    </providers>
    </roleManager>
    I modified the SecurityTokenServiceApplication web.config with these details
    <system.web>
    <membership>
    <providers>
    <add name="LdapMemebr"
    type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    userDNAttribute="dn"
    userNameAttribute="cn"
    userContainer="OU=people,O=validobject"
    userObjectClass="person"
    userFilter="(ObjectClass=person)"
    scope="Subtree"
    otherRequiredUserAttributes="sn,givenname,cn" />
    </providers>
    </membership>
    <roleManager enabled="true">
    <providers>
    <add name="LdapRole"
    type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    groupContainer="OU=people,O=validobject"
    groupNameAttribute="cn"
    groupNameAlternateSearchAttribute="samAccountName"
    groupMemberAttribute="member"
    userNameAttribute="sAMAccountName"
    dnAttribute="distinguishedName"
    groupFilter="(&amp;(ObjectClass=group))"
    userFilter="(&amp;(ObjectClass=person))"
    scope="Subtree" />
    </providers>
    </roleManager>
    </system.web>
    I modified the web.config of the test application I created with these details
    <roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">
    <providers>
    <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
    <add name="LdapRole" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    groupContainer="OU=people,O=validobject"
    groupNameAttribute="cn"
    groupNameAlternateSearchAttribute="samAccountName"
    groupMemberAttribute="member"
    userNameAttribute="cn"
    dnAttribute="dn"
    groupFilter="(&amp;(ObjectClass=group))"
    userFilter="(&amp;(ObjectClass=person))"
    scope="Subtree" />
    </providers>
    </roleManager>
    <membership defaultProvider="i">
    <providers>
    <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
    <add name="LdapMember" type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword= "validpassword"
    useDNAttribute="true"
    userDNAttribute="dn"
    userNameAttribute="cn"
    userContainer="OU=people,O=validobject"
    userObjectClass="person"
    userFilter="(ObjectClass=person)"
    scope="Subtree"
    otherRequiredUserAttributes="sn,givenname,cn" />
    </providers>
    </membership>
    With all of this configured, I can go to the new test site, I do see the form where I can choose either Windows authentication or Forms authentication. I can successfully login with Windows authentication, but forms authentication gives me me an error.
    The server could not sign you in. Make sure your user name and password are correct, and then try again.
    I can successfully login to a LDAP management tool, using the same credentials I entered on the form, so I know the username and password being submitted are correct. I get the following items in the event viewer
    8306 - SharePoint Foundation - The security token username and password could not be validated.
    in the SharePoint trace logs - Password check on 'testuser' generated exception: 'System.ServiceModel.FaultException`1[Microsoft.IdentityModel.Tokens.FailedAuthenticationException]: The security token username and password could not be validated. and
    then this:
    Request for security token failed with exception: System.ServiceModel.FaultException: The security token username and password could not be validated.
    at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.ReadResponse(Message response)
    at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst, RequestSecurityTokenResponse& rstr)
    at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst)
    at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForContext(Uri context, Boolean bearerToken, SecurityToken onBehalfOf, SecurityToken actAs, SecurityToken delegateTo)
    I monitored the LDAP server and did a packet-trace on the communication happening between the SharePoint server and the LDAP server and it is a bit odd. It goes like this:
    The SharePoint server successfully connects to the LDAP server, binding the ldapserviceid+password
    The LDAP server tells the SharePoint server it is ready to communicate
    the SharePoint server sends an LDAP query to the LDAP server, asking if the name entered in the form authentication page can be found.
    The LDAP server does the query, successfully finds the entered name and sends a success message back to SharePoint
    The LDAP server sends notification that it is done and is closing the connection that was bound to theldapserviceid+password
    The SharePoint server acknowledges the connection is closing
    ... and then nothing happens, except the error on SharePoint
    What I understand is that the SharePoint server, once it gets confirmation that the submitted username exists in LDAP, should attempt to make a new LDAP connection, bound to the username and password submitted in the form (rather than the LDAP service account
    specified in the web.config). That part does not seem to be happening.
    I am at a standstill on this and any help would be greatly appreciated.

    OK, our problem was resolved by removing any information about the ASP.NET role manager. Initially, we had information about a role manager defined in three different web.config files, as well as in the SharePoint Central Administration site, where there
    is the checkbox to Enable Forms Based Authentication (you see this when you first create the new SharePoint app, or afterwards by modifying the Authentication Provider for the app.) In either case, you will see two text boxes, underneath the checkbox item
    for enabling Forms Based Authentication:
    "ASP.NET Membership provider name"
    "ASP.NET Role manager name"
    We entered a name for Membership provider, and left Role manager blank.
    In the web.config for the SharePoint Central Administration site, the SecurityTokenServiceApplication app, and the web app we created with FBA enabled, we entered the following:
    <membership>
    <providers>
    <add name="LdapMember"
    type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
    server="ldap.server.address"
    port="389"
    useSSL="false"
    connectionUsername="cn=ldapserviceid,ou=sharepoint,ou=test,ou=location,o=validobject"
    connectionPassword="validpassword"
    useDNAttribute="false"
    userDNAttribute="dn"
    userNameAttribute="cn"
    userContainer="OU=people,O=validobject"
    userObjectClass="person"
    userFilter="(ObjectClass=person)"
    scope="Subtree"
    otherRequiredUserAttributes="sn,givenname,cn" />
    </providers>
    </membership>
    <roleManager>
    <providers>
    </providers>
    </roleManager>
    useDNAttribute="false" turned out to be important as well.
    So, for us to get LDAP authentication working between SharePoint 2010 and Novel eDirectory, we had to:
    leave anything related to the role provider blank
    configure the web.config in three different applications, with the proper connection information to reach our Novel eDir
    Ensure that useDNAttribute="false" was used in all three on the modified web.config files.
    Since our eDir is flat and used pretty much exclusively for external users, we had never done any sort of advanced role management configuration in eDir. So, by having role manager details in the web.config files, SharePoint was waiting for information from
    a non-existent role manager.

  • How to use two different LDAP authentication for my Apex application login

    Hi,
    I have 2 user groups defined in the LDAP directory and I provided the DN string for apex authentication something like the below
    cn=%LDAP_USER%,ou=usergrp1,dc=oracle,dc=com
    cn=%LDAP_USER%,ou=usergrp2,dc=oracle,dc=com
    The problem is I couln't pointout both the groups in DN string, I am trying to allow both usergroups to access the application.
    Does anyone know how to define both the group in LDAP DN String ?.
    Thanx in advance
    Vijay.

    Vijay,
    I don't think you'll be able to use the built-in LDAP authentication scheme. Just create a new authentication scheme that has its own authentication function. In that function code your calls to dbms_ldap however you need. Search the forum for dbms_ldap.simple_bind_s to find examples.
    Scott

  • Weblogic Server 10.3.0 and LDAP authentication Issue

    Hi - I have configured my WebLogic Server 10.3.0 for LDAP authentication (OID = 10.1.4.3.0) and so far the authentication works fine but I am having issue in terms of authorization.
    I am not able to access the default web logic administrator console app using any of the LDAP user, getting Forbiden message.
    It appears to me that the Weblogic Server is not pulling out the proper groups from the LDAP where user belongs too.
    Can anyone please point me towards the right direction to get this resolved.
    Thanks,
    STEPS
    Here are my steps I have followed:
    - Created a group called Administrators in OID.
    - Created a test user call uid=myadmin in the OID and assigned the above group to this user.
    - Added a new Authentication Provider to the Weblogic and configured it what is required to communicate with OID (the config.xml file snipet is below)
    <sec:authentication-provider xsi:type="wls:ldap-authenticatorType">
    <sec:name>OIDAuthentication</sec:name>
    <sec:control-flag>SUFFICIENT</sec:control-flag>
    <wls:propagate-cause-for-login-exception>false</wls:propagate-cause-for-login-exception>
    <wls:host>pmpdeva-idm.ncr.pwgsc.gc.ca</wls:host>
    <wls:port>1389</wls:port>
    <wls:principal>cn=orcladmin</wls:principal>
    <wls:user-base-dn>ou=AppAdmins, o=gc, c=ca</wls:user-base-dn>
    <wls:credential-encrypted>removed from here</wls:credential-encrypted>
    <wls:group-base-dn>ou=IDM, ou=ServiceAccounts, o=gc, c=ca</wls:group-base-dn>
    </sec:authentication-provider>
    - Marked the default authentication provider as sufficient as well.
    - Re-ordered the authentication provide such that the OIDauthentication is first in the list and default one is the last.
    - Looking at the log file I see there are no groups returned for this user and that is the problem in my opinion.
    <LDAP Atn Login username: myadmin>
    <getConnection return conn:LDAPConnection {ldaps://pmpdeva-idm.ncr.pwgsc.gc.ca:1389 ldapVersion:3 bindDN:"cn=orcladmin"}>
    <authenticate user:myadmin>
    <getDNForUser search("ou=AppAdmins, o=gc, c=ca", "(&(uid=myadmin)(objectclass=person))", base DN & below)>
    <DN for user myadmin: uid=myadmin,ou=AppAdmins,o=gc,c=ca>
    <authenticate user:myadmin with DN:uid=myadmin,ou=AppAdmins,o=gc,c=ca>
    <authentication succeeded>
    <returnConnection conn:LDAPConnection {ldaps://pmpdeva-idm.ncr.pwgsc.gc.ca:1389 ldapVersion:3 bindDN:"cn=orcladmin"}>
    <LDAP Atn Authenticated User myadmin>
    <List groups that member: myadmin belongs to>
    <getConnection return conn:LDAPConnection {ldaps://pmpdeva-idm.ncr.pwgsc.gc.ca:1389 ldapVersion:3 bindDN:"cn=orcladmin"}>
    <getDNForUser search("ou=AppAdmins, o=gc, c=ca", "(&(uid=myadmin)(objectclass=person))", base DN & below)>
    <DN for user myadmin: uid=myadmin,ou=AppAdmins,o=gc,c=ca>
    *<search("ou=IDM, ou=ServiceAccounts, o=gc, c=ca", "(&(uniquemember=uid=myadmin,ou=AppAdmins,o=gc,c=ca)(objectclass=groupofuniquenames))", base DN & below)>*
    *<Result has more elements: false>*
    <returnConnection conn:LDAPConnection {ldaps://pmpdeva-idm.ncr.pwgsc.gc.ca:1389 ldapVersion:3 bindDN:"cn=orcladmin"}>
    <login succeeded for username myadmin>
    - I see the XACML RoleMapper getRoles() only returning the Anonymous role as oppose to Admin (because the OID user is a part of Administrators group in OID then it should be returning Admin as fars I can tell. Here is the log entry that shows that:
    <XACML RoleMapper getRoles(): returning roles Anonymous>
    - I did a ldap search and I found no issues in getting the results back:
    C:\>ldapsearch -h localhost -p 1389 -b"ou=IDM, ou=ServiceAccounts, o=gc, c=ca" -D cn=orcladmin -w "removed from here" (uniquemember=uid=myadmin,ou=AppAdmins,o=gc,c=ca)(objectclass=groupOfUniqueNames)
    cn=Administrators,ou=IDM,ou=ServiceAccounts,o=gc,c=ca
    objectclass=groupOfUniqueNames
    objectclass=orclGroup
    objectclass=top
    END
    Here are the log entries:
    <1291668685624> <BEA-000000> <LDAP ATN LoginModule initialized>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.initialize delegated>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.login>
    <1291668685624> <BEA-000000> <LDAP Atn Login>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle callbcacks[0] will be delegated>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle callbcacks[0] will use NameCallback to retrieve name>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle callbcacks[1] will be delegated>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle will delegate all callbacks>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle delegated callbacks>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle got username from callbacks[0], UserName=myadmin>
    <1291668685624> <BEA-000000> <LDAP Atn Login username: myadmin>
    <1291668685624> <BEA-000000> <getConnection return conn:LDAPConnection { ldapVersion:2 bindDN:""}>
    <1291668685624> <BEA-000000> <authenticate user:myadmin>
    <1291668685624> <BEA-000000> <getDNForUser search("ou=people,ou=myrealm,dc=MBR_Domain", "(&(uid=myadmin)(objectclass=person))", base DN & below)>
    <1291668685624> <BEA-000000> <getDNForUser search("ou=people,ou=myrealm,dc=MBR_Domain", "(&(uid=myadmin)(objectclass=person))", base DN & below)>
    <1291668685624> <BEA-000000> <returnConnection conn:LDAPConnection { ldapVersion:2 bindDN:""}>
    <1291668685624> <BEA-000000> <[Security:090302]Authentication Failed: User myadmin denied>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.initialize LoginModuleClassName=weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.initialize ClassLoader=java.net.URLClassLoader@facf0b>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.initialize created delegate login module>
    <1291668685624> <BEA-000000> <LDAP ATN LoginModule initialized>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.initialize delegated>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.login>
    <1291668685624> <BEA-000000> <LDAP Atn Login>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle callbcacks[0] will be delegated>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle callbcacks[1] will be delegated>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle will delegate all callbacks>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle delegated callbacks>
    <1291668685624> <BEA-000000> <com.bea.common.security.internal.service.CallbackHandlerWrapper.handle did not get username from a callback>
    <1291668685624> <BEA-000000> <LDAP Atn Login username: myadmin>
    <1291668685624> <BEA-000000> <getConnection return conn:LDAPConnection {ldaps://pmpdeva-idm.ncr.pwgsc.gc.ca:1389 ldapVersion:3 bindDN:"cn=orcladmin"}>
    <1291668685624> <BEA-000000> <authenticate user:myadmin>
    <1291668685624> <BEA-000000> <getDNForUser search("ou=AppAdmins, o=gc, c=ca", "(&(uid=myadmin)(objectclass=person))", base DN & below)>
    <1291668685671> <BEA-000000> <DN for user myadmin: uid=myadmin,ou=AppAdmins,o=gc,c=ca>
    <1291668685671> <BEA-000000> <authenticate user:myadmin with DN:uid=myadmin,ou=AppAdmins,o=gc,c=ca>
    <1291668685671> <BEA-000000> <authentication succeeded>
    <1291668685686> <BEA-000000> <returnConnection conn:LDAPConnection {ldaps://pmpdeva-idm.ncr.pwgsc.gc.ca:1389 ldapVersion:3 bindDN:"cn=orcladmin"}>
    <1291668685686> <BEA-000000> <LDAP Atn Authenticated User myadmin>
    <1291668685686> <BEA-000000> <List groups that member: myadmin belongs to>
    <1291668685686> <BEA-000000> <getConnection return conn:LDAPConnection {ldaps://pmpdeva-idm.ncr.pwgsc.gc.ca:1389 ldapVersion:3 bindDN:"cn=orcladmin"}>
    <1291668685686> <BEA-000000> <getDNForUser search("ou=AppAdmins, o=gc, c=ca", "(&(uid=myadmin)(objectclass=person))", base DN & below)>
    <1291668685686> <BEA-000000> <DN for user myadmin: uid=myadmin,ou=AppAdmins,o=gc,c=ca>
    <1291668685686> <BEA-000000> <search("ou=IDM, ou=ServiceAccounts, o=gc, c=ca", "(&(uniquemember=uid=myadmin,ou=AppAdmins,o=gc,c=ca)(objectclass=groupofuniquenames))", base DN & below)>
    <1291668685686> <BEA-000000> <Result has more elements: false>
    <1291668685686> <BEA-000000> <returnConnection conn:LDAPConnection {ldaps://pmpdeva-idm.ncr.pwgsc.gc.ca:1389 ldapVersion:3 bindDN:"cn=orcladmin"}>
    <1291668685686> <BEA-000000> <login succeeded for username myadmin>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.login delegated, returning true>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.commit>
    <1291668685686> <BEA-000000> <LDAP Atn Commit>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.commit delegated, returning false>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.commit>
    <1291668685686> <BEA-000000> <LDAP Atn Commit>
    <1291668685686> <BEA-000000> <LDAP Atn Principals Added>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.LoginModuleWrapper.commit delegated, returning true>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.JAASLoginServiceImpl.login logged in>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.JAASLoginServiceImpl.login subject=Subject:
         Principal: myadmin
    >
    <1291668685686> <BEA-000000> <weblogic.security.service.internal.WLSIdentityServiceImpl.getIdentityFromSubject Subject: 1
         Principal = class weblogic.security.principal.WLSUserImpl("myadmin")
    >
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.sign(Principals)>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.sign(Principal) Principal=myadmin>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.sign(Principal) PrincipalClassName=weblogic.security.principal.WLSUserImpl>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.sign(Principal) trying PrincipalValidator for interface weblogic.security.principal.WLSPrincipal>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.sign(Principal) PrincipalValidator handles this PrincipalClass>
    <1291668685686> <BEA-000000> <Signed WLS principal myadmin>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.sign(Principal) PrincipalValidator signed the principal>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.sign(Principal) All required PrincipalValidators signed this PrincipalClass, returning true>
    <1291668685686> <BEA-000000> <com.bea.common.security.internal.service.JAASLoginServiceImpl.login identity=Subject: 1
         Principal = class weblogic.security.principal.WLSUserImpl("myadmin")
    >
    <1291668685686> <BEA-000000> <weblogic.security.service.internal.WLSJAASLoginServiceImpl$ServiceImpl.authenticate authenticate succeeded for user myadmin, Identity=Subject: 1
         Principal = class weblogic.security.principal.WLSUserImpl("myadmin")
    >
    <1291668685686> <BEA-000000> <weblogic.security.service.internal.UserLockoutServiceImpl$ServiceImpl.isLocked(myadmin)>
    <1291668685686> <BEA-000000> <weblogic.security.service.internal.WLSJAASLoginServiceImpl$ServiceImpl.authenticate login succeeded and myadmin was not previously locked out>
    <1291668685702> <BEA-000000> <Using Common RoleMappingService>
    <1291668685702> <BEA-000000> <PrincipalAuthenticator.validateIdentity>
    <1291668685702> <BEA-000000> <PrincipalAuthenticator.validateIdentity will use common security service>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.validate(Principals)>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.validate(Principal) Principal=myadmin>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.validate(Principal) PrincipalClassName=weblogic.security.principal.WLSUserImpl>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.validate(Principal) trying PrincipalValidator for interface weblogic.security.principal.WLSPrincipal>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.validate(Principal) PrincipalValidator handles this PrincipalClass>
    <1291668685702> <BEA-000000> <Validate WLS principal myadmin returns true>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.validate(Principal) PrincipalValidator said the principal is valid>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.validate(Principal) One or more PrincipalValidators handled this PrincipalClass, returning true>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.PrincipalValidationServiceImpl.validate(Principals) validated all principals>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.RoleMappingServiceImpl.getRoles Identity=Subject: 1
         Principal = class weblogic.security.principal.WLSUserImpl("myadmin")
    >
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.RoleMappingServiceImpl.getRoles Resource=type=<url>, application=consoleapp, contextPath=/console, uri=/index.jsp, httpMethod=GET>
    <1291668685702> <BEA-000000> <XACML RoleMapper getRoles(): input arguments:>
    <1291668685702> <BEA-000000> <     Subject: 1
         Principal = weblogic.security.principal.WLSUserImpl("myadmin")
    >
    <1291668685702> <BEA-000000> <     Resource: type=<url>, application=consoleapp, contextPath=/console, uri=/index.jsp, httpMethod=GET>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp, contextPath=/console, uri=/index.jsp>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp, contextPath=/console, uri=/index.jsp/*, httpMethod=GET>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp, contextPath=/console, uri=/index.jsp/*>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp, contextPath=/console, uri=/*, httpMethod=GET>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp, contextPath=/console, uri=/*>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp, contextPath=/console, uri=*.jsp, httpMethod=GET>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp, contextPath=/console, uri=*.jsp>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp, contextPath=/console, uri=/, httpMethod=GET>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp, contextPath=/console, uri=/>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp, contextPath=/console>
    <1291668685702> <BEA-000000> <     Parent: type=<url>, application=consoleapp>
    <1291668685702> <BEA-000000> <     Parent: type=<app>, application=consoleapp>
    <1291668685702> <BEA-000000> <     Parent: type=<url>>
    <1291668685702> <BEA-000000> <     Parent: null>
    <1291668685702> <BEA-000000> <     Context Handler: >
    <1291668685702> <BEA-000000> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users]>
    <1291668685702> <BEA-000000> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(AdminChannelUsers,[everyone,users]) -> false>
    <1291668685702> <BEA-000000> <primary-rule evaluates to NotApplicable because of Condition>
    <1291668685702> <BEA-000000> <urn:bea:xacml:2.0:entitlement:role:AdminChannelUser:, 1.0 evaluates to Deny>
    <1291668685702> <BEA-000000> <XACML RoleMapper: accessing role AdminChannelUser: DENIED>
    <1291668685702> <BEA-000000> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users]>
    <1291668685702> <BEA-000000> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(AppTesters,[everyone,users]) -> false>
    <1291668685702> <BEA-000000> <primary-rule evaluates to NotApplicable because of Condition>
    <1291668685702> <BEA-000000> <urn:bea:xacml:2.0:entitlement:role:AppTester:, 1.0 evaluates to Deny>
    <1291668685702> <BEA-000000> <XACML RoleMapper: accessing role AppTester: DENIED>
    <1291668685702> <BEA-000000> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users]>
    <1291668685702> <BEA-000000> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(everyone,[everyone,users]) -> true>
    <1291668685702> <BEA-000000> <primary-rule evaluates to Permit>
    <1291668685702> <BEA-000000> <urn:bea:xacml:2.0:entitlement:role:Anonymous:, 1.0 evaluates to Permit>
    <1291668685702> <BEA-000000> <XACML RoleMapper: accessing role Anonymous: GRANTED>
    <1291668685702> <BEA-000000> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users]>
    <1291668685702> <BEA-000000> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(Monitors,[everyone,users]) -> false>
    <1291668685702> <BEA-000000> <primary-rule evaluates to NotApplicable because of Condition>
    <1291668685702> <BEA-000000> <urn:bea:xacml:2.0:entitlement:role:Monitor:, 1.0 evaluates to Deny>
    <1291668685702> <BEA-000000> <XACML RoleMapper: accessing role Monitor: DENIED>
    <1291668685702> <BEA-000000> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users]>
    <1291668685702> <BEA-000000> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(Operators,[everyone,users]) -> false>
    <1291668685702> <BEA-000000> <primary-rule evaluates to NotApplicable because of Condition>
    <1291668685702> <BEA-000000> <urn:bea:xacml:2.0:entitlement:role:Operator:, 1.0 evaluates to Deny>
    <1291668685702> <BEA-000000> <XACML RoleMapper: accessing role Operator: DENIED>
    <1291668685702> <BEA-000000> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users]>
    <1291668685702> <BEA-000000> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(CrossDomainConnectors,[everyone,users]) -> false>
    <1291668685702> <BEA-000000> <primary-rule evaluates to NotApplicable because of Condition>
    <1291668685702> <BEA-000000> <urn:bea:xacml:2.0:entitlement:role:CrossDomainConnector:, 1.0 evaluates to Deny>
    <1291668685702> <BEA-000000> <XACML RoleMapper: accessing role CrossDomainConnector: DENIED>
    <1291668685702> <BEA-000000> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users]>
    <1291668685702> <BEA-000000> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(Deployers,[everyone,users]) -> false>
    <1291668685702> <BEA-000000> <primary-rule evaluates to NotApplicable because of Condition>
    <1291668685702> <BEA-000000> <urn:bea:xacml:2.0:entitlement:role:Deployer:, 1.0 evaluates to Deny>
    <1291668685702> <BEA-000000> <XACML RoleMapper: accessing role Deployer: DENIED>
    <1291668685702> <BEA-000000> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, SC=null, Value=[everyone,users]>
    <1291668685702> <BEA-000000> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(Administrators,[everyone,users]) -> false>
    <1291668685702> <BEA-000000> <primary-rule evaluates to NotApplicable because of Condition>
    <1291668685702> <BEA-000000> <urn:bea:xacml:2.0:entitlement:role:Admin:, 1.0 evaluates to Deny>
    <1291668685702> <BEA-000000> <XACML RoleMapper: accessing role Admin: DENIED>
    <1291668685702> <BEA-000000> <XACML RoleMapper getRoles(): returning roles Anonymous>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.RoleMappingServiceImpl.getRoles returning [ "Anonymous" ]>
    <1291668685702> <BEA-000000> <AuthorizationManager will use common security for ATZ>
    <1291668685702> <BEA-000000> <weblogic.security.service.WLSAuthorizationServiceWrapper.isAccessAllowed>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.AccessDecisionServiceImpl.isAccessAllowed Identity=Subject: 1
         Principal = class weblogic.security.principal.WLSUserImpl("myadmin")
    >
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.AccessDecisionServiceImpl.isAccessAllowed Roles=[ "Anonymous" ]>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.AccessDecisionServiceImpl.isAccessAllowed Resource=type=<url>, application=consoleapp, contextPath=/console, uri=/index.jsp, httpMethod=GET>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.AccessDecisionServiceImpl.isAccessAllowed Direction=ONCE>
    <1291668685702> <BEA-000000> <XACML Authorization isAccessAllowed(): input arguments:>
    <1291668685702> <BEA-000000> <     Subject: 1
         Principal = weblogic.security.principal.WLSUserImpl("myadmin")
    >
    <1291668685702> <BEA-000000> <     Roles:Anonymous>
    <1291668685702> <BEA-000000> <     Resource: type=<url>, application=consoleapp, contextPath=/console, uri=/index.jsp, httpMethod=GET>
    <1291668685702> <BEA-000000> <     Direction: ONCE>
    <1291668685702> <BEA-000000> <     Context Handler: >
    <1291668685702> <BEA-000000> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:role, SC=null, Value=Anonymous>
    <1291668685702> <BEA-000000> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of([Admin,Operator,Deployer,Monitor],Anonymous) -> false>
    <1291668685702> <BEA-000000> <primary-rule evaluates to NotApplicable because of Condition>
    <1291668685702> <BEA-000000> <urn:bea:xacml:2.0:entitlement:resource:type@E@Furl@G@M@Oapplication@Econsoleapp@M@OcontextPath@E@Uconsole@M@Ouri@E@U, 1.0 evaluates to Deny>
    <1291668685702> <BEA-000000> <XACML Authorization isAccessAllowed(): returning DENY>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.AccessDecisionServiceImpl.isAccessAllowed AccessDecision returned DENY>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.AdjudicationServiceImpl.adjudicate Results=[ DENY ]>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.AdjudicationServiceImpl.adjudicate Resource=type=<url>, application=consoleapp, contextPath=/console, uri=/index.jsp, httpMethod=GET>
    <1291668685702> <BEA-000000> <DefaultAdjudicatorImpl.adjudicate results: DENY >
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.AdjudicationServiceImpl.adjudicate Adjudictor returned false, returning that value>
    <1291668685702> <BEA-000000> <com.bea.common.security.internal.service.AuthorizationServiceImpl.isAccessAllowed returning adjudicated: false>

    Okay Finally the issue is resolved. Here is the findings to help others in case they ran into the same issue.
    The OID version that we are using is not returning the groups the way Weblogic is building the ldapsearch command. We captured the ldap traffic to go deeper and noticed the filters and attributes list that wls was asking. For example, the filter was like:
    "(&(uniquemember=uid=myadmin,ou=AppAdmins,o=gc,c=ca)(objectclass=groupofuniquenames))" cn
    its was the "cn" attribute that was causing the result set to be empty.
    from a command line we tried
    "(&(uniquemember=uid=myadmin,ou=AppAdmins,o=gc,c=ca)(objectclass=groupofuniquenames))" uniquemember
    and got the results back.
    Then we start looking into OID configuration and one of my coworker pointed me towards the orclinmemfiltprocess attributes in cn=dsaconfig entry and told me that they had lot of issues in the past in relation to this attribute.
    So as a test we removed the groupofuniquenames objectclass from the orclinmemfiltprocess attribute list and bingo it worked!
    Since we needed the groupofuniquenames in this list for performance/other reasons and decided to use a different objectclass for our groups instead i.e. orclGroup.
    Thanks everyone for showing interest on the problem and providing suggestions.

  • ASA 8.2.5 LDAP authentication by memberof doesn't always work

    I've configured LDAP authentication to allow access if  members are a member of the "VPN_Users" Group.  This configuration is  working, but only for some users.  For other users it isn't.  The output  of the 'debug ldap 255' shows an output of memberOf for the users that  it's working for, but shows nothing for users it's not working for.   I've not been able to figure out any connection or differences that are  the same between those users that work and those that don't.  Any idea on what might be causing this problem?  Both working and non-working users will authenticate, its just some of them don't pull the memberof data in the ldap query.
    Config:
    aaa-server AD protocol ldap
    aaa-server AD (inside) host btfs2
    ldap-base-dn dc=localdomain,dc=com
    ldap-scope subtree
    ldap-naming-attribute samAccountName
    ldap-login-password *****
    ldap-login-dn [email protected]
    server-type microsoft
    ldap-attribute-map VPNGroup
    ldap attribute-map VPNGroup
      map-name  memberOf IETF-Radius-Class
      map-value memberOf "CN=VPN_Users,OU=Security Groups,OU=Company OU,DC=localdomain,DC=com" btvpn
    group-policy NOACCESS internal
    group-policy NOACCESS attributes
    vpn-simultaneous-logins 0
    vpn-tunnel-protocol IPSec svc
    webvpn
      svc ask none default svc
    group-policy btvpn internal
    group-policy btvpn attributes
    banner value This is a private data network. All connections are logged and are subject to
    banner value monitoring. Unauthorized access is prohibited and will be prosecuted.
    dns-server value 10.0.0.x 10.0.0.y
    vpn-simultaneous-logins 10
    vpn-tunnel-protocol IPSec l2tp-ipsec svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value splittun
    default-domain value localdomain.com
    webvpn
      svc keep-installer installed
      svc rekey time 120
      svc rekey method ssl
      svc ask enable default svc
    tunnel-group btvpn type remote-access
    tunnel-group btvpn general-attributes
    address-pool vpnpool
    authentication-server-group AD LOCAL
    default-group-policy NOACCESS
    tunnel-group btvpn webvpn-attributes
    group-alias webvpn enable
    tunnel-group btvpn ipsec-attributes
    pre-shared-key *****
    Non-working user:
    [1575] Session Start
    [1575] New request Session, context 0xd7fbf210, reqType = Authentication
    [1575] Fiber started
    [1575] Creating LDAP context with uri=ldap://10.0.0.x:389
    [1575] Connect to LDAP server: ldap://10.0.0.x:389, status = Successful
    [1575] supportedLDAPVersion: value = 3
    [1575] supportedLDAPVersion: value = 2
    [1575] Binding as [email protected]
    [1575] Performing Simple authentication for [email protected] to 10.0.0.x
    [1575] LDAP Search:
            Base DN = [dc=localdomain,dc=com]
            Filter  = [samAccountName=cmcbride]
            Scope   = [SUBTREE]
    [1575] User DN = [CN=Chris McBride,OU=Administrators,OU=Company OU,DC=localdomain,DC=com]
    [1575] Talking to Active Directory server 10.0.0.x
    [1575] Reading password policy for cmcbride, dn:CN=Chris McBride,OU=Administrators,OU=Company OU,DC=localdomain,DC=com
    [1575] Binding as cmcbride
    [1575] Performing Simple authentication for cmcbride to 10.0.0.x
    [1575] Processing LDAP response for user cmcbride
    [1575] Message (cmcbride):
    [1575] Authentication successful for cmcbride to 10.0.0.x
    [1575] Retrieved User Attributes:
    [1575]  objectClass: value = top
    [1575]  objectClass: value = person
    [1575]  objectClass: value = organizationalPerson
    [1575]  objectClass: value = user
    [1575]  cn: value = Chris McBride
    [1575]  sn: value = McBride
    [1575]  l: value = Tulsa
    [1575]  description: value = cmcbride non-admin test account
    [1575]  givenName: value = Chris
    [1575]  distinguishedName: value = CN=Chris McBride,OU=Administrators,OU=Company OU,DC=localdomain,DC=co
    [1575]  displayName: value = Chris McBride
    [1575]  name: value = Chris McBride
    [1575]  objectGUID: value = ....5..L...[..K.
    [1575]  codePage: value = 0
    [1575]  countryCode: value = 0
    [1575]  primaryGroupID: value = 513
    [1575]  objectSid: value = ...............1...{C..2....
    [1575]  sAMAccountName: value = cmcbride
    [1575]  sAMAccountType: value = 805306368
    [1575]  userPrincipalName: value = [email protected]
    [1575]  objectCategory: value = CN=Person,CN=Schema,CN=Configuration,DC=localdomain,DC=com
    [1575] Fiber exit Tx=616 bytes Rx=2007 bytes, status=1
    [1575] Session End
    Working user:
    [1585] Session Start
    [1585] New request Session, context 0xd7fbf210, reqType = Authentication
    [1585] Fiber started
    [1585] Creating LDAP context with uri=ldap://10.0.0.x:389
    [1585] Connect to LDAP server: ldap://10.0.0.x:389, status = Successful
    [1585] supportedLDAPVersion: value = 3
    [1585] supportedLDAPVersion: value = 2
    [1585] Binding as [email protected]
    [1585] Performing Simple authentication for [email protected] to 10.0.0.x
    [1585] LDAP Search:
            Base DN = [dc=localdomain,dc=com]
            Filter  = [samAccountName=cmcbride_a]
            Scope   = [SUBTREE]
    [1585] User DN = [CN=Admin Chris McBride,OU=Administrators,OU=Company OU,DC=localdomain,DC=com]
    [1585] Talking to Active Directory server 10.0.0.x
    [1585] Reading password policy for cmcbride_a, dn:CN=Admin Chris McBride,OU=Administrators,OU=Company OU,DC=localdomain,DC=com
    [1585] Read bad password count 0
    [1585] Binding as cmcbride_a
    [1585] Performing Simple authentication for cmcbride_a to 10.0.0.x
    [1585] Processing LDAP response for user cmcbride_a
    [1585] Message (cmcbride_a):
    [1585] Authentication successful for cmcbride_a to 10.0.0.x
    [1585] Retrieved User Attributes:
    [1585]  objectClass: value = top
    [1585]  objectClass: value = person
    [1585]  objectClass: value = organizationalPerson
    [1585]  objectClass: value = user
    [1585]  cn: value = Admin Chris McBride
    [1585]  sn: value = McBride
    [1585]  description: value = PTC User, cjm 05312011
    [1585]  givenName: value = Chris
    [1585]  distinguishedName: value = CN=Admin Chris McBride,OU=Administrators,OU=Company OU,DC=localdomain
    [1585]  instanceType: value = 4
    [1585]  whenCreated: value = 20110525173004.0Z
    [1585]  whenChanged: value = 20110619154158.0Z
    [1585]  displayName: value = Admin Chris McBride
    [1585]  uSNCreated: value = 6188062
    [1585]  memberOf: value = CN=VPN_Users,OU=Security Groups,OU=Company OU,DC=localdomain,DC=com
    [1585]          mapped to IETF-Radius-Class: value = btvpn
    [1585]          mapped to LDAP-Class: value = btvpn
    [1585]  memberOf: value = CN=Websense Filtered Group,OU=Distribution Groups,OU=Company OU,DC=baer-t
    [1585]          mapped to IETF-Radius-Class: value = CN=Websense Filtered Group,OU=Distribution Groups,OU=Company OU,DC=localdomain,DC=com
    [1585]          mapped to LDAP-Class: value = CN=Websense Filtered Group,OU=Distribution Groups,OU=Company OU,DC=localdomain,DC=com
    [1585]  memberOf: value = CN=TS_Sec_Admin,OU=Terminal Server 2003,DC=localdomain,DC=com
    [1585]          mapped to IETF-Radius-Class: value = CN=TS_Sec_Admin,OU=Terminal Server 2003,DC=localdomain,DC=com
    [1585]          mapped to LDAP-Class: value = CN=TS_Sec_Admin,OU=Terminal Server 2003,DC=localdomain,DC=com
    [1585]  memberOf: value = CN=Domain Admins,CN=Users,DC=localdomain,DC=com
    [1585]          mapped to IETF-Radius-Class: value = CN=Domain Admins,CN=Users,DC=localdomain,DC=com
    [1585]          mapped to LDAP-Class: value = CN=Domain Admins,CN=Users,DC=localdomain,DC=com
    [1585]  memberOf: value = CN=Enterprise Admins,CN=Users,DC=localdomain,DC=com
    [1585]          mapped to IETF-Radius-Class: value = CN=Enterprise Admins,CN=Users,DC=localdomain,DC=com
    [1585]          mapped to LDAP-Class: value = CN=Enterprise Admins,CN=Users,DC=localdomain,DC=com
    [1585]  memberOf: value = CN=Schema Admins,CN=Users,DC=localdomain,DC=com
    [1585]          mapped to IETF-Radius-Class: value = CN=Schema Admins,CN=Users,DC=localdomain,DC=com
    [1585]          mapped to LDAP-Class: value = CN=Schema Admins,CN=Users,DC=localdomain,DC=com
    [1585]  uSNChanged: value = 6560745
    [1585]  name: value = Admin Chris McBride
    [1585]  objectGUID: value = ..Kj4..E..c.VCHT
    [1585]  userAccountControl: value = 512
    [1585]  badPwdCount: value = 0
    [1585]  codePage: value = 0
    [1585]  countryCode: value = 0
    [1585]  badPasswordTime: value = 129531669834218721
    [1585]  lastLogoff: value = 0
    [1585]  lastLogon: value = 129532463799841621
    [1585]  scriptPath: value = SLOGIC.BAT
    [1585]  pwdLastSet: value = 129508182041981337
    [1585]  primaryGroupID: value = 513
    [1585]  objectSid: value = ...............1...{C..2. ..
    [1585]  adminCount: value = 1
    [1585]  accountExpires: value = 9223372036854775807
    [1585]  logonCount: value = 90
    [1585]  sAMAccountName: value = cmcbride_a
    [1585]  sAMAccountType: value = 805306368
    [1585]  userPrincipalName: value = [email protected]
    [1585]  objectCategory: value = CN=Person,CN=Schema,CN=Configuration,DC=localdomain,DC=com
    [1585]  dSCorePropagationData: value = 20110525174152.0Z
    [1585]  dSCorePropagationData: value = 16010101000000.0Z
    [1585]  lastLogonTimestamp: value = 129529717185508866
    [1585]  msTSExpireDate: value = 20110803160858.0Z
    [1585]  msTSLicenseVersion: value = 393216
    [1585]  msTSManagingLS: value = 92573-029-5868087-27549
    [1585] Fiber exit Tx=633 bytes Rx=3420 bytes, status=1
    [1585] Session End

    As far as your configuration is concerned it looks perfectly fine. As you mentioned that the difference between the working and non working debugs is that in the non working debugs we do not see memberof attribute being retrieved.
    the main reason could be that the username "[email protected]" with which you are performing the LDAP bind does not have sufficient privileges to retreive all the attributes from all the users in the AD. This looks like permission issue at the AD user level.
    One thing you can try on the AD is to "Delegate Control" to this user ([email protected]) to "Read all properties" for all users and not just a subset of users. Please get in touch with AD Admin before making such a change on the AD.
    Here is an external link just to give an idea about delegation of control to "Read all properties"
    http://www.advproxy.net/ldapads.html

  • Open LDAP Authenticator Configuration on WLSSP5

    I have problems in the open LDAP authenticator configuration on Weblogic Server with Service Pack 5. I have users on OpenLDAP Server that do not belong to any group. My LDIF file contents are as given below.
    dn: dc=my-domain,dc=com
    dc: my-domain
    objectClass: dcObject
    objectClass: organization
    o: MYABC, Inc
    dn: cn=Manager, dc=my-domain,dc=com
    userPassword:: c2VjcmV0
    objectClass: person
    sn: Manager
    cn: Manager
    dn: cn=myabcsystem, dc=my-domain,dc=com
    userPassword:: dmVuZGF2b3N5c3RlbQ==
    objectClass: person
    sn: myabcsystem
    cn: myabcsystem
    dn: cn=Philippe, dc=my-domain,dc=com
    userPassword:: UGhpbGlwcGU=
    objectClass: person
    sn: Philippe
    cn: Philippe
    dn: cn=mlrick, dc=my-domain,dc=com
    userPassword:: bWxyaWNr
    objectClass: person
    sn: mlrick
    cn: mlrick
    All these users appear in the Users tab after configuration on the console only if LDAP Server is up. While I select group tab, I get errors indicating BAD SEARCH Filter.
    Inspite of me not having any groups in the ldap as indicated in ldif contents.
    While I try to login t the application with this LDAP configuration, I do not get any errors. LDAP authentication is not happening with just the LDAP authenticator in place. Even if I stop the LDAP server, I do nto get any exceptions while trying ot login. The config params for the Open LADP are as given below
    <weblogic.security.providers.authentication.OpenLDAPAuthenticator
    AllGroupsFilter="objectclass=*"
    Credential="{3DES}rGCpYmhaIorI99BjZ2u6Fg=="
    GroupBaseDN="dc=my-domain,dc=com"
    GroupFromNameFilter="(cn=%u)"
    Name="Security:Name=MYABCAuthenticationOpenLDAPAuthenticator"
    Principal="cn=myabcsystem,dc=my-domain,dc=com"
    Realm="Security:Name=MYABCAuthentication"
    StaticGroupDNsfromMemberDNFilter=""
    StaticGroupNameAttribute="" StaticGroupObjectClass=""
    StaticMemberDNAttribute="" UserBaseDN="dc=my-domain, dc=com"/>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <LDAP ATN LoginModule initialized>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <LDAP Atn Login>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <LDAP Atn Login username: bob>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <getConnection return conn:LDAPConnection { ldapVersion:2 bindDN:""}>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <authenticate user:bob>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <getDNForUser search("ou=people,ou=MYABCAuthentication,dc=myabc", "(&(uid=bob)(objectclass=person))", base DN & below)>
    ####<Mar 3, 2006 4:21:34 PM IST> <Debug> <SecurityDebug> <hemalatha> <myserver> <ExecuteThread: '49' for queue: 'default'> <<WLS Kernel>> <> <000000> <returnConnection conn:LDAPConnection { ldapVersion:2 bindDN:""}>
    CAN ANYONE HELP ME IDENTIFY WHAT IS THE ISSUE. Why is the authentication not happening?

    Hi Amol,
    I've seen this happen at least two times in 11.1.1.1 installs. You can safely restart and then add the service back again. Suggest you reboot after you re-add the service back or cycle all the Hyperion services.
    I was not aware you could install the service with that command.
    I used the below command instead:
    sc create OpenLDAP-slapd start= auto binPath= "D:\Hyperion\...\slapd.exe service" DisplayName= "Hyperion Shared Services OpenLAP"
    Regards,
    -John

  • LDAP Authentication / User-Role in a database (Weblogic Security)

    Hi,
    I would like to configure the Authentication with an LDAP Server (LDAP Authenticator) and the mapping between users and roles in an external database.
    I saw the following post, http://biemond.blogspot.com/2008/12/using-database-tables-as-authentication.html.
    According to the previous post, I created an LDAP Authenticator (trying to use embedded LDAP) and a SQL Authenticator.
    The problem is that it doesn't uses LDAP Authentication, it only uses SQL Authentication.
    I'm looking for a solution where password would remain in the LDAP Server and the username/role mapping would be in the database tables.
    Consider I'm using WLS 10.3 and JDeveloper 11g.
    Any suggestions?
    Thanks in advance,
    Olga

    Hi,
    Check following forum thread.
    Re: custome role maper example
    Regards,
    Kal

  • Ldap authentication on solaris 8 client

    I have directory server 6.0 set up on solaris 9 system. I convert a Solaris 8 system to be a ldap client. However, I can use ssh to authentication against LDAP server. Here is the output I got:
    # ssh -v user@localhost
    SSH Version 1.2.27 [sparc-sun-solaris2.8], protocol version 1.5.
    Standard version. Does not use RSAREF.
    host: Reading configuration data /etc/ssh_config
    host: ssh_connect: getuid 0 geteuid 0 anon 0
    host: Allocated local port 1023.
    host: Connecting to 127.0.0.1 port 22.
    host: Connection established.
    host: Remote protocol version 1.5, remote software version 1.2.27
    host: Waiting for server public key.
    host: Received server public key (768 bits) and host key (1024 bits).
    host: Forcing accepting of host key for localhost.
    host: Host '127.0.0.1' is known and matches the host key.
    host: Initializing random; seed file /root/.ssh/random_seed
    host: Encryption type: idea
    host: Sent encrypted session key.
    host: Installing crc compensation attack detector.
    host: Received encrypted confirmation.
    host: Trying rhosts or /etc/hosts.equiv with RSA host authentication.
    host: Server refused our rhosts authentication or host key.
    host: No agent.
    host: Doing password authentication.
    [email protected]'s password:
    Permission denied.
    This is the pam.conf I use:
    login auth requisite pam_authtok_get.so.1
    login auth required pam_dhkeys.so.1
    login auth required pam_dial_auth.so.1
    login auth binding pam_unix_auth.so.1 server_policy
    login auth required pam_ldap.so.1
    rlogin auth sufficient pam_rhosts_auth.so.1
    rlogin auth requisite pam_authtok_get.so.1
    rlogin auth required pam_dhkeys.so.1
    rlogin auth binding pam_unix_auth.so.1 server_policy
    rlogin auth required pam_ldap.so.1
    rsh auth sufficient pam_rhosts_auth.so.1
    rsh auth binding pam_unix_auth.so.1 server_policy
    rsh auth required pam_ldap.so.1
    ppp auth requisite pam_authtok_get.so.1
    ppp auth required pam_dhkeys.so.1
    ppp auth required pam_dial_auth.so.1
    ppp auth binding pam_unix_auth.so.1 server_policy
    ppp auth required pam_ldap.so.1
    other auth requisite pam_authtok_get.so.1
    other auth required pam_dhkeys.so.1
    other auth binding pam_unix_auth.so.1 server_policy
    other auth required pam_ldap.so.1
    passwd auth binding pam_passwd_auth.so.1 server_policy
    passwd auth required pam_ldap.so.1
    cron account required pam_unix_account.so.1
    other account requisite pam_roles.so.1
    other account binding pam_unix_account.so.1 server_policy
    other account required pam_ldap.so.1
    other session required pam_unix_session.so.1
    other password required pam_dhkeys.so.1
    other password requisite pam_authtok_get.so.1
    other password requisite pam_authtok_check.so.1
    other password required pam_authtok_store.so.1 server_policy
    ppp auth required pam_unix_auth.so.1
    Not sure why Solaris 8 can't authentication with LDAP server. I have applied the patch 108993-67. Also, su and telnet can work with LDAP but not 'ftp' and 'ssh'.
    Any ideas?

    No, my problem seems different.
    The authentication between ldap client and server is through tls:simple. Also, exact same configuration can work with Solaris 9 client, but not Solaris 8 client. Furthur checks on ssh on Solaris 8, the ssh is 'SSH Version 1.2.27 [sparc-sun-solaris2.8], protocol version 1.5.
    Standard version. Does not use RSAREF.'. But on a Solaris 9 client, the ssh is 'SSH Version Sun_SSH_1.0, protocol versions 1.5/2.0.' Not sure why the Solaris 8 ssh can't work with ldap authentication.
    Thanks,
    --xinhuan                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

  • LDAP Authentication "Network Accounts Unavailable" on 10.8

    Hello,
    We've been successfully authenticating against our LDAP servers on our 10.6.8 machines without any problems. I've setup a test machine running 10.8 to see if we will have any issues when it comes time to upgrade our lab OSs. I setup our LDAP authentication on the machine as per our usual methods. I get the "Green Light" in the Users/Groups preferences pane that our LDAP server is found. I can search through our LDAP users in the Directory Editor and I can access LDAP user accounts through terminal.
    My problem is at the login screen it tells me "Network Accounts Unavailable". This seems contradictory as when I'm logged into a local account, I can access our LDAP server. It seems to work everywhere except at the login screen.
    I've tried this openLDAP fix: http://iwatts.blogspot.ca/2012/01/osx-1072-openldap-authentication.html
    No luck.
    Any ideas?

    I see the same problem as a result of having the same UID number for both my local account and my LDAP account although the account names are different.  It appears that upon providing the correct login/password  to the LDAP server, 10.8 looks at the returned UID , identifies it as the same as a local UID and then rejects the login. 
    A security measure I want to work around but perhaps there is a better way of accessing both my local and LDAP accounts but keeping it as easy as it would be if both accounts had the same UID.

  • OBIEE 11.1.1.5.0 ldap authentication provider

    Hi all,
    We are having problem with OBIEE 11.1.1.5.0 .. We create a role and give some permissions to a folder in the catalog with that role. Then we login with a user in that role, the user is not able to see the contents of the folder until we restart the server.. We have LDAP authentication provider.. Could this be related to that ?

    Hi,
    @weblogic Home >Summary of Security Realms >myrealm >Providers >LDAPAuthenticator>Provider Specific>Users
    I tried something like :
    All Users Filter:(&(memberOf=cn=LDAPGroupName,cn=Users,dc=xxxx,dc=yyy,dc=com))
    User From Name Filter: (&(cn=%u)(objectclass=user))
    the original was:
    All Users Filter: (&(uid=*)(objectclass=person))
    User From Name Filter: (&(uid=%u)(objectclass=person))
    and restarted the server but it did not work ...

  • Configuring Oracle 9iAS for LDAP Authentication

    I have installed OID Server on my PC. Now I want to switch my Login Server to External LDAP Authentication mode. For that I run the script ssoldap.sql passing the host, port, search base, etc.. from my login server schema (portal30_sso) The script throws me the following error :
    " Bind variable "CN" not declared ".
    I even compile the package ssoxldap.pkb before that. But still this error persists.
    tnsnames.ora and listener.ora files are fine and the tnsping to the external procedure is also working properly.
    Can anyone help me in this.

    I got that problem solved. Its little bit funny solution. Instead of running the sql file using the File->open->ssoldap.sql, we should directly write the whole path i.e. @d:\oracle9i\portal30\admin\plsql\sso\ssoldap.sql
    And secondly, I also found one small change related to the installation manual. Its related to Adding entries to the LDAP Server. the manual shows this syntax:
    ldapadd -h i3dt111 -p 389 -D 'cn=orcladmin'
    -w welcome -f d:\oracle\admin\phd\udump\users.ldif
    but instead we shoud write this:
    ldapadd -h i3dt111 -p 389 -D cn=orcladmin
    -w welcome -f d:\oracle\admin\phd\udump\users.ldif
    . Just remove the single quotes in the username string.
    Anyways, thanks for your suggestions.
    null

  • Open LDAP Authentication in SAPNW 7.0 AS ABAP ( Linux)

    Hello ! I need your help please.
    I need to authenticate the SAP Users in a SAPNW 7.0 AS ABAP in Linux  With an existing LDAP Directory (OPENLDAP).
    I Dont have any Windows Active Directory in the infraesctructure. 
    The front end is Windows Xp with SAPGUI7.10 for Windows.
    I know that is is possible to have a LDAP Directory as user data source but only in UME.
    I check this options:
    The Pluggable  Authentication Services ,requires the availability of Sap Web application Server or lower, since PAS interface is not supported any more by the SAP application Server from SAP NW 2004 and UP.
    Java Authentication and Authorization Service ( JAAS ) is not possible because i Need a Sap Netweaver Application Server Java.
    ¿ What options do I have , i am a bit confused ?
    Thanks in advance.

    Gabriel,
    If you want to logon via SAP GUI using any method of authentication which is not the normal userid+password logon via SAP GUI logon screen, then you need to use the SNC-interface which is included in SAP GUI and SAP ABAP AS. If you use SNC, then you need a cryptographic library which allows you to authenticate outside of SAP, then the credentials obtained are used to establish a security context for authentication purposes. The problem is that LDAP protocol is not a secure method of authentication. I therefore doubt you will find any LDAP authentication solution that works with SNC, mostly because it is not technical practical or even possible to code such an authentication method.
    For web logon to SAP ABAP, if you cannot use the standard methods included in ABAP engine, you need to use the JAAS custom login modules, which (as you indicated) will require a J2EE engine to be setup in your landscape, and use to authetnicate users to ABAP applications via a browser redirect.
    I am intersted how your XP wrokstation users logon to their workstation without Active Directory ? Are they using local accounts, and no domain is used, or are you using Novell as your domain for user authentication ?
    Thanks,
    Tim

Maybe you are looking for

  • How to set a default value in a Value Help Drop Down List

    Hi, I used an age Range field in my adobe form, the control  is a Value Help Drop Down List. i am populating the drop down using following code. IWDAttributeInfo ageInfo = wdContext.nodePersonalData().getNodeInfo().getAttribute("CTAgeRange");      IS

  • Link to QT videos and display in media holder on same CF page

    I am using a learning object which I downloaded from Macromedia many years ago. The white paper which came with it was very usueful in parts but did not cover this problem. One of the interactions which I was never able to get to work as given was fo

  • Rented movie download stuck

    I have rented two movies in iTunes with my iPhone an successfully downloaded one. The second movie downloaded 500mb and stopped. Now when I try to restart the download I get and error saying tap to retry. I have tapped for a day and am all tapped out

  • Changing focus and highlight of text in item

    Hi I have a field that is displaying messages on the form and I do not have it set to display only because this mucks up the custom colour settings of the text required. A user can navigate into this field but cannot do anything bar highlight the tex

  • Adobe form development using WD ABAP

    Hi, I am a begineer to ABAP PDF Form development. Anyone could help me to develop Adobe interactive forms (online and offline cases) using ABAP WebDynpro. I would need step by step procedures to develop quickly. I have found the material mostly relat