Web-controller Active Directory authentication

We have a 10.5.7 xserve as our Podcast Producer server. The server is tied to Active Directory for authentication. I just recently installed the web controller. When I authenticate with a local server account, I get in just fine. But, when I try to authenticate to the web controller with an AD account it fails.
Now I know that since 10.5.6 in Podcast Capture I have had to select "single sign-on" in the app's preferences. Does anyone know if there is something similar in the web controller?

I figured it out. May not be the perfect solution, but it works until 10.5.8.
In /Library/Preferences/com.apple.pcastserverd.plist
Find the following:
<key>httpauthtype</key>
<array>
<string>basic</string>
<string>digest</string>
<string>kerberos</string>
</array>
Change to:
<key>httpauthtype</key>
<array>
<string>basic</string>
</array>
Restart PCP:
sudo launchctl unload /System/Library/LaunchDaemons/com.apple.pcastserverd.plist
sudo launchctl load /System/Library/LaunchDaemons/com.apple.pcastserverd.plist
Log into your server with an AD account at https://server.domain:8143

Similar Messages

  • BO XI 3.1 : Active Directory Authentication failed to get the Active Directory groups

    Dear all 
            In our environment, there are 2 domain (domain A and B); it works well all the time. Today, all the user belong to domain A are not logi n; for user in domain B, all of them can log in but BO server response is very slowly. and there is error message popup when opening Webi report for domain B user. Below are the error message: 
           " Active Directory Authentication failed to get the Active Directory groups for the account with ID:XXXX; pls make sure this account is valid and belongs to an accessible domain"
          Anyone has encountered similar issue?
       BO version: BO XI 3.1 SP5
       Authenticate: Windows AD
    Thanks and Regards

    Please get in touch with your AD team and verify if there are any changes applied to the domain controller and there are no network issues.
    Also since this is a multi domain, make sure you have 2 way transitive forest trust as mentioned in SAP Note : 1323391 and FQDN for Directory servers are maintained in registry as per 1199995
    http://service.sap.com/sap/support/notes/1323391
    http://service.sap.com/sap/support/notes/1199995
    -Ambarish-

  • Weblogic with Active Directory Authentication provider problem: DN for user ....: null

    I have a java application (SSO via SAML2) that uses Weblogic as a Identity Service Provider. All works well using users created directly in Weblogic. However, I need to add support for Active Directory. So, as per documentation:
    - I defined an Active Directory Authentication provider
    - changed it's order in the Authentication Providers list so that it comes first
    - set the control flag to SUFFICIENT and configured the Provider Specific; here's the concerned part in config.xml:
    <sec:authentication-provider xsi:type="wls:active-directory-authenticatorType">
            <sec:name>MyOwnADAuthenticator</sec:name>
            <sec:control-flag>SUFFICIENT</sec:control-flag>
            <wls:propagate-cause-for-login-exception>true</wls:propagate-cause-for-login-exception>
            <wls:host>10.20.150.4</wls:host>
            <wls:port>5000</wls:port>
            <wls:ssl-enabled>false</wls:ssl-enabled>
            <wls:principal>CN=tadmin,CN=wl,DC=at,DC=com</wls:principal>
            <wls:user-base-dn>CN=wl,DC=at,DC=com</wls:user-base-dn>
            <wls:credential-encrypted>{AES}deleted</wls:credential-encrypted>
            <wls:cache-enabled>false</wls:cache-enabled>
            <wls:group-base-dn>CN=wl,DC=at,DC=com</wls:group-base-dn>
    </sec:authentication-provider>
    I configured a AD LDS instance(Active Directory Lightweight Directory Services) on a Windows Server 2008 R2. I created users and one admin user "tadmin" which was added to Administrators members. I also made sure to set msDS-UserAccountDisabled property to FALSE.
    After restarting Weblogic I can see that the AD LDS's users and groups are correctly fetched in Weblogic. But, when I try to connect with my application, using Username:tadmin and Password:<...> it does not work.
    Here's what I see in the log file:
    <BEA-000000> <LDAP Atn Login username: tadmin>
    <BEA-000000> <authenticate user:tadmin>
    <BEA-000000> <getConnection return conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
    <BEA-000000> <getDNForUser search("CN=wl,DC=at,DC=com", "(&(&(cn=tadmin)(objectclass=user))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))", base DN & below)>
    <BEA-000000> <DN for user tadmin: null>
    <BEA-000000> <returnConnection conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
    <BEA-000000> <getConnection return conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
    <BEA-000000> <getDNForUser search("CN=wl,DC=at,DC=com", "(&(&(cn=tadmin)(objectclass=user))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))", base DN & below)>
    <BEA-000000> <DN for user tadmin: null>
    <BEA-000000> <returnConnection conn:LDAPConnection {ldaps://10.20.150.4:5000 ldapVersion:3 bindDN:"CN=tadmin,CN=wl,DC=at,DC=com"}>
    <BEA-000000> <javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User tadmin denied
      at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:229)
      at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
    So, I tried to look why do I have: <DN for user tadmin: null>. Using Apache Directory Studio I reproduced the ldap search request used in Weblogic and, sure enough, I get no results. But, changing the filter to only "(&(cn=tadmin)(objectclass=user))" (NOTICE, no userAccountControl), it works; here's the result from Apache Directory Studio:
    #!SEARCH REQUEST (145) OK
    #!CONNECTION ldap://10.20.150.4:5000
    #!DATE 2014-01-23T14:52:09.324
    # LDAP URL     : ldap://10.20.150.4:5000/CN=wl,DC=at,DC=com?objectClass?sub?(&(cn=tadmin)(objectclass=user))
    # command line : ldapsearch -H ldap://10.20.150.4:5000 -x -D "[email protected]" -W -b "CN=wl,DC=at,DC=com" -s sub -a always -z 1000 "(&(cn=tadmin)(objectclass=user))" "objectClass"
    # baseObject   : CN=wl,DC=at,DC=com
    # scope        : wholeSubtree (2)
    # derefAliases : derefAlways (3)
    # sizeLimit    : 1000
    # timeLimit    : 0
    # typesOnly    : False
    # filter       : (&(cn=tadmin)(objectclass=user))
    # attributes   : objectClass
    #!SEARCH RESULT DONE (145) OK
    #!CONNECTION ldap://10.20.150.4:5000
    #!DATE 2014-01-23T14:52:09.356
    # numEntries : 1
    (the "[email protected]" is defined as userPrincipalName in the tadmin user on AD LDS)
    As you can see, "# numEntries : 1" (and I can see as result the entry "CN=tadmin,CN=wl,DC=at,DC=com"  in Apache Directory Studio's interface); if I add the userAccountControl filter I get 0.
    I've read that the AD LDS does not use userAccountControl but "uses several individual attributes to hold the information that is contained in the flags of the userAccountControl attribute"; among those attributes is msDS-UserAccountDisabled which, as I said, I already set to FALSE.
    So, my question is, how do I make it work? Why do I have "<DN for user tadmin: null>" ? Is it the userAccountControl ? If it is, do I need to do some other configuration on my AD LDS ? Or, how can I get rid of the userAccountControl filter in Weblogic?
    I didn't seem to find it in config files or in the interface: I only have "User From Name Filter: (&(cn=%u)(objectclass=user))", there's no userAccountControl.
    Another difference I noticed is that, even though in Weblogic I have set ssl-enabled flag to false, in the logs I see ldaps and not ldap ( I'm not looking to setup something production-ready and I don't want SSL for the moment ).
    Here are some other things I tried but did not change anything:
    - the other "msDS-" attributes were not set so I tried initializing them to some value
    - I tried other users defined in AD LDS, not tadmin
    - in Weblogic I added users that were imported from AD LDS in Roles and Policies> Realm Roles > Global Roles > Roles > Admin
    - I removed all userAccountControl occurrences that I found in xml files in Weblogic (schema.ms.xml, schema.msad2003.xml)
    Any thoughts?
    Thanks.

    I managed to narrow it down: the AD LDS does not support the userAccountControl.
    Anyone knows how I can configure my Active Directory Authentication Provider in Weblogic so that it does not implicitly use userAccountControl as filter?
    <BEA-000000> <getDNForUser search("CN=wl,DC=at,DC=com", "(&(&(cn=tadmin)(objectclass=user))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))", base DN & below)> 

  • Unable to find user list in Active Directory Authenticator

    Hi all,
    I am using weblogic 10.3 and want to configure ActiveDirectory Authenticator for my weblogic application. We have one managed srever under admin server . I have configured a Active Directory Authenticator named "ADAuthenticator" and made following changes as per the below values:
    I set the control flag to "OPTIONAL" .
    Security Realms-->myrealm-->Providers-->ADAuthenticator-->Provider Specific
    UserName Attribute : ServiceBEA
    Principal : ServiceBEA
    Host : xxxxxx
    User Search Scope : subtree
    Group From Name Filter : (&(ServiceBEA=%g)(objectclass=group))
    Credential : xxxxxx
    Confirm Credential : xxxxxx
    User From Name Filter : (&(ServiceBEA=%u)(objectclass=user))
    Static Group Name Attribute : ServiceBEA
    User Base DN : values provided as per requirement
    Port : 389
    User Object Class : user
    Use Retrieved User Name as Principal : checked
    Group Base DN : same values as per User Base DN
    Static Group Object Class : group
    Group Membership Searching : unlimited
    Max Group Membership Search Level : 0
    These are my AD settings. After doing this i click on save and then activate changes and then restarted the admin server.
    But the problem is when i login to weblogic console to check the user list under "User and Group" i am unble to find any Active Directory users.
    I don't know where i made the mistake. Can some make me out of this trouble.
    Any help is highly appreciated.
    Thanks in advance !

    Hi Sean,
    Actually we have already a Active Directory with username "ServiceBEA" in our windows server. So i used this "ServiceBEA" as UserName Attribute in weblogic console while creating a Active Directory Authenticator.
    You mean to say that we should go for "sAMAccountName" or what? If that is the case then i have also tested with following values, but still no luck.
    UserName Attribute : sAMAccountName
    Principal : ServiceBEA
    Host : xxxxxx
    User Search Scope : subtree
    Group From Name Filter : (&(sAMAccountName=%g)(objectclass=group))
    Credential : xxxxxx
    Confirm Credential : xxxxxx
    User From Name Filter : (&(sAMAccountName=%u)(objectclass=user))
    Static Group Name Attribute : sAMAccountName
    User Base DN : values provided as per requirement
    Port : 389
    User Object Class : user
    Use Retrieved User Name as Principal : checked
    Group Base DN : same values as per User Base DN
    Static Group Object Class : group
    Group Membership Searching : unlimited
    Max Group Membership Search Level : 0
    Please advise what to be place in case of User Name Attribute.
    Any help is highly appreciated.
    Thanks in advance !

  • Active Directory Authentication in Weblogic 8.1

    Hi,
    We want to do authentication from Microsoft Active Directory using weblogic 8.1.
    I have created a Active directory and
    configured weblogic from console to use it. But it is still not working. Your
    help with these question would be highly
    appreciated.
    1. Is there anyone in group who have tried this before. Please let me know how
    to proceed.
    2. Is there any tool by which I can get to know the different attribute asked
    for configuration in Weblogic?
    3. I am not able to login to my application after configuration. Is there any
    other way to come to know whether it is working
    or not?
    There could be plethora of reason but nothing which can come to my mind. Everything
    seems to be configured correctly. Here is
    portion of my config.xml related with authentication:
    <FileRealm Name="wl_default_file_realm"/>
    <PasswordPolicy Name="wl_default_password_policy"/>
    <Realm FileRealm="wl_default_file_realm" Name="wl_default_realm"/>
    <Security GuestDisabled="false" Name="vendavo-dev"
    PasswordPolicy="wl_default_password_policy"
    Realm="wl_default_realm" RealmSetup="true">
    <weblogic.security.providers.authentication.DefaultAuthenticator
    ControlFlag="SUFFICIENT"
    Name="Security:Name=myrealmDefaultAuthenticator" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authentication.DefaultIdentityAsserter
    ActiveTypes="AuthenticatedUser"
    Name="Security:Name=myrealmDefaultIdentityAsserter" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultRoleMapper
    Name="Security:Name=myrealmDefaultRoleMapper" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultAuthorizer
    Name="Security:Name=myrealmDefaultAuthorizer" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultAdjudicator
    Name="Security:Name=myrealmDefaultAdjudicator" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.credentials.DefaultCredentialMapper
    Name="Security:Name=myrealmDefaultCredentialMapper" Realm="Security:Name=myrealm"/>
    <weblogic.management.security.authentication.UserLockoutManager
    Name="Security:Name=myrealmUserLockoutManager" Realm="Security:Name=myrealm"/>
    <weblogic.management.security.Realm
    Adjudicator="Security:Name=myrealmDefaultAdjudicator"
    AuthenticationProviders="Security:Name=myrealmDefaultAuthenticator|Security:Name=myrealmDefaultIdentityAsserter|Security:Name
    =myrealmADAuthenticator"
    Authorizers="Security:Name=myrealmDefaultAuthorizer"
    CredentialMappers="Security:Name=myrealmDefaultCredentialMapper"
    DefaultRealm="true" DisplayName="myrealm"
    Name="Security:Name=myrealm"
    RoleMappers="Security:Name=myrealmDefaultRoleMapper"
    UserLockoutManager="Security:Name=myrealmUserLockoutManager"/>
    <weblogic.security.providers.pk.DefaultKeyStore
    Name="Security:Name=myrealmDefaultKeyStore" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authentication.ActiveDirectoryAuthenticator
    ControlFlag="SUFFICIENT" Credential="{3DES}hvEo4sy7g1E="
    DisplayName="ADAuthenticator" FollowReferrals="false"
    GroupBaseDN="ou=ou=Groups,dc=devdc,dc=com" Host="venper5"
    Name="Security:Name=myrealmADAuthenticator"
    Principal="vendev" Realm="Security:Name=myrealm" UserBaseDN="ou=Users,dc=devdc,dc=com"/>
    </Security>
    First, of all is it possible to use Active Directory authentication in Weblogic
    without writing any custom code. If yes, how?
    Thanks in advance,
    Amit Tyagi

    Amit,
    We have successfully used WLS 8.1 sp1 with AD - but not without our share of ups
    and downs though.
    |
    |
    1) First, make sure you are sending right LDAP queries to AD. To verify this,
    we used free 3rd party LDAP browser from Softerra. There is also java based free
    browser from Univ of Michigan. Personally, I like Softerra's LDAP browser better.
    Play with your LDAP settings using this and make sure AD is returning the right
    data.
    |
    2) AD has some default settings that makes it return only the top 1000 users.
    Use ntdsutil.exe to modify these default settings
    |
    3) AD needs to have the right set of users and groups. To configure this, refer
    to WLS docs. This is very well documented in WLS docs. Also refer to this article
    http://dev2dev.bea.com/products/wlportal/whitepapers/wlp70_MSADS.jsp as additional
    reference
    |
    4) Also, there are some bugs with 8.1 portal sp1 and AD. It cannot take more than
    one Authentication provider. sp2 is supposed to have fixed it. For sp1 we used
    another product AD/AM (AD in Application Mode) in combination with MIIS server.
    But if you are using sp2, you shouldn't be worry about this.
    |
    5) In your providers, you might want to get rid of the DefaultAuthentication provider,
    once you are able to establish a connection with your ActiveDirectoryAuthentication
    provider. The DefaultAuthentication provider causes some problems and does not
    let ActiveDirectoryAuthentication provider to behave properly. We haven't fully
    investgated the root of this prob. When we deleted DefaultAuthentication provider,
    everything worked normally - so we didn't really care that much :-)
    |
    6) Make sure you have your JAAS options set to OPTIONAL initially and make sure
    your are able to authenticate talk to your AD.
    |
    These are the ones I could think of. Hope this helps..
    Regards,
    Anant
    "Amit" <[email protected]> wrote:
    >
    Hi,
    We want to do authentication from Microsoft Active Directory using weblogic
    8.1.
    I have created a Active directory and
    configured weblogic from console to use it. But it is still not working.
    Your
    help with these question would be highly
    appreciated.
    1. Is there anyone in group who have tried this before. Please let me
    know how
    to proceed.
    2. Is there any tool by which I can get to know the different attribute
    asked
    for configuration in Weblogic?
    3. I am not able to login to my application after configuration. Is there
    any
    other way to come to know whether it is working
    or not?
    There could be plethora of reason but nothing which can come to my mind.
    Everything
    seems to be configured correctly. Here is
    portion of my config.xml related with authentication:
    <FileRealm Name="wl_default_file_realm"/>
    <PasswordPolicy Name="wl_default_password_policy"/>
    <Realm FileRealm="wl_default_file_realm" Name="wl_default_realm"/>
    <Security GuestDisabled="false" Name="vendavo-dev"
    PasswordPolicy="wl_default_password_policy"
    Realm="wl_default_realm" RealmSetup="true">
    <weblogic.security.providers.authentication.DefaultAuthenticator
    ControlFlag="SUFFICIENT"
    Name="Security:Name=myrealmDefaultAuthenticator" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authentication.DefaultIdentityAsserter
    ActiveTypes="AuthenticatedUser"
    Name="Security:Name=myrealmDefaultIdentityAsserter" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultRoleMapper
    Name="Security:Name=myrealmDefaultRoleMapper" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultAuthorizer
    Name="Security:Name=myrealmDefaultAuthorizer" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authorization.DefaultAdjudicator
    Name="Security:Name=myrealmDefaultAdjudicator" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.credentials.DefaultCredentialMapper
    Name="Security:Name=myrealmDefaultCredentialMapper" Realm="Security:Name=myrealm"/>
    <weblogic.management.security.authentication.UserLockoutManager
    Name="Security:Name=myrealmUserLockoutManager" Realm="Security:Name=myrealm"/>
    <weblogic.management.security.Realm
    Adjudicator="Security:Name=myrealmDefaultAdjudicator"
    AuthenticationProviders="Security:Name=myrealmDefaultAuthenticator|Security:Name=myrealmDefaultIdentityAsserter|Security:Name
    =myrealmADAuthenticator"
    Authorizers="Security:Name=myrealmDefaultAuthorizer"
    CredentialMappers="Security:Name=myrealmDefaultCredentialMapper"
    DefaultRealm="true" DisplayName="myrealm"
    Name="Security:Name=myrealm"
    RoleMappers="Security:Name=myrealmDefaultRoleMapper"
    UserLockoutManager="Security:Name=myrealmUserLockoutManager"/>
    <weblogic.security.providers.pk.DefaultKeyStore
    Name="Security:Name=myrealmDefaultKeyStore" Realm="Security:Name=myrealm"/>
    <weblogic.security.providers.authentication.ActiveDirectoryAuthenticator
    ControlFlag="SUFFICIENT" Credential="{3DES}hvEo4sy7g1E="
    DisplayName="ADAuthenticator" FollowReferrals="false"
    GroupBaseDN="ou=ou=Groups,dc=devdc,dc=com" Host="venper5"
    Name="Security:Name=myrealmADAuthenticator"
    Principal="vendev" Realm="Security:Name=myrealm" UserBaseDN="ou=Users,dc=devdc,dc=com"/>
    </Security>
    First, of all is it possible to use Active Directory authentication in
    Weblogic
    without writing any custom code. If yes, how?
    Thanks in advance,
    Amit Tyagi

  • WLS 7.0 Active Directory authenticator - problems starting managed server (Solaris 8)

    Has anyone managed to setup a WLS 7.0 Active Directory authenticator and booted
    a managed server using the node manager? I can boot the server without the AD
    authenticator and I can also boot the server using a script and successfully authenticate
    through AD. My AD control flag is set to OPTIONAL and I have also setup a default
    authenticator to boot weblogic - the control flag here is set to SUFFICIENT. This
    configuration works fine with weblogic running on W2K, but not on Solaris (it
    looks like the control flag is being ignored). Errors as follows
    ####<Oct 1, 2002 1:59:08 PM BST> <Info> <Logging> <mymachine> <server01> <main>
    <kernel identity> <> <000000> <FileLo
    gger Opened at /opt/app/live/appserver/domains/test/NodeManager/server01/server01.log>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01> <main>
    <kernel identity> <> <000415> <System
    has file descriptor limits of - soft: 1,024, hard: 1,024>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01> <main>
    <kernel identity> <> <000416> <Using e
    ffective file descriptor limit of: 1,024 open sockets/files.>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01> <main>
    <kernel identity> <> <000418> <Allocat
    ing: 3 POSIX reader threads>
    ####<Oct 1, 2002 1:59:19 PM BST> <Critical> <WebLogicServer> <mymachine> <server01>
    <main> <kernel identity> <> <0003
    64> <Server failed during initialization. Exception:weblogic.security.service.SecurityServiceRuntimeException:
    Problem instantiating
    Authentication Providerjavax.management.RuntimeOperationsException: RuntimeException
    thrown by the getAttribute method of the Dynam
    icMBean for the attribute Credential>
    weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
    Authentication Providerjavax.management.RuntimeOper
    ationsException: RuntimeException thrown by the getAttribute method of the DynamicMBean
    for the attribute Credential
    at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
    at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
    at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
    at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
    at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
    at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
    at weblogic.Server.main(Server.java:31)
    ####<Oct 1, 2002 1:59:19 PM BST> <Emergency> <WebLogicServer> <mymachine> <server01>
    <main> <kernel identity> <> <000
    342> <Unable to initialize the server: Fatal initialization exception
    Throwable: weblogic.security.service.SecurityServiceRuntimeException: Problem
    instantiating Authentication Providerjavax.management.
    RuntimeOperationsException: RuntimeException thrown by the getAttribute method
    of the DynamicMBean for the attribute Credential
    weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
    Authentication Providerjavax.management.RuntimeOper
    ationsException: RuntimeException thrown by the getAttribute method of the DynamicMBean
    for the attribute Credential
    at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
    at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
    at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
    at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
    at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
    at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
    at weblogic.Server.main(Server.java:31)

    Solved the problem. The 'domain root' directory specified in the remote start configuration,
    must contain a copy of the file 'SerializedSystemIni.dat' that was created along
    with the domain, in order to boot when an AD authenticator is configured. If an
    AD authenticator is not configured, no file is required. This was not a platform
    specific issue; on Win2K I had configured the 'domain root' remote start parameter
    to point to an existing domain root and not a new directory.
    "Andrew Walker" <[email protected]> wrote:
    >
    Has anyone managed to setup a WLS 7.0 Active Directory authenticator
    and booted
    a managed server using the node manager? I can boot the server without
    the AD
    authenticator and I can also boot the server using a script and successfully
    authenticate
    through AD. My AD control flag is set to OPTIONAL and I have also setup
    a default
    authenticator to boot weblogic - the control flag here is set to SUFFICIENT.
    This
    configuration works fine with weblogic running on W2K, but not on Solaris
    (it
    looks like the control flag is being ignored). Errors as follows
    ####<Oct 1, 2002 1:59:08 PM BST> <Info> <Logging> <mymachine> <server01>
    <main>
    <kernel identity> <> <000000> <FileLo
    gger Opened at /opt/app/live/appserver/domains/test/NodeManager/server01/server01.log>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01>
    <main>
    <kernel identity> <> <000415> <System
    has file descriptor limits of - soft: 1,024, hard: 1,024>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01>
    <main>
    <kernel identity> <> <000416> <Using e
    ffective file descriptor limit of: 1,024 open sockets/files.>
    ####<Oct 1, 2002 1:59:09 PM BST> <Info> <socket> <mymachine> <server01>
    <main>
    <kernel identity> <> <000418> <Allocat
    ing: 3 POSIX reader threads>
    ####<Oct 1, 2002 1:59:19 PM BST> <Critical> <WebLogicServer> <mymachine>
    <server01>
    <main> <kernel identity> <> <0003
    64> <Server failed during initialization. Exception:weblogic.security.service.SecurityServiceRuntimeException:
    Problem instantiating
    Authentication Providerjavax.management.RuntimeOperationsException:
    RuntimeException
    thrown by the getAttribute method of the Dynam
    icMBean for the attribute Credential>
    weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
    Authentication Providerjavax.management.RuntimeOper
    ationsException: RuntimeException thrown by the getAttribute method of
    the DynamicMBean
    for the attribute Credential
    at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
    at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
    at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
    at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
    at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
    at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
    at weblogic.Server.main(Server.java:31)
    ####<Oct 1, 2002 1:59:19 PM BST> <Emergency> <WebLogicServer> <mymachine>
    <server01>
    <main> <kernel identity> <> <000
    342> <Unable to initialize the server: Fatal initialization exception
    Throwable: weblogic.security.service.SecurityServiceRuntimeException:
    Problem
    instantiating Authentication Providerjavax.management.
    RuntimeOperationsException: RuntimeException thrown by the getAttribute
    method
    of the DynamicMBean for the attribute Credential
    weblogic.security.service.SecurityServiceRuntimeException: Problem instantiating
    Authentication Providerjavax.management.RuntimeOper
    ationsException: RuntimeException thrown by the getAttribute method of
    the DynamicMBean
    for the attribute Credential
    at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:186)
    at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:236)
    at weblogic.security.service.SecurityServiceManager.doATN(SecurityServiceManager.java:1506)
    at weblogic.security.service.SecurityServiceManager.initializeRealm(SecurityServiceManager.java:1308)
    at weblogic.security.service.SecurityServiceManager.loadRealm(SecurityServiceManager.java:1247)
    at weblogic.security.service.SecurityServiceManager.initializeRealms(SecurityServiceManager.java:1364)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1107)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
    at weblogic.Server.main(Server.java:31)

  • Active Directory Authentication and permissions for user group in APEX 4.0

    Hello,
    I am new to oracle APEX and I have searched the forum for active directory authentication for a user group and I am really confused about all the different threads. Can anyone please provide me the steps to follow; in order to implement AD authentication for a user group in Oracle APEX 4.0.
    These are the threads which i was looking at to get an idea like how AD authentication works but its really confusing for me.
    Help with Authentication (APEX_LDAP.AUTHENTICATE)
    Re: LDAP Authentication Via Groups
    Thanks,
    Tony

    You need to give it more than 30 minutes before bumping your own post. This is not an official support channel, so you need to be patient and wait for people to read, think and respond.

  • NTLM Authentication with a domain controller/active directory

    Hi,
    I have a requirement to do an NTLM authentication with the MS active directory.
    I am aware that JNDI doesn't support this protocol to communicate with the AD.
    I have looked into couple of online solutions available but that doesn't seem to meet my requirement. Most of the solutions like (Apache commons NTLMScheme/NTCredentials and java.net.Authenticator etc...) are used for only NTLM proxy authentication (where both username, password is sent to the proxy server which does the actual NTLM authentication with the Active Directory.)
    What I need is a solution in Java where I can directly contact Active directory for negotiation of challenge/response mechanism.
    Can any of you guys suggest any alternative to achieve this ?

    it really depends to be honest. I'd probably go something like this though:
    One Small physical server to act as a domain controller - you could put DHCP on this too
    One or Two physical, quite powerful servers to act as Hyper-V hosts - these can be domain joined. 
    Then for your VM's create the following:
    1 x additional domain controller
    For remote desktop services:
    1 x Remote Desktop Session Host
    1 x Connection Broker
    1 x Gateway and web server
    For additional services
    1 or 2 x Exchange
    1 x sharepoint
    1 x IIS
    but it really depends what you want to achieve. 
    The benefit from Virtual machines is that you can keep separate virtual servers for separate applications. 
    If you have two hosts you could then replicate the virtual machines between them if you wanted some layer of fault tolerance. 
    Hope this helps you a bit more. And thanks for positive blog feedback - its appreciated. 
    Regards,
    Denis Cooper
    MCITP EA - MCT
    Help keep the forums tidy, if this has helped please mark it as an answer
    My Blog
    LinkedIn:

  • Getting AADSTS50020 error on microsoft login page when using Azure Active Directory Authentication

    We have implemented Azure Ad single sign on using auto generated code from Visual studio 2013 with organization account authentication and its working fine.
    The problem is when user is logged in in azure management portal with his live account and in other tab he try to open our app, then he directly gets below error on Microsoft login page.
    Additional technical information:
    Correlation ID: 78e13474-6f92-40ec-b463-91e36a6dae84
    Timestamp: 2015-04-14 12:27:20Z
    AADSTS50020:
    User account '[email protected]' from external
    identity provider 'live.com' is not supported for application
    'https://xxxxx.onmicrosoft.com/xxxx'. The account needs to
    be added as an external user in the tenant. Please sign out and sign in
    again with an Azure Active Directory user account.
    It works fine if I log out from management portal. Is there any way to resolve this issue without forcing user to log out from live account(management portal)?

    I assume you created a web application using VS2013 which uses the WS-Federation protocol.
    The behavior that you are seeing is expected Single-sign-on because you are logged in using the live account in the management portal.
    For WS-Federation, there is no current way for a caller to specify they want to force a fresh login, so the behavior is always the equivalent of LoginBehavior.Normal.
    The user will need to either sign-out or use an in-private session in the browse.
    If you switch to openID connect(sample at
    https://github.com/AzureADSamples/WebApp-OpenIDConnect-DotNet) and use the “prompt=login” query paramerter in the sign in request, this will force a fresh login.

  • Active Directory Authentication, AFP Home Folders in the wrong place!

    Hi,
    I've had this problem off and on... that is, it comes and goes, so I'm not really able to effectively troubleshoot it. My setup is this:
    -Xserve G5, Mac OS X Server 10.4.7
    -OD Master bound to AD for authentication
    -Hosts AFP and SMB shares, all stored on Xserve RAID
    On the RAID, I have a folder called Users (/Volumes/XserveRAID/Users) that is shared via AFP. The system Users folder (/Users) is not shared. In fact, nothing at all on the root drive is shared. All share points are on /Volumes/XserveRAID/. All Mac users' home directory profiles are pointed to \\servername\Users\username (in Active Directory Users and Computers application on our domain controller). Their home directories mount automatically when they log into their client machines (also bound to AD).
    The problem is this; at seemingly random times, a user's home folder will all of a sudden be created in /Users on the server, and it will not use the /Volumes/XserveRAID/Users/ folder. I will clean out /Users every now and again, but the errant home folders show back up. The only folder that should be in /Users is the local admin.
    Since /Users is not even shared, how is it doing this? Why is it that sometimes the /Volumes/XserveRAID/Users share is used (I know this because there are users' files in their folders in the proper place) and sometimes it's going to /Users? Any ideas? Thanks in advance!!
    Going slightly mad,
    Jason

    Hi there,
    Just wanted to share my make-due solution.
    I have setup the automount sharepoint at "/Data/Home".
    When I logged in or tried to use createhomedir in terminal, nothing happened but users could login (even though there was no home folder on the sharepoint for them).
    I have created the Home Folders manually "/Data/Home/username" and then logged in again. When I did this it created two folders in the home dir:
    -Desktop
    -Library
    The other icons related to the home dir on the Dock remain big "?" 's.
    So I manually added them and assigned them the propper rights.
    Now users can log in without any problems, network home folders are working.
    So essentially I got thing s to work, luckily I have only a hand full of Mac Users, Imagine having a user base in the hundreds !
    Thinking about this really makes me want to know how I can fix this problem, I have a make shift solution but this really isn't the way to go. When I use the createhomedir command, it says "creating homedir on servername.domain.net" and it seems to be busy for like 20 - 30 secs, but after that nothing has changed.
    I've checked all possible locations on the server (i thought maybe it might have made local accounts on server by accident, but it didn't.)
    If anyone has ANY idea, please share.
    Thx!!
    Have a nice day

  • Install Domain Controller, Active Directory, RemoteApps on Single Server?

    Have a server that I want to experiment with RemoteApps.   Documentation I have read state you need to have a Domain Controller setup with AD on one server, and have a second server to install all the RemoteApps requirements. Is this true or can
    this all be done on one server.
    If I need a separate server for the Domain Controller and Active Directory, can I assume that a low end server would be sufficient?  Or would using Hyper-V with a single hardware server and create two virtual machines: one as the DC/AD, and the other
    to run Remote Apps be a possible solution.  Any advice?

    it really depends to be honest. I'd probably go something like this though:
    One Small physical server to act as a domain controller - you could put DHCP on this too
    One or Two physical, quite powerful servers to act as Hyper-V hosts - these can be domain joined. 
    Then for your VM's create the following:
    1 x additional domain controller
    For remote desktop services:
    1 x Remote Desktop Session Host
    1 x Connection Broker
    1 x Gateway and web server
    For additional services
    1 or 2 x Exchange
    1 x sharepoint
    1 x IIS
    but it really depends what you want to achieve. 
    The benefit from Virtual machines is that you can keep separate virtual servers for separate applications. 
    If you have two hosts you could then replicate the virtual machines between them if you wanted some layer of fault tolerance. 
    Hope this helps you a bit more. And thanks for positive blog feedback - its appreciated. 
    Regards,
    Denis Cooper
    MCITP EA - MCT
    Help keep the forums tidy, if this has helped please mark it as an answer
    My Blog
    LinkedIn:

  • Oracle database and Windows Active directory authentication

    Hello,
    Our developers have created a couple of web apps which look at our oracle database. Presently they use the APPS user and the user/password is hard coded into the config files.
    Is it possible to authenticate these using Windows Active Directory instead? Is it possible to use AD authentication for all developer access to the database?
    I'm trying to research this on the web but getting very confused. Would a lot of work be involved to get this up and running?
    Is anyone able to offer and advise?
    Thank you very much
    Sarah

    I don't have experience in joining a Linux system with Windows AD, and it generally does not sound like the best idea to me, but since Oracle Enterprise Linux is a clone of Red Hat Enterprise Linux, the solution you are looking for could be called Winbind.
    Perhaps the following links are useful:
    http://spiralbound.net/blog/2007/04/11/rhel-winbind-authentication-against-active-directory
    http://www.linuxmail.info/active-directory-integration-samba-centos-5/
    http://magazine.redhat.com/2007/11/12/tips-and-tricks-how-can-i-configure-winbind-to-synchronize-user-and-group-ids-across-multiple-red-hat-enterprise-linux-hosts-on-active-directory-accounts/

  • Windows Active Directory Authentication

    Hi Experts,
    I have an enterprise application running in a clustered environment. The jars are diployed in jboss and wars in tomcat servers. The requirement is to authenticate users with thier Windows username/password with active directory itself and depending upon their roles give access to various functionalities in the application. Could someone guide on how the windows authentication should be done?
    Thanks

    We were able to successfully enable the Windows AD Authentication.
    Section 4 would be on the SIA's or server tier. Sections 5,6,and 7 would be for the Java Web app server or web tier.
    We got an error when trying to enable SSO though.
    The server encountered an internal error (com.wedgetail.idm.sso.ProtocolException: com.wedgetail.idm.spnego.server.SpnegoException: GSSException: Failure unspecified at GSS-API level (Mechanism level: com.dstc.security.kerberos.KerberosException: Successfully matched service principal "account@domian_name" but not key type (18) + KVNO (32) in this entry: Principal: [1] account@domain_name TimeStamp: Wed Dec 31 19:00:00 COT 1969 KVNO: -1 EncType: 23 Key: 16 bytes, fingerprint = [......] )) that prevented it from fulfilling this request.
    We disabled the SSO for the time being, but the Windows AD works fine.

  • Provision Search in SharePoint Foundation 2013 without Domain Controller / Active Directory - Domain accounts

    Hi,
    I have successfully setup SharePoint Foundation 2013 as single server farm with SQL Server Standard database in a DMZ environment using local accounts since DMZ doesn't have an Active Directory and hence Domain accounts using powershell as described
    in https://theblobfarm.wordpress.com/2012/12/03/installing-sharepoint-2013-without-a-domain-controller 
    When I run Farm configuration wizard to provision search service application, I get an error:
    ERROR: "The service application(s) for the service "Search Service Application" could not be provisioned because of the following error: I/O error occurred."
    The log file logged the details of this error as:
    ERROR: "Failed to create file share Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 at D:\SharePoint Search\Office Server\Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 (System.ArgumentException: The SDDL string contains an invalid sid or a sid
    that cannot be translated."
    After investigation, I found that potentially the error could be because the timer service is trying to setup a network share for analytics component (as part of provisioning search). It is trying to setup that share with a domain account that happens to
    be a local user instead in this case and fails with error “System.ArgumentException: The SDDL string contains an invalid sid or a sid that cannot be translated”.
    I got some pointer from the below thread
    https://social.technet.microsoft.com/Forums/en-US/c8e93984-f4e5-46da-8e8a-c5c79ea1ff62/error-creating-search-service-application-on-sharepoint-foundation-with-local-account?forum=sharepointadmin
    However, the above thread doesn't state that the solution worked.
    I have tried creating share manually for Analytics_<Guid> folder but it doesn't work since every time farm configuration wizards is run it creates a new Analytics_<Guid> folder.
    Since, I have setup SharePoint Foundation 2013 on a production environment I cannot test and trial various solutions.
    Can some please guide me on how to successfully provision search for SharePoint Foundation 2013 setup as a single server farm with SQL Server Standard database in a DMZ environment using local accounts (without Active Directory - domain accounts).
    Thanks in advance.
    Himanshu

    Microsoft documentation doesn't always specifically call out all products (Project Server isn't there, either). But it does apply. You'll need to stand up at least one Domain Controller, or allow port access back to a DC.
    Preferably, set up SharePoint on the internal network and use a reverse proxy (which will terminate client connections at the reverse proxy) present in the DMZ.
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • SGD 4.7 - Cannot enable Active Directory authentication

    I've followed the steps in the Admin Guide, and have a service object created.  Running tarantella service list --name service_name produces the following output (obfuscated):
    Name:  service_name
    Enabled: 1
    Url: ad://url_to_dc
    Base-domain: same as above
    Security-mode: kerberos
    Type: ad
    ...all of which looks correct.  I've added the recommended log filters.  Directory services (server/directoryservices/*) returns the following INFO message when attempting a logn:
    No Login authorities are available.
    The configured service objects will not be used.
    When I click the "Test" button in the service object property screen, the above log fills with what look like appropriate log messages and a Success result from the AD server, then the above message is displayed.  Running the tarantella config list | grep login command produced the following output:
    login-ad-base-domain:  same domain as above
    login-ad-default-domain: ""
    login-ldap-thirdparty-ens: 1
    login-lday-thirdparty-profile: 1
    login-thirdparty-ens: 0
    login-thirdparty-nonens: 0
    login-thirdparty-superusers:  sgd_trusted_user
    login-web-tokenvalidity: 180
    server-login: enabled
    Any ideas?

    Problems can be
    Incorrect domain
    Name resolutions fails: OSGD server must be able to resolve the global catalog server
    Timeserver: OSGD server must have the same time as the AD
    Wrong /etc/krb5.conf
    Global Catalog Server
    Check, if the domain has a global catalog server:
    nslookup -query=any _gc._tcp.DOMAIN_lowercase 
    Example for Domain TBSOL.DE 
    [root@tab-ol5u7-SGD1dev-adm tmp]# nslookup -query=any _gc._tcp.tbsol.de 
    Server:         192.168.99.1
    Address:        192.168.99.1#53
    Non-authoritative answer:
    _gc._tcp.tbsol.de       service = 0 100 3268 office-ad.tbsol.de.
    Authoritative answers can be found from:
    tbsol.de        nameserver = office-ad.tbsol.de.
    office-ad.tbsol.de      internet address = 172.16.1.14
    Kerberos Layer
    Simple Kerberos file
    [libdefaults] 
      default_realm = TBSOL.DE
      default_tkt_enctypes = rc4-hmac
      default_tgs_enctypes = rc4-hmac
    [realms]
       TBSOL.DE = {
         kdc = office-ad.tbsol.de
         admin_server = office-ad.tbsol.de
    [domain_realm]
       .tbsol.de = TBSOL.DE
       tbsol.de = TBSOL.DE
    Icon
    The format (tabs and spaces) of the Kerberos file is not relevant.
    (other experience: after correcting the format of the kerberos file, pwd change works !)
    Use kinit to test the Kerberos file.
    Tarantella needs a restart, if this file is changed.
    Icon
    The OSGD documentation mentions in "2.2.4.2 Active Directory Password Expiry" to set
    kpasswd_protocol = SET_CHANGE
    This was not needed in these tests.
    Login check via kinit
    kinit <userprincibalename>@DOMAIN_uppercase 
    Example of kinit 
    [root@tab-ol5u7-SGD1dev-adm tmp]# kinit [email protected]; echo $? 
    Password for [email protected]:
    kinit(v5): Preauthentication failed while getting initial credentials
    1
    [root@tab-ol5u7-SGD1dev-adm tmp]# kinit [email protected]; echo $?
    Password for [email protected]:
    0
    [root@tab-ol5u7-SGD1dev-adm tmp]#
    Check password change with KPASSWD
    [root@tab-ol5u7-SGD1dev-adm log]# kpasswd [email protected] 
    Password for [email protected]:
    Enter new password:
    Enter it again:
    Password changed.
    Check password change on AD request
    Mark user, that he has to change his password on the next login in the AD.
    [root@tab-ol5u7-SGD2dev-adm tmp]# kinit [email protected] 
    Password for [email protected]:
    Password expired.  You must change it now.
    Enter new password:
    Enter it again:
    [root@tab-ol5u7-SGD2dev-adm tmp]# kinit [email protected]
    C

Maybe you are looking for