last day (15 days later) » 

9:33 PM
1
Q: Shiro with LDAP

JohnBI am trying to validate an user using LDAP but the following settings don't work (Shiro.ini): [main] authc.loginUrl = /login.xhtml authc.usernameParam = login.username authc.passwordParam = login.password authc.rememberMeParam = login.rememberMe user = co.com.xxx.yyy.filters.FacesAjaxAwareUserF...

 
Does "uid=<username you're trying>,ou=Users,ou=Accounts,dc=aaa,dc=ggg,dc=com,dc=co" exist in your LDAP server? Can that LDAP entry be read by the same user?
 
When I put the username instead of {0} I got an error
 
So, does the LDAP entry exist? Can it be read by that user?
 
How can I test that? There are other applications using an especific user and running right but using spring, when I put in shiro the specific user it shows me this error: javax.naming.AuthenticationException: [LDAP: error code 32 - No Such Object]. If I put an unknown user I get this error: javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]
 
Use a LDAP client and connect to the server using uid=...,ou=...,... and password, and look for the entry uid=...,ou=...,...
 
9:33 PM
Ok, I could connect using JXplorer. Now I have the uid and the ou. What is next?
 
Navigate the tree shown in the JXplorer to reach the entry uid=<username you're trying>,ou=Users,ou=Accounts,dc=aaa,dc=ggg,dc=com,dc=co and see if you can select it to see it's attributes. Shiro does this with the same user it tries to authenticate (AFIK), so if you haven't specify the same DN as username when connecting.
 
Yes, I can select it but it shows the value of only 3 attributes: objectClass, objectClass and ou
 
Are you sure that you're looking at the right entry, it seems that you're looking at organizationalUnit object, and I'm guessing that the two objectClass attributes have values top and organizationalUnit, and that the ou is one of Users or Accounts. So it seems that your LDAP server indeed either does not contain the uid=...,ou=Users,ou=Accounts,dc=aaa,dc=ggg,dc=com,dc=co and you're not logged in as that user or that you are logged in as that user but cannot read the user's entry.
 
Sorry, I can see now the user attributes. What can I do?
 
Double check everything, if indeed the user you're trying to login as is at uid=<your user>,ou=Users,ou=Accounts,dc=aaa,dc=ggg,dc=com,dc=co and using the LDAP client you can authenticate and see uid=<your user>,ou=Users,ou=Accounts,dc=aaa,dc=ggg,dc=com,dc=co and the Shiro configuration is as provided in the question I see no other reason for the 32 - No Such Object error.
 
9:33 PM
Could you provide an example please?
 
Of what, really?
 
For example, how to set shiro.ini to connect to this online free server: LDAP free online test server
The ldap manager in my company gave me an user and a password, in the shiro.ini I set the password with the ldapRealm.contextFactory.environment[java.naming.security.credentials] key but I haven't set the username in the shiro.ini because I don't know how to do it
My native language is spanish, sometimes is difficult to me to explain my problems, sorry
 

last day (15 days later) »