I have configured a Liferay server using CAS for login authorization with Oracle Internet Directory LDAP. User can login to the Liferay or only CAS server without problem if the user id and password type correctly. However, if any user type the password incorrect once time and failure to login, all users (including himself) cannot login the Liferay or CAS server again until the CAS server restarted.
Here is my environment: - JBoss version: JBoss-EAP-6.4 - Liferay version: liferay-portal-6.2-ee-sp14 - CAS version: 4.0.0 - Oracle Internet Directory version: 11.1.1.9 - Red Hat Linux Enterprise The exception find in the cas log: 06:52:35,021 INFO org.jasig.cas.authentication.PolicyBasedAuthenticationManager <https://github.com/Jasig/cas/issues/http-iphoneD3.apple.local/10.2.236.82:8443-6>AcceptUsersAuthenticationHandler failed authenticating i1001A001+password 06:52:35,021 DEBUG org.jasig.cas.authentication.LdapAuthenticationHandler <https://github.com/Jasig/cas/issues/http-iphoneD3.apple.local/10.2.236.82:8443-6> Attempting LDAP authentication for i1001A001+password 06:52:35,021 DEBUG org.ldaptive.auth.PooledSearchDnResolver <https://github.com/Jasig/cas/issues/http-iphoneD3.apple.local/10.2.236.82:8443-6> resolve user=i1001A001 06:52:35,021 DEBUG org.ldaptive.auth.PooledSearchDnResolver <https://github.com/Jasig/cas/issues/http-iphoneD3.apple.local/10.2.236.82:8443-6> searching for DN using userFilter 06:52:35,022 DEBUG org.ldaptive.SearchOperation <https://github.com/Jasig/cas/issues/http-iphoneD3.apple.local/10.2.236.82:8443-6> execute request=[org.ldaptive.SearchRequest@-881776365::baseDn=, searchFilter=[ org.ldaptive.SearchFilter@1642584 <https://github.com/org.ldaptive.SearchFilter/cas/commit/1642584434>::filter=(objectClass=*), parameters={}], returnAttributes=[1.1], searchScope=OBJECT, timeLimit=0, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@2038238935::config=[ org.ldaptive.ConnectionConfig@1843141 <https://github.com/org.ldaptive.ConnectionConfig/cas/commit/1843141917>::ldapUrl=ldap://iphone2.apple.local:23060, connectTimeout=3000, responseTimeout=-1, sslConfig=[ org.ldaptive.ssl.SslConfig@5810877 <https://github.com/org.ldaptive.ssl.SslConfig/cas/commit/581087781>::credentialConfig=[org.ldaptive.ssl.KeyStoreCredentialConfig@-395197149::trustStore=/poc2a/certs/cas-trusted.jks, trustStoreType=null, trustStoreAliases=null, keyStore=/poc2a/certs/cas.jks, keyStoreType=null, keyStoreAliases=null], trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1004623 <https://github.com/org.ldaptive.BindConnectionInitializer/cas/commit/1004623272>::bindDn=cn=ldap_conn,cn=users,dc=apple,dc=phone, dc=us, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[ org.ldaptive.provider.jndi.JndiConnectionFactory@2995652 <https://github.com/org.ldaptive.provider.jndi.JndiConnectionFactory/cas/commit/299565209>::metadata=[ldapUrl=ldap://iphonesl2.apple.local:23060, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1810762 <https://github.com/org.ldaptive.provider.jndi.JndiProviderConfig/cas/commit/1810762078>::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@5361c303, controlProcessor=org.ldaptive.provider.ControlProcessor@16d40264, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@13e7edca] 06:52:35,024 DEBUG org.ldaptive.SearchOperation <https://github.com/Jasig/cas/issues/http-iphoneD3.apple.local/10.2.236.82:8443-6> execute response=[org.ldaptive.Response@1859608 <https://github.com/org.ldaptive.Response/cas/commit/1859608806>::result=[org.ldaptive.SearchResult@-1951941189::entries=[[dn=[], responseControls=null, messageId=-1]], references=[]], resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1] for request=[org.ldaptive.SearchRequest@-881776365::baseDn=, searchFilter=[org.ldaptive.SearchFilter@1642584 <https://github.com/org.ldaptive.SearchFilter/cas/commit/1642584434>::filter=(objectClass=*), parameters={}], returnAttributes=[1.1], searchScope=OBJECT, timeLimit=0, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@2038238935::config=[ org.ldaptive.ConnectionConfig@1843141 <https://github.com/org.ldaptive.ConnectionConfig/cas/commit/1843141917>::ldapUrl=ldap://iphonesl2.apple.local:23060, connectTimeout=3000, responseTimeout=-1, sslConfig=[ org.ldaptive.ssl.SslConfig@5810877 <https://github.com/org.ldaptive.ssl.SslConfig/cas/commit/581087781>::credentialConfig=[org.ldaptive.ssl.KeyStoreCredentialConfig@-395197149::trustStore=/poc2a/certs/cas-trusted.jks, trustStoreType=null, trustStoreAliases=null, keyStore=/poc2a/certs/cas.jks, keyStoreType=null, keyStoreAliases=null], trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1004623 <https://github.com/org.ldaptive.BindConnectionInitializer/cas/commit/1004623272>::bindDn=cn=ldap_conn,cn=users,dc=apple,dc=phone,dc=uk, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[ org.ldaptive.provider.jndi.JndiConnectionFactory@2995652 <https://github.com/org.ldaptive.provider.jndi.JndiConnectionFactory/cas/commit/299565209>::metadata=[ldapUrl=ldap://iphonesl2.apple.local:23060, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1810762 <https://github.com/org.ldaptive.provider.jndi.JndiProviderConfig/cas/commit/1810762078>::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@5361c303, controlProcessor=org.ldaptive.provider.ControlProcessor@16d40264, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@13e7edca] 06:52:35,026 DEBUG org.ldaptive.SearchOperation <https://github.com/Jasig/cas/issues/http-iphoneD3.apple.local/10.2.236.82:8443-6> execute request=[org.ldaptive.SearchRequest@-706206285::baseDn=cn=users,dc=apple,dc=iphone dc=uk, searchFilter=[org.ldaptive.SearchFilter@-1728831595::filter=(&(uid={user})(objectClass=person)), parameters={user=i1001A001}], returnAttributes=[1.1], searchScope=SUBTREE, timeLimit=0, sizeLimit=0, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@2038238935::config=[ org.ldaptive.ConnectionConfig@1843141 <https://github.com/org.ldaptive.ConnectionConfig/cas/commit/1843141917>::ldapUrl=ldap://iphonesl2.apple.local:23060, connectTimeout=3000, responseTimeout=-1, sslConfig=[ org.ldaptive.ssl.SslConfig@5810877 <https://github.com/org.ldaptive.ssl.SslConfig/cas/commit/581087781>::credentialConfig=[org.ldaptive.ssl.KeyStoreCredentialConfig@-395197149::trustStore=/poc2a/certs/cas-trusted.jks, trustStoreType=null, trustStoreAliases=null, keyStore=/poc2a/certs/cas.jks, keyStoreType=null, keyStoreAliases=null], trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1004623 <https://github.com/org.ldaptive.BindConnectionInitializer/cas/commit/1004623272>::bindDn=cn=ldap_conn,cn=users,dc=apple,dc=phone,dc=uk, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[ org.ldaptive.provider.jndi.JndiConnectionFactory@2995652 <https://github.com/org.ldaptive.provider.jndi.JndiConnectionFactory/cas/commit/299565209>::metadata=[ldapUrl=ldap://iphonesl2.apple.local:23060, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1810762 <https://github.com/org.ldaptive.provider.jndi.JndiProviderConfig/cas/commit/1810762078>::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@5361c303, controlProcessor=org.ldaptive.provider.ControlProcessor@16d40264, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@13e7edca] 06:52:35,028 DEBUG org.ldaptive.provider.jndi.NamingExceptionUtils <https://github.com/Jasig/cas/issues/http-iphoneD3.apple.local/10.2.236.82:8443-6> naming exception class javax.naming.AuthenticationNotSupportedException is ambiguous, maps to multiple result codes:*[AUTH_METHOD_NOT_SUPPORTED, STRONG_AUTH_REQUIRED, CONFIDENTIALITY_REQUIRED, INAPPROPRIATE_AUTHENTICATION]* Anyone have idea on that? deployerConfigContext.xml <bean id="ldapAuthenticationHandler" class="org.jasig.cas.authentication.LdapAuthenticationHandler" p:principalIdAttribute="uid"> <constructor-arg ref="authenticator" /> <property name="principalAttributeMap"> <map> <entry key="mail" value="email" /> <entry key="cn" value="cn" /> <entry key="uid" value="userId" /> <entry key="displayName" value="displayName" /> <entry key="memberOf" value="membership" /> <entry key="userpassword" value="userPassword" /> </map> </property> </bean> <bean id="usernamePasswordCredentialsResolver" class="org.jasig.cas.authentication.principal.BasicPrincipalResolver" /> <bean id="httpBasedCredentialsResolver" class="org.jasig.cas.authentication.principal.BasicPrincipalResolver" /> <bean id="authenticator" class="org.ldaptive.auth.Authenticator" c:resolver-ref="pooledSearchDnResolver" c:handler-ref="pooledBindHandler" /> <bean id="connectionConfig" class="org.ldaptive.ConnectionConfig" p:ldapUrl="ldap://iphonesl2.apple.local:23060"; p:connectTimeout="3000" p:useStartTLS="false" p:connectionInitializer-ref="bindConnectionInitializer" p:sslConfig-ref="sslConfig" /> <bean id="sslConfig" class="org.ldaptive.ssl.SslConfig"> <property name="credentialConfig"> <bean class="org.ldaptive.ssl.KeyStoreCredentialConfig" p:keyStore="/poc2a/certs/cas.jks" p:keyStorePassword="abcd1234" p:trustStore="/poc2a/certs/cas-trusted.jks" p:trustStorePassword="abcd1234" /> </property> </bean> <bean id="bindConnectionInitializer" class="org.ldaptive.BindConnectionInitializer" p:bindDn="cn=ldap_conn,cn=users,dc=apple,dc=phone,dc=us"> <property name="bindCredential"> <bean class="org.ldaptive.Credential" c:password="abcd1234" /> </property> </bean> <bean id="ldapPoolConfig" class="org.ldaptive.pool.PoolConfig" p:minPoolSize="10" p:maxPoolSize="99999999" p:validateOnCheckOut="true" p:validatePeriodically="false" p:validatePeriod="300" /> <bean id="pruneStrategy" class="org.ldaptive.pool.IdlePruneStrategy" p:prunePeriod="300" p:idleTime="600" /> <bean id="searchValidator" class="org.ldaptive.pool.SearchValidator" /> <bean id="connectionPool" class="org.ldaptive.pool.BlockingConnectionPool" init-method="initialize" p:poolConfig-ref="ldapPoolConfig" p:blockWaitTime="3000" p:validator-ref="searchValidator" p:pruneStrategy-ref="pruneStrategy" p:connectionFactory-ref="connectionFactory" /> <bean id="pooledSearchDnResolver" class="org.ldaptive.auth.PooledSearchDnResolver" p:baseDn="cn=users,dc=apple,dc=phone,dc=us" p:subtreeSearch="true" p:allowMultipleDns="false" p:connectionFactory-ref="pooledConnectionFactory" p:userFilter="(&(uid={user})(objectClass=person))" /> <bean id="pooledBindHandler" class="org.ldaptive.auth.PooledBindAuthenticationHandler" p:connectionFactory-ref="pooledConnectionFactory" /> <bean id="connectionFactory" class="org.ldaptive.DefaultConnectionFactory" p:connectionConfig-ref="connectionConfig" /> <bean id="pooledConnectionFactory" class="org.ldaptive.pool.PooledConnectionFactory" p:connectionPool-ref="connectionPool" /> -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
