On Mon, Jul 10, 2017 at 6:21 PM, Carlos Fernandez <[email protected]> wrote:
> 2017-07-10 13:02:40,171 DEBUG [org.ldaptive.auth.
> PooledBindAuthenticationHandler] - <authenticate
> criteria=[org.ldaptive.auth.AuthenticationCriteria@
> 530348177::dn=uid=jb617017,ou=people,o=sju.edu,
> authenticationRequest=[org.ldaptive.auth.AuthenticationRequest@2074611074
> <(207)%20461-1074>::user=[org.ldaptive.auth.User@1520364966::identifier=jb617017,
> context=null], returnAttributes=[udcid, uid, employeeType, mail,
> displayName, givenName, departmentNumber, pswUserName, sn, employeeNumber,
> udcid, uid, employeeType, mail, displayName, givenName, departmentNumber,
> pswUserName, sn, employeeNumber]]]>
>
Did you list all these attributes twice or is CAS duplicating them?
> 2017-07-10 13:02:40,182 DEBUG [org.ldaptive.SearchOperation] - <execute
> response=[org.ldaptive.Response@2058915982 <(205)%20891-5982>::result=[
> org.ldaptive.SearchResult@-1951941189::entries=[[dn=[],
> responseControls=null, messageId=-1]], references=[]], resultCode=SUCCESS,
> message=null, matchedDn=null, responseControls=null, referralURLs=null,
> messageId=-1] for request=[org.ldaptive.SearchRequest@600881066::baseDn=,
> searchFilter=[org.ldaptive.SearchFilter@1642584434::filter=(objectClass=*),
> parameters={}], returnAttributes=[1.1], searchScope=OBJECT, timeLimit=PT0S,
> sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null,
> sortBehavior=UNORDERED, searchEntryHandlers=null,
> searchReferenceHandlers=null, controls=null, referralHandler=null,
> intermediateResponseHandlers=null]
>
Here's the successful connection validation.
> 2017-07-10 13:02:40,189 DEBUG [org.ldaptive.BindOperation] - <execute
> response=[org.ldaptive.Response@1635611633::result=null,
> resultCode=SUCCESS, message=null, matchedDn=null, responseControls=[[org.
> ldaptive.control.PasswordPolicyControl@-350057371::criticality=false,
> timeBeforeExpiration=0, graceAuthNsRemaining=0, error=null]],
> referralURLs=null, messageId=-1] for request=[org.ldaptive.
> BindRequest@1840527521::bindDn=uid=jb617017,ou=people,o=sju.edu,
> saslConfig=null,
> controls=[[org.ldaptive.control.PasswordPolicyControl@-350057371::criticality=false,
> timeBeforeExpiration=0, graceAuthNsRemaining=0, error=null]],
> referralHandler=null, intermediateResponseHandlers=null] with
> connection=[org.ldaptive.DefaultConnectionFactory$
> DefaultConnection@1236378265::config=[org.ldaptive.ConnectionConfig@
> 2142472158 <(214)%20247-2158>::ldapUrl=ldaps://axldap.sju.edu,
> connectTimeout=PT1H23M20S, responseTimeout=null,
> sslConfig=[org.ldaptive.ssl.SslConfig@1154240951::credentialConfig=[org.
> ldaptive.ssl.X509CredentialConfig@-747746929::trustCertificates=
> file:/etc/cas/credentials/axldap.crt, authenticationCertificate=null,
> authenticationKey=null], trustManagers=null, enabledCipherSuites=null,
> enabledProtocols=null, handshakeCompletedListeners=null], useSSL=true,
> useStartTLS=false, connectionInitializer=null, connectionStrategy=org.
> ldaptive.DefaultConnectionStrategy@22c0dfad], providerConnectionFactory=[
> org.ldaptive.provider.jndi.JndiConnectionFactory@
> 412312959::metadata=[ldapUrl=ldaps://axldap.sju.edu, count=1],
> environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory,
> com.sun.jndi.ldap.connect.timeout=5000000, java.naming.ldap.version=3,
> java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
> java.naming.security.protocol=ssl}, classLoader=null,
> providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@2080218308::
> operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN],
> properties={},
> controlProcessor=org.ldaptive.provider.ControlProcessor@5d1a2be5,
> environment=null, tracePackets=null, removeDnUrls=true,
> searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED,
> PARTIAL_RESULTS], classLoader=null, sslSocketFactory=null,
> hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.
> JndiConnection@7983aa5c]>
>
Here's the successful bind. Although a connectTimeout of PT1H23M20S is
either a configuration mistake or a CAS parsing bug.
> 2017-07-10 13:02:40,189 DEBUG [org.ldaptive.auth.PooledSearchEntryResolver]
> - <resolve criteria=[org.ldaptive.auth.AuthenticationCriteria@
> 530348177::dn=uid=jb617017,ou=people,o=sju.edu,
> authenticationRequest=[org.ldaptive.auth.AuthenticationRequest@2074611074
> <(207)%20461-1074>::user=[org.ldaptive.auth.User@1520364966::identifier=jb617017,
> context=null], returnAttributes=[udcid, uid, employeeType, mail,
> displayName, givenName, departmentNumber, pswUserName, sn, employeeNumber,
> udcid, uid, employeeType, mail, displayName, givenName, departmentNumber,
> pswUserName, sn, employeeNumber]]]>
>
I'm confused why this search entry resolver is running. Perhaps it's
configuration mistake, perhaps CAS is leveraging the DN resolver in a way I
don't understand.
> java.lang.IllegalStateException: Connection is not open
>
Here's the connection validation failing, presumably because of the close
passivator. There's definitely some strange stuff going on here. I see you
changed your config and got it working, however it should be possible to
get the behavior you want with the direct authenticator. You should
probably file a feature request and ask for an anonymous bind to be
performed when using the BIND option with no bindDN property.
--Daniel Fisher
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAFC6YwT_kcCFzykj0cqWq9XnQw%3DCqN_%3DTG%3D87rPOzfr_D0ZU4A%40mail.gmail.com.
