[
https://issues.apache.org/jira/browse/KNOX-2881?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17688521#comment-17688521
]
ASF subversion and git services commented on KNOX-2881:
-------------------------------------------------------
Commit c06874cc819cddd422cc30f227cf0282c402c970 in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=c06874cc8 ]
KNOX-2881 - KnoxCLI handles aliases when testing LDAP (system) authentication
(#732)
> KnoxCLI doesn’t hande ALIAS in (system)-user-auth-test
> ------------------------------------------------------
>
> Key: KNOX-2881
> URL: https://issues.apache.org/jira/browse/KNOX-2881
> Project: Apache Knox
> Issue Type: Improvement
> Components: KnoxCLI
> Affects Versions: 1.2.0, 1.3.0, 1.4.0, 1.5.0, 2.0.0, 1.6.0, 1.6.1
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 2.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> When topology has
> {noformat}
> <param>
> <name>main.ldapRealm.contextFactory.systemPassword</name>
> <value>${ALIAS=knoxldapsystempassword}</value>
> </param>
> {noformat}
> The validations fail as:
> {noformat}
> # /bin/knoxcli.sh system-user-auth-test --cluster ldapUsecase1Topo2
> org.apache.shiro.authc.AuthenticationException: LDAP authentication failed.
> [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042A, comment:
> AcceptSecurityContext error, data 52e, v3839]
> For more information use --d for debug output.
> Unable to successfully bind to LDAP server with topology credentials. Are
> your parameters correct?
> # bin/knoxcli.sh user-auth-test --cluster ldapUsecase1Topo2 --u user1 --p
> Test123
> org.apache.shiro.config.ConfigurationException: Unable to set property
> 'contextFactory.systemPassword' with value [S{ALIAS=knoxldapsystempassword}]
> on object of type org.apache.knox.gateway.shirorealm.KnoxLdapRealm. If
> 'S{ALIAS=knoxldapsystempassword}' is a reference to another (previously
> defined) object, prefix it with '$' to indicate that the referenced object
> should be used as the actual value. For example,
> $S{ALIAS=knoxldapsystempassword}
> org.apache.knox.gateway.util.KnoxCLI$LDAPCommand$BadSubjectException: Subject
> could not be created with Shiro Config at sections=main,urls
> For more information use --d for debug output.
> ERR: Unable to authenticate user: user1
> {noformat}
> Note: we checked that the keystore has the right password value set:
> {noformat}
> # ${JAVA} GetValueFromJCEKS ${JCEKSFILE} ${JCEKSPASS} ${PW_ALIAS}
> Test123
> {noformat}
>
> When the topology is configured with a plain password like:
> {noformat}
> <param>
> <name>main.ldapRealm.contextFactory.systemPassword</name>
> <value>Test123</value>
> </param>
> {noformat}
> The validations run with no errors:
> {noformat}
> # bin/knoxcli.sh system-user-auth-test --cluster ldapUsecase1Topo3
> System LDAP Bind successful.
> # bin/knoxcli.sh user-auth-test --cluster ldapUsecase1Topo3 --u user1 --p
> Test123
> LDAP authentication successful!{noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
