Hi Francesco,
Role assignment with the ldap provider is explained here:
http://docs.geoserver.org/latest/en/user/security/auth/providers.html#role-assignment
Basically, for those groups in ldap your user is a part of will have to
present in the role service. So say you are part of an ldap group named
"foo". That is mapped to the role "ROLE_FOO" when you are authenticated. So
"ROLE_FOO" needs to be defined in the role service as an administrator role
if you want to have full ui admin privileges. Explained here:
http://docs.geoserver.org/latest/en/user/security/tutorials/ldap/index.html#map-ldap-groups-to-geoserver-roles
The alternative is to ignore ldap groups and use a user group service. But
this means having to redefine users in your user group service that are in
your ldap server. But it gives you full control over the role assignment.
On Fri, Apr 6, 2012 at 3:58 AM, Francesco Izzi <[email protected]>wrote:
> Hi Justin,
>
> i try to manage also ldap group.
>
> I set this for group binding:
>
> Group search base
> ou=groups
>
> Group search filter
> memberUid={0}
>
> The login working but the ldap user logged without any role.
>
> I see in the log:
>
> 06 apr 11:54:20 WARN
> [authentication.SpringSecurityAuthenticationSource] - No
> Authentication object set in SecurityContext - returning empty String
> as Principal
> 06 apr 11:54:20 WARN
> [authentication.SpringSecurityAuthenticationSource] - No
> Authentication object set in SecurityContext - returning empty String
> as Credentials
>
>
>
> 2012/4/5 Francesco Izzi <[email protected]>:
> > Yep Justin,
> >
> > works !!!
> >
> >
> > Thanks,
> >
> > 2012/4/5 Justin Deoliveira <[email protected]>:
> >> Hi Francesco,
> >>
> >> It is a bit weird but the root domain components are actually specified
> as
> >> part of the server url... so try the following instead:
> >>
> >> url: ldap://150.145.133.83/dc=geoserver,dc=geosdi,dc=org
> >>
> >> Also, the user lookup is a template for a lookup, and generally not a
> fixed
> >> user... but i guess it could be. The idea is to specify this:
> >>
> >> user: uid={0},ou=people,dc=geoserver,dc=geosdi,dc=org
> >>
> >> Where {0} is replaced with the username being logged in. The abobe would
> >> ignore the username specified and always log in as admin... perhaps
> that is
> >> intended.
> >>
> >> Also, there is a tutorial here that might be worth going through.
> >>
> >>
> http://docs.geoserver.org/latest/en/user/security/tutorials/ldap/index.html
> >>
> >> Hope that helps, let me know how it goes.
> >>
> >> -Justin
> >>
> >>
> >> On Thu, Apr 5, 2012 at 7:02 AM, Francesco Izzi <
> [email protected]>
> >> wrote:
> >>>
> >>> Hi Justing,
> >>>
> >>> i see your work, very impressed.
> >>>
> >>> I try to configure an ldap provider but i have always :
> >>>
> >>> javax.naming.InvalidNameException: [LDAP: error code 34 - invalid DN]
> >>>
> >>> my configuration parameter:
> >>>
> >>> name: ldap-geosdi
> >>> url: ldap://150.145.133.83/
> >>> user lookup pattern: dc=geoserver,dc=geosdi,dc=org
> >>>
> >>> user: uid=admin,ou=people,dc=geoserver,dc=geosdi,dc=org
> >>> pass: myPass
> >>>
> >>> the stack trace:
> >>>
> >>>
> >>>
> org.apache.wicket.util.io.SerializableChecker$WicketNotSerializableException:
> >>> Unable to serialize class: com.sun.jndi.ldap.LdapCtx
> >>> Field hierarchy is:
> >>> 3 [class=org.geoserver.security.web.SecurityNamedServiceNewPage,
> path=3]
> >>> private java.lang.Object
> >>> org.apache.wicket.MarkupContainer.children [class=[Ljava.lang.Object;]
> >>> protected org.apache.wicket.util.collections.MiniMap
> >>> org.apache.wicket.markup.html.link.BookmarkablePageLink.parameters[8]
> >>> [class=org.apache.wicket.markup.html.panel.FeedbackPanel,
> >>> path=3:feedback]
> >>> private java.lang.Object
> >>> org.apache.wicket.MarkupContainer.children
> >>> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$1,
> >>> path=3:feedback:feedbackul]
> >>> private java.lang.Object
> >>> org.apache.wicket.MarkupContainer.children
> >>>
> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView,
> >>> path=3:feedback:feedbackul:messages]
> >>> private java.lang.Object
> >>> org.apache.wicket.MarkupContainer.children
> >>> [class=org.apache.wicket.markup.html.list.ListItem,
> >>> path=3:feedback:feedbackul:messages:0]
> >>> java.lang.Object org.apache.wicket.Component.data
> >>> [class=[Ljava.lang.Object;]
> >>> java.lang.Object
> >>> org.apache.wicket.Component.data[0][1]
> >>> [class=org.apache.wicket.AttributeModifier]
> >>> private final org.apache.wicket.model.IModel
> >>> org.apache.wicket.AttributeModifier.replaceModel
> >>>
> >>>
> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView$1]
> >>> final org.apache.wicket.feedback.FeedbackMessage
> >>>
> >>>
> org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView$1.val$message
> >>> [class=org.apache.wicket.feedback.FeedbackMessage]
> >>> private final java.io.Serializable
> >>> org.apache.wicket.feedback.FeedbackMessage.message
> >>> [class=javax.naming.InvalidNameException]
> >>> protected java.lang.Object
> >>> javax.naming.NamingException.resolvedObj
> >>> [class=com.sun.jndi.ldap.LdapCtx] <----- field that is not
> >>> serializable
> >>> at
> >>>
> org.apache.wicket.util.io.SerializableChecker.check(SerializableChecker.java:346)
> >>>
> >>> Suggestion?
> >>>
> >>>
> >>> Regard,
> >>>
> >>> 2012/4/4 Justin Deoliveira <[email protected]>:
> >>> > Ok, build should be back to normal now. Thanks for the patience
> >>> > everyone.
> >>> >
> >>> > On Wed, Apr 4, 2012 at 2:51 AM, Justin Deoliveira <
> [email protected]>
> >>> > wrote:
> >>> >>
> >>> >> OK... good news i found the leak. Was a matter of making sure the
> >>> >> wicket
> >>> >> tester instance is destroyed in test tear down. Bad news is the
> build
> >>> >> is
> >>> >> still failing because of some issues in the jdbc security module.
> Those
> >>> >> tests arent actually supposed to be running, i put them in a
> profile to
> >>> >> explicitly be run. Again... will have to pick this up tomorrow. And
> >>> >> again...
> >>> >> apologies for inconvenience.
> >>> >>
> >>> >> On Wed, Apr 4, 2012 at 8:26 AM, Justin Deoliveira
> >>> >> <[email protected]>
> >>> >> wrote:
> >>> >>>
> >>> >>> Hi all,
> >>> >>>
> >>> >>>
> >>> >>> The security work has been committed. The settings on the build
> server
> >>> >>> (256M of heap for tests) have brought out a memory leak. I run with
> >>> >>> 512m
> >>> >>> locally (the default defined in the root pom) so I didn't see this
> >>> >>> before. I
> >>> >>> spent a while looking for the leak tonight but haven't come up with
> >>> >>> anything
> >>> >>> yet. I will have to pick this back up tomorrow, it will be my top
> >>> >>> priority.
> >>> >>>
> >>> >>> For now i have upped the test heap on the server to 512m as a
> >>> >>> temporary
> >>> >>> measure to try and get the build back. Hopefully that fixes it.
> >>> >>>
> >>> >>> Again I will pick this back up first thing tomorrow. I apologize
> for
> >>> >>> the inconvenience.
> >>> >>>
> >>> >>> -Justin
> >>> >>>
> >>> >>> --
> >>> >>> Justin Deoliveira
> >>> >>> OpenGeo - http://opengeo.org
> >>> >>> Enterprise support for open source geospatial.
> >>> >>>
> >>> >>
> >>> >>
> >>> >>
> >>> >> --
> >>> >> Justin Deoliveira
> >>> >> OpenGeo - http://opengeo.org
> >>> >> Enterprise support for open source geospatial.
> >>> >>
> >>> >
> >>> >
> >>> >
> >>> > --
> >>> > Justin Deoliveira
> >>> > OpenGeo - http://opengeo.org
> >>> > Enterprise support for open source geospatial.
> >>> >
> >>> >
> >>> >
> >>> >
> ------------------------------------------------------------------------------
> >>> > Better than sec? Nothing is better than sec when it comes to
> >>> > monitoring Big Data applications. Try Boundary one-second
> >>> > resolution app monitoring today. Free.
> >>> > http://p.sf.net/sfu/Boundary-dev2dev
> >>> > _______________________________________________
> >>> > Geoserver-devel mailing list
> >>> > [email protected]
> >>> > https://lists.sourceforge.net/lists/listinfo/geoserver-devel
> >>> >
> >>>
> >>>
> >>>
> >>> --
> >>> Francesco Izzi
> >>> CNR - IMAA
> >>> geoSDI
> >>> Direzione Tecnologie e Sviluppo
> >>>
> >>> C.da S. Loja
> >>> 85050 Tito Scalo - POTENZA (PZ)
> >>> Italia
> >>>
> >>> phone: +39 0971427305
> >>> fax: +39 0971 427271
> >>> mob: +39 3203126609
> >>> mail: [email protected]
> >>> skype: neofx8080
> >>>
> >>> web: http://www.geosdi.org
> >>
> >>
> >>
> >>
> >> --
> >> Justin Deoliveira
> >> OpenGeo - http://opengeo.org
> >> Enterprise support for open source geospatial.
> >>
> >
> >
> >
> > --
> > Francesco Izzi
> > CNR - IMAA
> > geoSDI
> > Direzione Tecnologie e Sviluppo
> >
> > C.da S. Loja
> > 85050 Tito Scalo - POTENZA (PZ)
> > Italia
> >
> > phone: +39 0971427305
> > fax: +39 0971 427271
> > mob: +39 3203126609
> > mail: [email protected]
> > skype: neofx8080
> >
> > web: http://www.geosdi.org
>
>
>
> --
> Francesco Izzi
> CNR - IMAA
> geoSDI
> Direzione Tecnologie e Sviluppo
>
> C.da S. Loja
> 85050 Tito Scalo - POTENZA (PZ)
> Italia
>
> phone: +39 0971427305
> fax: +39 0971 427271
> mob: +39 3203126609
> mail: [email protected]
> skype: neofx8080
>
> web: http://www.geosdi.org
>
--
Justin Deoliveira
OpenGeo - http://opengeo.org
Enterprise support for open source geospatial.
------------------------------------------------------------------------------
For Developers, A Lot Can Happen In A Second.
Boundary is the first to Know...and Tell You.
Monitor Your Applications in Ultra-Fine Resolution. Try it FREE!
http://p.sf.net/sfu/Boundary-d2dvs2
_______________________________________________
Geoserver-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/geoserver-devel
