Hi, Francesco and Justin
I assume the problem is in the Spring DefaultLdapAuthoritiesPopulator
class, the implementation uses a role prefix "ROLE_". I had the same
problem with the J2EE proxy authenticator, a J2EE role "admin" was mapped
to "ROLE_admin".
I disabled this prefix logic behind the scenes for the J2EE proxy
authenticator and do not modify the roles.
Would be good to have a common strategy for all authentication providers, I
would prefer not modifying role names provided by an external party.
Christian
2012/4/10 Francesco Izzi <[email protected]>
> Hi Justin,
>
> I'm still testing with ldap,
>
> I noticed that if in my ldap tree there is a group called
> "ROLE_GP_ADMIN" the Granted Authorities of Auth User: is
> ROLE_ROLE_GP_ADMIN.
>
> I try to create a role in my ldap named GP_ADMIN and all works.
>
> Any opinion ?
>
> 2012/4/6 Justin Deoliveira <[email protected]>:
> > Hi Francesco,
> >
> > Role assignment with the ldap provider is explained here:
> >
> >
> http://docs.geoserver.org/latest/en/user/security/auth/providers.html#role-assignment
> >
> > Basically, for those groups in ldap your user is a part of will have to
> > present in the role service. So say you are part of an ldap group named
> > "foo". That is mapped to the role "ROLE_FOO" when you are authenticated.
> So
> > "ROLE_FOO" needs to be defined in the role service as an administrator
> role
> > if you want to have full ui admin privileges. Explained here:
> >
> >
> http://docs.geoserver.org/latest/en/user/security/tutorials/ldap/index.html#map-ldap-groups-to-geoserver-roles
> >
> > The alternative is to ignore ldap groups and use a user group service.
> But
> > this means having to redefine users in your user group service that are
> in
> > your ldap server. But it gives you full control over the role assignment.
> >
> > On Fri, Apr 6, 2012 at 3:58 AM, Francesco Izzi <
> [email protected]>
> > wrote:
> >>
> >> Hi Justin,
> >>
> >> i try to manage also ldap group.
> >>
> >> I set this for group binding:
> >>
> >> Group search base
> >> ou=groups
> >>
> >> Group search filter
> >> memberUid={0}
> >>
> >> The login working but the ldap user logged without any role.
> >>
> >> I see in the log:
> >>
> >> 06 apr 11:54:20 WARN
> >> [authentication.SpringSecurityAuthenticationSource] - No
> >> Authentication object set in SecurityContext - returning empty String
> >> as Principal
> >> 06 apr 11:54:20 WARN
> >> [authentication.SpringSecurityAuthenticationSource] - No
> >> Authentication object set in SecurityContext - returning empty String
> >> as Credentials
> >>
> >>
> >>
> >> 2012/4/5 Francesco Izzi <[email protected]>:
> >> > Yep Justin,
> >> >
> >> > works !!!
> >> >
> >> >
> >> > Thanks,
> >> >
> >> > 2012/4/5 Justin Deoliveira <[email protected]>:
> >> >> Hi Francesco,
> >> >>
> >> >> It is a bit weird but the root domain components are actually
> specified
> >> >> as
> >> >> part of the server url... so try the following instead:
> >> >>
> >> >> url: ldap://150.145.133.83/dc=geoserver,dc=geosdi,dc=org
> >> >>
> >> >> Also, the user lookup is a template for a lookup, and generally not a
> >> >> fixed
> >> >> user... but i guess it could be. The idea is to specify this:
> >> >>
> >> >> user: uid={0},ou=people,dc=geoserver,dc=geosdi,dc=org
> >> >>
> >> >> Where {0} is replaced with the username being logged in. The abobe
> >> >> would
> >> >> ignore the username specified and always log in as admin... perhaps
> >> >> that is
> >> >> intended.
> >> >>
> >> >> Also, there is a tutorial here that might be worth going through.
> >> >>
> >> >>
> >> >>
> http://docs.geoserver.org/latest/en/user/security/tutorials/ldap/index.html
> >> >>
> >> >> Hope that helps, let me know how it goes.
> >> >>
> >> >> -Justin
> >> >>
> >> >>
> >> >> On Thu, Apr 5, 2012 at 7:02 AM, Francesco Izzi
> >> >> <[email protected]>
> >> >> wrote:
> >> >>>
> >> >>> Hi Justing,
> >> >>>
> >> >>> i see your work, very impressed.
> >> >>>
> >> >>> I try to configure an ldap provider but i have always :
> >> >>>
> >> >>> javax.naming.InvalidNameException: [LDAP: error code 34 - invalid
> DN]
> >> >>>
> >> >>> my configuration parameter:
> >> >>>
> >> >>> name: ldap-geosdi
> >> >>> url: ldap://150.145.133.83/
> >> >>> user lookup pattern: dc=geoserver,dc=geosdi,dc=org
> >> >>>
> >> >>> user: uid=admin,ou=people,dc=geoserver,dc=geosdi,dc=org
> >> >>> pass: myPass
> >> >>>
> >> >>> the stack trace:
> >> >>>
> >> >>>
> >> >>>
> >> >>>
> org.apache.wicket.util.io.SerializableChecker$WicketNotSerializableException:
> >> >>> Unable to serialize class: com.sun.jndi.ldap.LdapCtx
> >> >>> Field hierarchy is:
> >> >>> 3 [class=org.geoserver.security.web.SecurityNamedServiceNewPage,
> >> >>> path=3]
> >> >>> private java.lang.Object
> >> >>> org.apache.wicket.MarkupContainer.children
> [class=[Ljava.lang.Object;]
> >> >>> protected org.apache.wicket.util.collections.MiniMap
> >> >>>
> org.apache.wicket.markup.html.link.BookmarkablePageLink.parameters[8]
> >> >>> [class=org.apache.wicket.markup.html.panel.FeedbackPanel,
> >> >>> path=3:feedback]
> >> >>> private java.lang.Object
> >> >>> org.apache.wicket.MarkupContainer.children
> >> >>> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$1,
> >> >>> path=3:feedback:feedbackul]
> >> >>> private java.lang.Object
> >> >>> org.apache.wicket.MarkupContainer.children
> >> >>>
> >> >>>
> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView,
> >> >>> path=3:feedback:feedbackul:messages]
> >> >>> private java.lang.Object
> >> >>> org.apache.wicket.MarkupContainer.children
> >> >>> [class=org.apache.wicket.markup.html.list.ListItem,
> >> >>> path=3:feedback:feedbackul:messages:0]
> >> >>> java.lang.Object org.apache.wicket.Component.data
> >> >>> [class=[Ljava.lang.Object;]
> >> >>> java.lang.Object
> >> >>> org.apache.wicket.Component.data[0][1]
> >> >>> [class=org.apache.wicket.AttributeModifier]
> >> >>> private final org.apache.wicket.model.IModel
> >> >>> org.apache.wicket.AttributeModifier.replaceModel
> >> >>>
> >> >>>
> >> >>>
> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView$1]
> >> >>> final org.apache.wicket.feedback.FeedbackMessage
> >> >>>
> >> >>>
> >> >>>
> org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView$1.val$message
> >> >>> [class=org.apache.wicket.feedback.FeedbackMessage]
> >> >>> private final java.io.Serializable
> >> >>> org.apache.wicket.feedback.FeedbackMessage.message
> >> >>> [class=javax.naming.InvalidNameException]
> >> >>> protected java.lang.Object
> >> >>> javax.naming.NamingException.resolvedObj
> >> >>> [class=com.sun.jndi.ldap.LdapCtx] <----- field that is not
> >> >>> serializable
> >> >>> at
> >> >>>
> >> >>>
> org.apache.wicket.util.io.SerializableChecker.check(SerializableChecker.java:346)
> >> >>>
> >> >>> Suggestion?
> >> >>>
> >> >>>
> >> >>> Regard,
> >> >>>
> >> >>> 2012/4/4 Justin Deoliveira <[email protected]>:
> >> >>> > Ok, build should be back to normal now. Thanks for the patience
> >> >>> > everyone.
> >> >>> >
> >> >>> > On Wed, Apr 4, 2012 at 2:51 AM, Justin Deoliveira
> >> >>> > <[email protected]>
> >> >>> > wrote:
> >> >>> >>
> >> >>> >> OK... good news i found the leak. Was a matter of making sure the
> >> >>> >> wicket
> >> >>> >> tester instance is destroyed in test tear down. Bad news is the
> >> >>> >> build
> >> >>> >> is
> >> >>> >> still failing because of some issues in the jdbc security module.
> >> >>> >> Those
> >> >>> >> tests arent actually supposed to be running, i put them in a
> >> >>> >> profile to
> >> >>> >> explicitly be run. Again... will have to pick this up tomorrow.
> And
> >> >>> >> again...
> >> >>> >> apologies for inconvenience.
> >> >>> >>
> >> >>> >> On Wed, Apr 4, 2012 at 8:26 AM, Justin Deoliveira
> >> >>> >> <[email protected]>
> >> >>> >> wrote:
> >> >>> >>>
> >> >>> >>> Hi all,
> >> >>> >>>
> >> >>> >>>
> >> >>> >>> The security work has been committed. The settings on the build
> >> >>> >>> server
> >> >>> >>> (256M of heap for tests) have brought out a memory leak. I run
> >> >>> >>> with
> >> >>> >>> 512m
> >> >>> >>> locally (the default defined in the root pom) so I didn't see
> this
> >> >>> >>> before. I
> >> >>> >>> spent a while looking for the leak tonight but haven't come up
> >> >>> >>> with
> >> >>> >>> anything
> >> >>> >>> yet. I will have to pick this back up tomorrow, it will be my
> top
> >> >>> >>> priority.
> >> >>> >>>
> >> >>> >>> For now i have upped the test heap on the server to 512m as a
> >> >>> >>> temporary
> >> >>> >>> measure to try and get the build back. Hopefully that fixes it.
> >> >>> >>>
> >> >>> >>> Again I will pick this back up first thing tomorrow. I apologize
> >> >>> >>> for
> >> >>> >>> the inconvenience.
> >> >>> >>>
> >> >>> >>> -Justin
> >> >>> >>>
> >> >>> >>> --
> >> >>> >>> Justin Deoliveira
> >> >>> >>> OpenGeo - http://opengeo.org
> >> >>> >>> Enterprise support for open source geospatial.
> >> >>> >>>
> >> >>> >>
> >> >>> >>
> >> >>> >>
> >> >>> >> --
> >> >>> >> Justin Deoliveira
> >> >>> >> OpenGeo - http://opengeo.org
> >> >>> >> Enterprise support for open source geospatial.
> >> >>> >>
> >> >>> >
> >> >>> >
> >> >>> >
> >> >>> > --
> >> >>> > Justin Deoliveira
> >> >>> > OpenGeo - http://opengeo.org
> >> >>> > Enterprise support for open source geospatial.
> >> >>> >
> >> >>> >
> >> >>> >
> >> >>> >
> >> >>> >
> ------------------------------------------------------------------------------
> >> >>> > Better than sec? Nothing is better than sec when it comes to
> >> >>> > monitoring Big Data applications. Try Boundary one-second
> >> >>> > resolution app monitoring today. Free.
> >> >>> > http://p.sf.net/sfu/Boundary-dev2dev
> >> >>> > _______________________________________________
> >> >>> > Geoserver-devel mailing list
> >> >>> > [email protected]
> >> >>> > https://lists.sourceforge.net/lists/listinfo/geoserver-devel
> >> >>> >
> >> >>>
> >> >>>
> >> >>>
> >> >>> --
> >> >>> Francesco Izzi
> >> >>> CNR - IMAA
> >> >>> geoSDI
> >> >>> Direzione Tecnologie e Sviluppo
> >> >>>
> >> >>> C.da S. Loja
> >> >>> 85050 Tito Scalo - POTENZA (PZ)
> >> >>> Italia
> >> >>>
> >> >>> phone: +39 0971427305
> >> >>> fax: +39 0971 427271
> >> >>> mob: +39 3203126609
> >> >>> mail: [email protected]
> >> >>> skype: neofx8080
> >> >>>
> >> >>> web: http://www.geosdi.org
> >> >>
> >> >>
> >> >>
> >> >>
> >> >> --
> >> >> Justin Deoliveira
> >> >> OpenGeo - http://opengeo.org
> >> >> Enterprise support for open source geospatial.
> >> >>
> >> >
> >> >
> >> >
> >> > --
> >> > Francesco Izzi
> >> > CNR - IMAA
> >> > geoSDI
> >> > Direzione Tecnologie e Sviluppo
> >> >
> >> > C.da S. Loja
> >> > 85050 Tito Scalo - POTENZA (PZ)
> >> > Italia
> >> >
> >> > phone: +39 0971427305
> >> > fax: +39 0971 427271
> >> > mob: +39 3203126609
> >> > mail: [email protected]
> >> > skype: neofx8080
> >> >
> >> > web: http://www.geosdi.org
> >>
> >>
> >>
> >> --
> >> Francesco Izzi
> >> CNR - IMAA
> >> geoSDI
> >> Direzione Tecnologie e Sviluppo
> >>
> >> C.da S. Loja
> >> 85050 Tito Scalo - POTENZA (PZ)
> >> Italia
> >>
> >> phone: +39 0971427305
> >> fax: +39 0971 427271
> >> mob: +39 3203126609
> >> mail: [email protected]
> >> skype: neofx8080
> >>
> >> web: http://www.geosdi.org
> >
> >
> >
> >
> > --
> > Justin Deoliveira
> > OpenGeo - http://opengeo.org
> > Enterprise support for open source geospatial.
> >
>
>
>
> --
> Francesco Izzi
> CNR - IMAA
> geoSDI
> Direzione Tecnologie e Sviluppo
>
> C.da S. Loja
> 85050 Tito Scalo - POTENZA (PZ)
> Italia
>
> phone: +39 0971427305
> fax: +39 0971 427271
> mob: +39 3203126609
> mail: [email protected]
> skype: neofx8080
>
> web: http://www.geosdi.org
>
>
> ------------------------------------------------------------------------------
> Better than sec? Nothing is better than sec when it comes to
> monitoring Big Data applications. Try Boundary one-second
> resolution app monitoring today. Free.
> http://p.sf.net/sfu/Boundary-dev2dev
> _______________________________________________
> Geoserver-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/geoserver-devel
>
------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev
_______________________________________________
Geoserver-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/geoserver-devel
