Hi Justin, another issue.
I have 2 user in my ldap. admin with no role and fizzi with GP_ADMIN role. I logged in with fizzi and all works. if i try to login with admin user the effective user logged is fizzi. I log this... LOGIN WITH ADMIN 10 apr 17:42:59 INFO [geoserver.security] - org.springframework.security.authentication.UsernamePasswordAuthenticationToken@99d1ae08: Principal: org.springframework.security.ldap.userdetails.LdapUserDetailsImpl@2c5657b3: Dn: uid=admin,ou=people,dc=geoserver,dc=geosdi,dc=org; Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; CredentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ; Credentials: [PROTECTED]; Authenticated: true; Details: org.geoserver.security.filter.GeoServerWebAuthenticationDetails@fffe9938: RemoteIpAddress: 0:0:0:0:0:0:0:1%0; SessionId: qfsj4ceu9ffd; Not granted any authorities 10 apr 17:42:59 INFO [geoserver.security] - org.springframework.security.authentication.UsernamePasswordAuthenticationToken@3000f992: Principal: org.springframework.security.ldap.userdetails.LdapUserDetailsImpl@630282ea: Dn: uid=fizzi,ou=people,dc=geoserver,dc=geosdi,dc=org; Username: fizzi; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; CredentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_GP_ADMIN; Credentials: [PROTECTED]; Authenticated: true; Details: org.geoserver.security.filter.GeoServerWebAuthenticationDetails@fffe9938: RemoteIpAddress: 0:0:0:0:0:0:0:1%0; SessionId: qfsj4ceu9ffd; Granted Authorities: ROLE_GP_ADMIN Opinion? 2012/4/10 Justin Deoliveira <[email protected]>: > Yeah, we should definitely expose the ability to set the role prefix on the > ldap auth provider. Or perhaps to drop it all together. > > Francesco, can you open a jira issue for this? Thanks. > > -Justin > > > On Tue, Apr 10, 2012 at 9:51 AM, Christian Mueller <[email protected]> > wrote: >> >> >> Hi, Francesco and Justin >> >> I assume the problem is in the Spring DefaultLdapAuthoritiesPopulator >> class, the implementation uses a role prefix "ROLE_". I had the same problem >> with the J2EE proxy authenticator, a J2EE role "admin" was mapped to >> "ROLE_admin". >> I disabled this prefix logic behind the scenes for the J2EE proxy >> authenticator and do not modify the roles. >> >> Would be good to have a common strategy for all authentication providers, >> I would prefer not modifying role names provided by an external party. >> >> Christian >> >> >> >> 2012/4/10 Francesco Izzi <[email protected]> >>> >>> Hi Justin, >>> >>> I'm still testing with ldap, >>> >>> I noticed that if in my ldap tree there is a group called >>> "ROLE_GP_ADMIN" the Granted Authorities of Auth User: is >>> ROLE_ROLE_GP_ADMIN. >>> >>> I try to create a role in my ldap named GP_ADMIN and all works. >>> >>> Any opinion ? >>> >>> 2012/4/6 Justin Deoliveira <[email protected]>: >>> > Hi Francesco, >>> > >>> > Role assignment with the ldap provider is explained here: >>> > >>> > >>> > http://docs.geoserver.org/latest/en/user/security/auth/providers.html#role-assignment >>> > >>> > Basically, for those groups in ldap your user is a part of will have to >>> > present in the role service. So say you are part of an ldap group named >>> > "foo". That is mapped to the role "ROLE_FOO" when you are >>> > authenticated. So >>> > "ROLE_FOO" needs to be defined in the role service as an administrator >>> > role >>> > if you want to have full ui admin privileges. Explained here: >>> > >>> > >>> > http://docs.geoserver.org/latest/en/user/security/tutorials/ldap/index.html#map-ldap-groups-to-geoserver-roles >>> > >>> > The alternative is to ignore ldap groups and use a user group service. >>> > But >>> > this means having to redefine users in your user group service that are >>> > in >>> > your ldap server. But it gives you full control over the role >>> > assignment. >>> > >>> > On Fri, Apr 6, 2012 at 3:58 AM, Francesco Izzi >>> > <[email protected]> >>> > wrote: >>> >> >>> >> Hi Justin, >>> >> >>> >> i try to manage also ldap group. >>> >> >>> >> I set this for group binding: >>> >> >>> >> Group search base >>> >> ou=groups >>> >> >>> >> Group search filter >>> >> memberUid={0} >>> >> >>> >> The login working but the ldap user logged without any role. >>> >> >>> >> I see in the log: >>> >> >>> >> 06 apr 11:54:20 WARN >>> >> [authentication.SpringSecurityAuthenticationSource] - No >>> >> Authentication object set in SecurityContext - returning empty String >>> >> as Principal >>> >> 06 apr 11:54:20 WARN >>> >> [authentication.SpringSecurityAuthenticationSource] - No >>> >> Authentication object set in SecurityContext - returning empty String >>> >> as Credentials >>> >> >>> >> >>> >> >>> >> 2012/4/5 Francesco Izzi <[email protected]>: >>> >> > Yep Justin, >>> >> > >>> >> > works !!! >>> >> > >>> >> > >>> >> > Thanks, >>> >> > >>> >> > 2012/4/5 Justin Deoliveira <[email protected]>: >>> >> >> Hi Francesco, >>> >> >> >>> >> >> It is a bit weird but the root domain components are actually >>> >> >> specified >>> >> >> as >>> >> >> part of the server url... so try the following instead: >>> >> >> >>> >> >> url: ldap://150.145.133.83/dc=geoserver,dc=geosdi,dc=org >>> >> >> >>> >> >> Also, the user lookup is a template for a lookup, and generally not >>> >> >> a >>> >> >> fixed >>> >> >> user... but i guess it could be. The idea is to specify this: >>> >> >> >>> >> >> user: uid={0},ou=people,dc=geoserver,dc=geosdi,dc=org >>> >> >> >>> >> >> Where {0} is replaced with the username being logged in. The abobe >>> >> >> would >>> >> >> ignore the username specified and always log in as admin... perhaps >>> >> >> that is >>> >> >> intended. >>> >> >> >>> >> >> Also, there is a tutorial here that might be worth going through. >>> >> >> >>> >> >> >>> >> >> >>> >> >> http://docs.geoserver.org/latest/en/user/security/tutorials/ldap/index.html >>> >> >> >>> >> >> Hope that helps, let me know how it goes. >>> >> >> >>> >> >> -Justin >>> >> >> >>> >> >> >>> >> >> On Thu, Apr 5, 2012 at 7:02 AM, Francesco Izzi >>> >> >> <[email protected]> >>> >> >> wrote: >>> >> >>> >>> >> >>> Hi Justing, >>> >> >>> >>> >> >>> i see your work, very impressed. >>> >> >>> >>> >> >>> I try to configure an ldap provider but i have always : >>> >> >>> >>> >> >>> javax.naming.InvalidNameException: [LDAP: error code 34 - invalid >>> >> >>> DN] >>> >> >>> >>> >> >>> my configuration parameter: >>> >> >>> >>> >> >>> name: ldap-geosdi >>> >> >>> url: ldap://150.145.133.83/ >>> >> >>> user lookup pattern: dc=geoserver,dc=geosdi,dc=org >>> >> >>> >>> >> >>> user: uid=admin,ou=people,dc=geoserver,dc=geosdi,dc=org >>> >> >>> pass: myPass >>> >> >>> >>> >> >>> the stack trace: >>> >> >>> >>> >> >>> >>> >> >>> >>> >> >>> >>> >> >>> org.apache.wicket.util.io.SerializableChecker$WicketNotSerializableException: >>> >> >>> Unable to serialize class: com.sun.jndi.ldap.LdapCtx >>> >> >>> Field hierarchy is: >>> >> >>> 3 [class=org.geoserver.security.web.SecurityNamedServiceNewPage, >>> >> >>> path=3] >>> >> >>> private java.lang.Object >>> >> >>> org.apache.wicket.MarkupContainer.children >>> >> >>> [class=[Ljava.lang.Object;] >>> >> >>> protected org.apache.wicket.util.collections.MiniMap >>> >> >>> >>> >> >>> org.apache.wicket.markup.html.link.BookmarkablePageLink.parameters[8] >>> >> >>> [class=org.apache.wicket.markup.html.panel.FeedbackPanel, >>> >> >>> path=3:feedback] >>> >> >>> private java.lang.Object >>> >> >>> org.apache.wicket.MarkupContainer.children >>> >> >>> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$1, >>> >> >>> path=3:feedback:feedbackul] >>> >> >>> private java.lang.Object >>> >> >>> org.apache.wicket.MarkupContainer.children >>> >> >>> >>> >> >>> >>> >> >>> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView, >>> >> >>> path=3:feedback:feedbackul:messages] >>> >> >>> private java.lang.Object >>> >> >>> org.apache.wicket.MarkupContainer.children >>> >> >>> [class=org.apache.wicket.markup.html.list.ListItem, >>> >> >>> path=3:feedback:feedbackul:messages:0] >>> >> >>> java.lang.Object org.apache.wicket.Component.data >>> >> >>> [class=[Ljava.lang.Object;] >>> >> >>> java.lang.Object >>> >> >>> org.apache.wicket.Component.data[0][1] >>> >> >>> [class=org.apache.wicket.AttributeModifier] >>> >> >>> private final org.apache.wicket.model.IModel >>> >> >>> org.apache.wicket.AttributeModifier.replaceModel >>> >> >>> >>> >> >>> >>> >> >>> >>> >> >>> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView$1] >>> >> >>> final >>> >> >>> org.apache.wicket.feedback.FeedbackMessage >>> >> >>> >>> >> >>> >>> >> >>> >>> >> >>> org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView$1.val$message >>> >> >>> [class=org.apache.wicket.feedback.FeedbackMessage] >>> >> >>> private final java.io.Serializable >>> >> >>> org.apache.wicket.feedback.FeedbackMessage.message >>> >> >>> [class=javax.naming.InvalidNameException] >>> >> >>> protected java.lang.Object >>> >> >>> javax.naming.NamingException.resolvedObj >>> >> >>> [class=com.sun.jndi.ldap.LdapCtx] <----- field that is not >>> >> >>> serializable >>> >> >>> at >>> >> >>> >>> >> >>> >>> >> >>> org.apache.wicket.util.io.SerializableChecker.check(SerializableChecker.java:346) >>> >> >>> >>> >> >>> Suggestion? >>> >> >>> >>> >> >>> >>> >> >>> Regard, >>> >> >>> >>> >> >>> 2012/4/4 Justin Deoliveira <[email protected]>: >>> >> >>> > Ok, build should be back to normal now. Thanks for the patience >>> >> >>> > everyone. >>> >> >>> > >>> >> >>> > On Wed, Apr 4, 2012 at 2:51 AM, Justin Deoliveira >>> >> >>> > <[email protected]> >>> >> >>> > wrote: >>> >> >>> >> >>> >> >>> >> OK... good news i found the leak. Was a matter of making sure >>> >> >>> >> the >>> >> >>> >> wicket >>> >> >>> >> tester instance is destroyed in test tear down. Bad news is the >>> >> >>> >> build >>> >> >>> >> is >>> >> >>> >> still failing because of some issues in the jdbc security >>> >> >>> >> module. >>> >> >>> >> Those >>> >> >>> >> tests arent actually supposed to be running, i put them in a >>> >> >>> >> profile to >>> >> >>> >> explicitly be run. Again... will have to pick this up tomorrow. >>> >> >>> >> And >>> >> >>> >> again... >>> >> >>> >> apologies for inconvenience. >>> >> >>> >> >>> >> >>> >> On Wed, Apr 4, 2012 at 8:26 AM, Justin Deoliveira >>> >> >>> >> <[email protected]> >>> >> >>> >> wrote: >>> >> >>> >>> >>> >> >>> >>> Hi all, >>> >> >>> >>> >>> >> >>> >>> >>> >> >>> >>> The security work has been committed. The settings on the >>> >> >>> >>> build >>> >> >>> >>> server >>> >> >>> >>> (256M of heap for tests) have brought out a memory leak. I run >>> >> >>> >>> with >>> >> >>> >>> 512m >>> >> >>> >>> locally (the default defined in the root pom) so I didn't see >>> >> >>> >>> this >>> >> >>> >>> before. I >>> >> >>> >>> spent a while looking for the leak tonight but haven't come up >>> >> >>> >>> with >>> >> >>> >>> anything >>> >> >>> >>> yet. I will have to pick this back up tomorrow, it will be my >>> >> >>> >>> top >>> >> >>> >>> priority. >>> >> >>> >>> >>> >> >>> >>> For now i have upped the test heap on the server to 512m as a >>> >> >>> >>> temporary >>> >> >>> >>> measure to try and get the build back. Hopefully that fixes >>> >> >>> >>> it. >>> >> >>> >>> >>> >> >>> >>> Again I will pick this back up first thing tomorrow. I >>> >> >>> >>> apologize >>> >> >>> >>> for >>> >> >>> >>> the inconvenience. >>> >> >>> >>> >>> >> >>> >>> -Justin >>> >> >>> >>> >>> >> >>> >>> -- >>> >> >>> >>> Justin Deoliveira >>> >> >>> >>> OpenGeo - http://opengeo.org >>> >> >>> >>> Enterprise support for open source geospatial. >>> >> >>> >>> >>> >> >>> >> >>> >> >>> >> >>> >> >>> >> >>> >> >>> >> -- >>> >> >>> >> Justin Deoliveira >>> >> >>> >> OpenGeo - http://opengeo.org >>> >> >>> >> Enterprise support for open source geospatial. >>> >> >>> >> >>> >> >>> > >>> >> >>> > >>> >> >>> > >>> >> >>> > -- >>> >> >>> > Justin Deoliveira >>> >> >>> > OpenGeo - http://opengeo.org >>> >> >>> > Enterprise support for open source geospatial. >>> >> >>> > >>> >> >>> > >>> >> >>> > >>> >> >>> > >>> >> >>> > >>> >> >>> > ------------------------------------------------------------------------------ >>> >> >>> > Better than sec? Nothing is better than sec when it comes to >>> >> >>> > monitoring Big Data applications. Try Boundary one-second >>> >> >>> > resolution app monitoring today. Free. >>> >> >>> > http://p.sf.net/sfu/Boundary-dev2dev >>> >> >>> > _______________________________________________ >>> >> >>> > Geoserver-devel mailing list >>> >> >>> > [email protected] >>> >> >>> > https://lists.sourceforge.net/lists/listinfo/geoserver-devel >>> >> >>> > >>> >> >>> >>> >> >>> >>> >> >>> >>> >> >>> -- >>> >> >>> Francesco Izzi >>> >> >>> CNR - IMAA >>> >> >>> geoSDI >>> >> >>> Direzione Tecnologie e Sviluppo >>> >> >>> >>> >> >>> C.da S. Loja >>> >> >>> 85050 Tito Scalo - POTENZA (PZ) >>> >> >>> Italia >>> >> >>> >>> >> >>> phone: +39 0971427305 >>> >> >>> fax: +39 0971 427271 >>> >> >>> mob: +39 3203126609 >>> >> >>> mail: [email protected] >>> >> >>> skype: neofx8080 >>> >> >>> >>> >> >>> web: http://www.geosdi.org >>> >> >> >>> >> >> >>> >> >> >>> >> >> >>> >> >> -- >>> >> >> Justin Deoliveira >>> >> >> OpenGeo - http://opengeo.org >>> >> >> Enterprise support for open source geospatial. >>> >> >> >>> >> > >>> >> > >>> >> > >>> >> > -- >>> >> > Francesco Izzi >>> >> > CNR - IMAA >>> >> > geoSDI >>> >> > Direzione Tecnologie e Sviluppo >>> >> > >>> >> > C.da S. Loja >>> >> > 85050 Tito Scalo - POTENZA (PZ) >>> >> > Italia >>> >> > >>> >> > phone: +39 0971427305 >>> >> > fax: +39 0971 427271 >>> >> > mob: +39 3203126609 >>> >> > mail: [email protected] >>> >> > skype: neofx8080 >>> >> > >>> >> > web: http://www.geosdi.org >>> >> >>> >> >>> >> >>> >> -- >>> >> Francesco Izzi >>> >> CNR - IMAA >>> >> geoSDI >>> >> Direzione Tecnologie e Sviluppo >>> >> >>> >> C.da S. Loja >>> >> 85050 Tito Scalo - POTENZA (PZ) >>> >> Italia >>> >> >>> >> phone: +39 0971427305 >>> >> fax: +39 0971 427271 >>> >> mob: +39 3203126609 >>> >> mail: [email protected] >>> >> skype: neofx8080 >>> >> >>> >> web: http://www.geosdi.org >>> > >>> > >>> > >>> > >>> > -- >>> > Justin Deoliveira >>> > OpenGeo - http://opengeo.org >>> > Enterprise support for open source geospatial. >>> > >>> >>> >>> >>> -- >>> Francesco Izzi >>> CNR - IMAA >>> geoSDI >>> Direzione Tecnologie e Sviluppo >>> >>> C.da S. Loja >>> 85050 Tito Scalo - POTENZA (PZ) >>> Italia >>> >>> phone: +39 0971427305 >>> fax: +39 0971 427271 >>> mob: +39 3203126609 >>> mail: [email protected] >>> skype: neofx8080 >>> >>> web: http://www.geosdi.org >>> >>> >>> ------------------------------------------------------------------------------ >>> Better than sec? Nothing is better than sec when it comes to >>> monitoring Big Data applications. Try Boundary one-second >>> resolution app monitoring today. Free. >>> http://p.sf.net/sfu/Boundary-dev2dev >>> _______________________________________________ >>> Geoserver-devel mailing list >>> [email protected] >>> https://lists.sourceforge.net/lists/listinfo/geoserver-devel >> >> > > > > -- > Justin Deoliveira > OpenGeo - http://opengeo.org > Enterprise support for open source geospatial. > -- Francesco Izzi CNR - IMAA geoSDI Direzione Tecnologie e Sviluppo C.da S. Loja 85050 Tito Scalo - POTENZA (PZ) Italia phone: +39 0971427305 fax: +39 0971 427271 mob: +39 3203126609 mail: [email protected] skype: neofx8080 web: http://www.geosdi.org ------------------------------------------------------------------------------ Better than sec? Nothing is better than sec when it comes to monitoring Big Data applications. Try Boundary one-second resolution app monitoring today. Free. http://p.sf.net/sfu/Boundary-dev2dev _______________________________________________ Geoserver-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/geoserver-devel
