Hi Francesco, can you try to logout fizzy explicitly ?
If you can login with admin, he should have the role "ROLE_AUTHORIZED"
2012/4/10 Francesco Izzi <[email protected]>
> Hi Justin,
>
> another issue.
>
> I have 2 user in my ldap.
>
> admin with no role
> and fizzi with GP_ADMIN role.
>
> I logged in with fizzi and all works.
>
> if i try to login with admin user the effective user logged is fizzi.
>
> I log this...
>
> LOGIN WITH ADMIN
>
> 10 apr 17:42:59 INFO [geoserver.security] -
>
> org.springframework.security.authentication.UsernamePasswordAuthenticationToken@99d1ae08
> :
> Principal:
> org.springframework.security.ldap.userdetails.LdapUserDetailsImpl@2c5657b3
> :
> Dn: uid=admin,ou=people,dc=geoserver,dc=geosdi,dc=org; Username:
> admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true;
> CredentialsNonExpired: true; AccountNonLocked: true; Granted
> Authorities: ; Credentials: [PROTECTED]; Authenticated: true; Details:
> org.geoserver.security.filter.GeoServerWebAuthenticationDetails@fffe9938:
> RemoteIpAddress: 0:0:0:0:0:0:0:1%0; SessionId: qfsj4ceu9ffd; Not
> granted any authorities
> 10 apr 17:42:59 INFO [geoserver.security] -
>
> org.springframework.security.authentication.UsernamePasswordAuthenticationToken@3000f992
> :
> Principal:
> org.springframework.security.ldap.userdetails.LdapUserDetailsImpl@630282ea
> :
> Dn: uid=fizzi,ou=people,dc=geoserver,dc=geosdi,dc=org; Username:
> fizzi; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true;
> CredentialsNonExpired: true; AccountNonLocked: true; Granted
> Authorities: ROLE_GP_ADMIN; Credentials: [PROTECTED]; Authenticated:
> true; Details:
> org.geoserver.security.filter.GeoServerWebAuthenticationDetails@fffe9938:
> RemoteIpAddress: 0:0:0:0:0:0:0:1%0; SessionId: qfsj4ceu9ffd; Granted
> Authorities: ROLE_GP_ADMIN
>
> Opinion?
>
>
>
> 2012/4/10 Justin Deoliveira <[email protected]>:
> > Yeah, we should definitely expose the ability to set the role prefix on
> the
> > ldap auth provider. Or perhaps to drop it all together.
> >
> > Francesco, can you open a jira issue for this? Thanks.
> >
> > -Justin
> >
> >
> > On Tue, Apr 10, 2012 at 9:51 AM, Christian Mueller <[email protected]>
> > wrote:
> >>
> >>
> >> Hi, Francesco and Justin
> >>
> >> I assume the problem is in the Spring DefaultLdapAuthoritiesPopulator
> >> class, the implementation uses a role prefix "ROLE_". I had the same
> problem
> >> with the J2EE proxy authenticator, a J2EE role "admin" was mapped to
> >> "ROLE_admin".
> >> I disabled this prefix logic behind the scenes for the J2EE proxy
> >> authenticator and do not modify the roles.
> >>
> >> Would be good to have a common strategy for all authentication
> providers,
> >> I would prefer not modifying role names provided by an external party.
> >>
> >> Christian
> >>
> >>
> >>
> >> 2012/4/10 Francesco Izzi <[email protected]>
> >>>
> >>> Hi Justin,
> >>>
> >>> I'm still testing with ldap,
> >>>
> >>> I noticed that if in my ldap tree there is a group called
> >>> "ROLE_GP_ADMIN" the Granted Authorities of Auth User: is
> >>> ROLE_ROLE_GP_ADMIN.
> >>>
> >>> I try to create a role in my ldap named GP_ADMIN and all works.
> >>>
> >>> Any opinion ?
> >>>
> >>> 2012/4/6 Justin Deoliveira <[email protected]>:
> >>> > Hi Francesco,
> >>> >
> >>> > Role assignment with the ldap provider is explained here:
> >>> >
> >>> >
> >>> >
> http://docs.geoserver.org/latest/en/user/security/auth/providers.html#role-assignment
> >>> >
> >>> > Basically, for those groups in ldap your user is a part of will have
> to
> >>> > present in the role service. So say you are part of an ldap group
> named
> >>> > "foo". That is mapped to the role "ROLE_FOO" when you are
> >>> > authenticated. So
> >>> > "ROLE_FOO" needs to be defined in the role service as an
> administrator
> >>> > role
> >>> > if you want to have full ui admin privileges. Explained here:
> >>> >
> >>> >
> >>> >
> http://docs.geoserver.org/latest/en/user/security/tutorials/ldap/index.html#map-ldap-groups-to-geoserver-roles
> >>> >
> >>> > The alternative is to ignore ldap groups and use a user group
> service.
> >>> > But
> >>> > this means having to redefine users in your user group service that
> are
> >>> > in
> >>> > your ldap server. But it gives you full control over the role
> >>> > assignment.
> >>> >
> >>> > On Fri, Apr 6, 2012 at 3:58 AM, Francesco Izzi
> >>> > <[email protected]>
> >>> > wrote:
> >>> >>
> >>> >> Hi Justin,
> >>> >>
> >>> >> i try to manage also ldap group.
> >>> >>
> >>> >> I set this for group binding:
> >>> >>
> >>> >> Group search base
> >>> >> ou=groups
> >>> >>
> >>> >> Group search filter
> >>> >> memberUid={0}
> >>> >>
> >>> >> The login working but the ldap user logged without any role.
> >>> >>
> >>> >> I see in the log:
> >>> >>
> >>> >> 06 apr 11:54:20 WARN
> >>> >> [authentication.SpringSecurityAuthenticationSource] - No
> >>> >> Authentication object set in SecurityContext - returning empty
> String
> >>> >> as Principal
> >>> >> 06 apr 11:54:20 WARN
> >>> >> [authentication.SpringSecurityAuthenticationSource] - No
> >>> >> Authentication object set in SecurityContext - returning empty
> String
> >>> >> as Credentials
> >>> >>
> >>> >>
> >>> >>
> >>> >> 2012/4/5 Francesco Izzi <[email protected]>:
> >>> >> > Yep Justin,
> >>> >> >
> >>> >> > works !!!
> >>> >> >
> >>> >> >
> >>> >> > Thanks,
> >>> >> >
> >>> >> > 2012/4/5 Justin Deoliveira <[email protected]>:
> >>> >> >> Hi Francesco,
> >>> >> >>
> >>> >> >> It is a bit weird but the root domain components are actually
> >>> >> >> specified
> >>> >> >> as
> >>> >> >> part of the server url... so try the following instead:
> >>> >> >>
> >>> >> >> url: ldap://150.145.133.83/dc=geoserver,dc=geosdi,dc=org
> >>> >> >>
> >>> >> >> Also, the user lookup is a template for a lookup, and generally
> not
> >>> >> >> a
> >>> >> >> fixed
> >>> >> >> user... but i guess it could be. The idea is to specify this:
> >>> >> >>
> >>> >> >> user: uid={0},ou=people,dc=geoserver,dc=geosdi,dc=org
> >>> >> >>
> >>> >> >> Where {0} is replaced with the username being logged in. The
> abobe
> >>> >> >> would
> >>> >> >> ignore the username specified and always log in as admin...
> perhaps
> >>> >> >> that is
> >>> >> >> intended.
> >>> >> >>
> >>> >> >> Also, there is a tutorial here that might be worth going through.
> >>> >> >>
> >>> >> >>
> >>> >> >>
> >>> >> >>
> http://docs.geoserver.org/latest/en/user/security/tutorials/ldap/index.html
> >>> >> >>
> >>> >> >> Hope that helps, let me know how it goes.
> >>> >> >>
> >>> >> >> -Justin
> >>> >> >>
> >>> >> >>
> >>> >> >> On Thu, Apr 5, 2012 at 7:02 AM, Francesco Izzi
> >>> >> >> <[email protected]>
> >>> >> >> wrote:
> >>> >> >>>
> >>> >> >>> Hi Justing,
> >>> >> >>>
> >>> >> >>> i see your work, very impressed.
> >>> >> >>>
> >>> >> >>> I try to configure an ldap provider but i have always :
> >>> >> >>>
> >>> >> >>> javax.naming.InvalidNameException: [LDAP: error code 34 -
> invalid
> >>> >> >>> DN]
> >>> >> >>>
> >>> >> >>> my configuration parameter:
> >>> >> >>>
> >>> >> >>> name: ldap-geosdi
> >>> >> >>> url: ldap://150.145.133.83/
> >>> >> >>> user lookup pattern: dc=geoserver,dc=geosdi,dc=org
> >>> >> >>>
> >>> >> >>> user: uid=admin,ou=people,dc=geoserver,dc=geosdi,dc=org
> >>> >> >>> pass: myPass
> >>> >> >>>
> >>> >> >>> the stack trace:
> >>> >> >>>
> >>> >> >>>
> >>> >> >>>
> >>> >> >>>
> >>> >> >>>
> org.apache.wicket.util.io.SerializableChecker$WicketNotSerializableException:
> >>> >> >>> Unable to serialize class: com.sun.jndi.ldap.LdapCtx
> >>> >> >>> Field hierarchy is:
> >>> >> >>> 3
> [class=org.geoserver.security.web.SecurityNamedServiceNewPage,
> >>> >> >>> path=3]
> >>> >> >>> private java.lang.Object
> >>> >> >>> org.apache.wicket.MarkupContainer.children
> >>> >> >>> [class=[Ljava.lang.Object;]
> >>> >> >>> protected org.apache.wicket.util.collections.MiniMap
> >>> >> >>>
> >>> >> >>>
> org.apache.wicket.markup.html.link.BookmarkablePageLink.parameters[8]
> >>> >> >>> [class=org.apache.wicket.markup.html.panel.FeedbackPanel,
> >>> >> >>> path=3:feedback]
> >>> >> >>> private java.lang.Object
> >>> >> >>> org.apache.wicket.MarkupContainer.children
> >>> >> >>> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$1,
> >>> >> >>> path=3:feedback:feedbackul]
> >>> >> >>> private java.lang.Object
> >>> >> >>> org.apache.wicket.MarkupContainer.children
> >>> >> >>>
> >>> >> >>>
> >>> >> >>>
> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView,
> >>> >> >>> path=3:feedback:feedbackul:messages]
> >>> >> >>> private java.lang.Object
> >>> >> >>> org.apache.wicket.MarkupContainer.children
> >>> >> >>> [class=org.apache.wicket.markup.html.list.ListItem,
> >>> >> >>> path=3:feedback:feedbackul:messages:0]
> >>> >> >>> java.lang.Object org.apache.wicket.Component.data
> >>> >> >>> [class=[Ljava.lang.Object;]
> >>> >> >>> java.lang.Object
> >>> >> >>> org.apache.wicket.Component.data[0][1]
> >>> >> >>> [class=org.apache.wicket.AttributeModifier]
> >>> >> >>> private final org.apache.wicket.model.IModel
> >>> >> >>> org.apache.wicket.AttributeModifier.replaceModel
> >>> >> >>>
> >>> >> >>>
> >>> >> >>>
> >>> >> >>>
> [class=org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView$1]
> >>> >> >>> final
> >>> >> >>> org.apache.wicket.feedback.FeedbackMessage
> >>> >> >>>
> >>> >> >>>
> >>> >> >>>
> >>> >> >>>
> org.apache.wicket.markup.html.panel.FeedbackPanel$MessageListView$1.val$message
> >>> >> >>> [class=org.apache.wicket.feedback.FeedbackMessage]
> >>> >> >>> private final java.io.Serializable
> >>> >> >>> org.apache.wicket.feedback.FeedbackMessage.message
> >>> >> >>> [class=javax.naming.InvalidNameException]
> >>> >> >>> protected java.lang.Object
> >>> >> >>> javax.naming.NamingException.resolvedObj
> >>> >> >>> [class=com.sun.jndi.ldap.LdapCtx] <----- field that is not
> >>> >> >>> serializable
> >>> >> >>> at
> >>> >> >>>
> >>> >> >>>
> >>> >> >>>
> org.apache.wicket.util.io.SerializableChecker.check(SerializableChecker.java:346)
> >>> >> >>>
> >>> >> >>> Suggestion?
> >>> >> >>>
> >>> >> >>>
> >>> >> >>> Regard,
> >>> >> >>>
> >>> >> >>> 2012/4/4 Justin Deoliveira <[email protected]>:
> >>> >> >>> > Ok, build should be back to normal now. Thanks for the
> patience
> >>> >> >>> > everyone.
> >>> >> >>> >
> >>> >> >>> > On Wed, Apr 4, 2012 at 2:51 AM, Justin Deoliveira
> >>> >> >>> > <[email protected]>
> >>> >> >>> > wrote:
> >>> >> >>> >>
> >>> >> >>> >> OK... good news i found the leak. Was a matter of making sure
> >>> >> >>> >> the
> >>> >> >>> >> wicket
> >>> >> >>> >> tester instance is destroyed in test tear down. Bad news is
> the
> >>> >> >>> >> build
> >>> >> >>> >> is
> >>> >> >>> >> still failing because of some issues in the jdbc security
> >>> >> >>> >> module.
> >>> >> >>> >> Those
> >>> >> >>> >> tests arent actually supposed to be running, i put them in a
> >>> >> >>> >> profile to
> >>> >> >>> >> explicitly be run. Again... will have to pick this
> up tomorrow.
> >>> >> >>> >> And
> >>> >> >>> >> again...
> >>> >> >>> >> apologies for inconvenience.
> >>> >> >>> >>
> >>> >> >>> >> On Wed, Apr 4, 2012 at 8:26 AM, Justin Deoliveira
> >>> >> >>> >> <[email protected]>
> >>> >> >>> >> wrote:
> >>> >> >>> >>>
> >>> >> >>> >>> Hi all,
> >>> >> >>> >>>
> >>> >> >>> >>>
> >>> >> >>> >>> The security work has been committed. The settings on the
> >>> >> >>> >>> build
> >>> >> >>> >>> server
> >>> >> >>> >>> (256M of heap for tests) have brought out a memory leak. I
> run
> >>> >> >>> >>> with
> >>> >> >>> >>> 512m
> >>> >> >>> >>> locally (the default defined in the root pom) so I didn't
> see
> >>> >> >>> >>> this
> >>> >> >>> >>> before. I
> >>> >> >>> >>> spent a while looking for the leak tonight but haven't come
> up
> >>> >> >>> >>> with
> >>> >> >>> >>> anything
> >>> >> >>> >>> yet. I will have to pick this back up tomorrow, it will be
> my
> >>> >> >>> >>> top
> >>> >> >>> >>> priority.
> >>> >> >>> >>>
> >>> >> >>> >>> For now i have upped the test heap on the server to 512m as
> a
> >>> >> >>> >>> temporary
> >>> >> >>> >>> measure to try and get the build back. Hopefully that fixes
> >>> >> >>> >>> it.
> >>> >> >>> >>>
> >>> >> >>> >>> Again I will pick this back up first thing tomorrow. I
> >>> >> >>> >>> apologize
> >>> >> >>> >>> for
> >>> >> >>> >>> the inconvenience.
> >>> >> >>> >>>
> >>> >> >>> >>> -Justin
> >>> >> >>> >>>
> >>> >> >>> >>> --
> >>> >> >>> >>> Justin Deoliveira
> >>> >> >>> >>> OpenGeo - http://opengeo.org
> >>> >> >>> >>> Enterprise support for open source geospatial.
> >>> >> >>> >>>
> >>> >> >>> >>
> >>> >> >>> >>
> >>> >> >>> >>
> >>> >> >>> >> --
> >>> >> >>> >> Justin Deoliveira
> >>> >> >>> >> OpenGeo - http://opengeo.org
> >>> >> >>> >> Enterprise support for open source geospatial.
> >>> >> >>> >>
> >>> >> >>> >
> >>> >> >>> >
> >>> >> >>> >
> >>> >> >>> > --
> >>> >> >>> > Justin Deoliveira
> >>> >> >>> > OpenGeo - http://opengeo.org
> >>> >> >>> > Enterprise support for open source geospatial.
> >>> >> >>> >
> >>> >> >>> >
> >>> >> >>> >
> >>> >> >>> >
> >>> >> >>> >
> >>> >> >>> >
> ------------------------------------------------------------------------------
> >>> >> >>> > Better than sec? Nothing is better than sec when it comes to
> >>> >> >>> > monitoring Big Data applications. Try Boundary one-second
> >>> >> >>> > resolution app monitoring today. Free.
> >>> >> >>> > http://p.sf.net/sfu/Boundary-dev2dev
> >>> >> >>> > _______________________________________________
> >>> >> >>> > Geoserver-devel mailing list
> >>> >> >>> > [email protected]
> >>> >> >>> > https://lists.sourceforge.net/lists/listinfo/geoserver-devel
> >>> >> >>> >
> >>> >> >>>
> >>> >> >>>
> >>> >> >>>
> >>> >> >>> --
> >>> >> >>> Francesco Izzi
> >>> >> >>> CNR - IMAA
> >>> >> >>> geoSDI
> >>> >> >>> Direzione Tecnologie e Sviluppo
> >>> >> >>>
> >>> >> >>> C.da S. Loja
> >>> >> >>> 85050 Tito Scalo - POTENZA (PZ)
> >>> >> >>> Italia
> >>> >> >>>
> >>> >> >>> phone: +39 0971427305
> >>> >> >>> fax: +39 0971 427271
> >>> >> >>> mob: +39 3203126609
> >>> >> >>> mail: [email protected]
> >>> >> >>> skype: neofx8080
> >>> >> >>>
> >>> >> >>> web: http://www.geosdi.org
> >>> >> >>
> >>> >> >>
> >>> >> >>
> >>> >> >>
> >>> >> >> --
> >>> >> >> Justin Deoliveira
> >>> >> >> OpenGeo - http://opengeo.org
> >>> >> >> Enterprise support for open source geospatial.
> >>> >> >>
> >>> >> >
> >>> >> >
> >>> >> >
> >>> >> > --
> >>> >> > Francesco Izzi
> >>> >> > CNR - IMAA
> >>> >> > geoSDI
> >>> >> > Direzione Tecnologie e Sviluppo
> >>> >> >
> >>> >> > C.da S. Loja
> >>> >> > 85050 Tito Scalo - POTENZA (PZ)
> >>> >> > Italia
> >>> >> >
> >>> >> > phone: +39 0971427305
> >>> >> > fax: +39 0971 427271
> >>> >> > mob: +39 3203126609
> >>> >> > mail: [email protected]
> >>> >> > skype: neofx8080
> >>> >> >
> >>> >> > web: http://www.geosdi.org
> >>> >>
> >>> >>
> >>> >>
> >>> >> --
> >>> >> Francesco Izzi
> >>> >> CNR - IMAA
> >>> >> geoSDI
> >>> >> Direzione Tecnologie e Sviluppo
> >>> >>
> >>> >> C.da S. Loja
> >>> >> 85050 Tito Scalo - POTENZA (PZ)
> >>> >> Italia
> >>> >>
> >>> >> phone: +39 0971427305
> >>> >> fax: +39 0971 427271
> >>> >> mob: +39 3203126609
> >>> >> mail: [email protected]
> >>> >> skype: neofx8080
> >>> >>
> >>> >> web: http://www.geosdi.org
> >>> >
> >>> >
> >>> >
> >>> >
> >>> > --
> >>> > Justin Deoliveira
> >>> > OpenGeo - http://opengeo.org
> >>> > Enterprise support for open source geospatial.
> >>> >
> >>>
> >>>
> >>>
> >>> --
> >>> Francesco Izzi
> >>> CNR - IMAA
> >>> geoSDI
> >>> Direzione Tecnologie e Sviluppo
> >>>
> >>> C.da S. Loja
> >>> 85050 Tito Scalo - POTENZA (PZ)
> >>> Italia
> >>>
> >>> phone: +39 0971427305
> >>> fax: +39 0971 427271
> >>> mob: +39 3203126609
> >>> mail: [email protected]
> >>> skype: neofx8080
> >>>
> >>> web: http://www.geosdi.org
> >>>
> >>>
> >>>
> ------------------------------------------------------------------------------
> >>> Better than sec? Nothing is better than sec when it comes to
> >>> monitoring Big Data applications. Try Boundary one-second
> >>> resolution app monitoring today. Free.
> >>> http://p.sf.net/sfu/Boundary-dev2dev
> >>> _______________________________________________
> >>> Geoserver-devel mailing list
> >>> [email protected]
> >>> https://lists.sourceforge.net/lists/listinfo/geoserver-devel
> >>
> >>
> >
> >
> >
> > --
> > Justin Deoliveira
> > OpenGeo - http://opengeo.org
> > Enterprise support for open source geospatial.
> >
>
>
>
> --
> Francesco Izzi
> CNR - IMAA
> geoSDI
> Direzione Tecnologie e Sviluppo
>
> C.da S. Loja
> 85050 Tito Scalo - POTENZA (PZ)
> Italia
>
> phone: +39 0971427305
> fax: +39 0971 427271
> mob: +39 3203126609
> mail: [email protected]
> skype: neofx8080
>
> web: http://www.geosdi.org
>
------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev
_______________________________________________
Geoserver-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/geoserver-devel
