On Wed, Sep 15, 2010 at 5:41 PM, Douglas Hubler <[email protected]> wrote:
> On Wed, Sep 15, 2010 at 8:59 AM, Michael Picher <[email protected]> wrote: > > Kyle, > > You could try re-setting superadmin... > > > http://wiki.sipfoundry.org/display/sipXecs/Useful+sipXecs+Service+Commands > > Mike > > you can try, but the catch-22 is that with ldap turned, auth is not > from local db. > > Development time was spent ensure user with name "superadmin" could > always check local db and my fear is that something is messed up here. > Two of the sipXconfig authenticators used are DAOAuthenticator (authenticates against DB) and LdapAuthenticator (authenticates against configured LDAP) The security model used walks through all defined authenticators, in the order they are defined, and tries to authenticate. Ldap Authenticator comes first and when it cannot authenticate using LDAP it tries to authenticate using DAOAuthenticator automatically. The DaoAuthenticator verifies if the user that tries to authenticate is superadmin or not. If this is superadmin it always tries to authenticate superadmin against DB no matter what authentication scheme is selected (LDAP only, LDAP and PIN, no LDAP) Here is the piece of code that ensures that superadmin is always verified against DB: if (settings.isLdapOnly() && ! StringUtils.equals(username, AbstractUser.SUPERADMIN)) { throw new AuthenticationServiceException( "Only LDAP authentication is permitted"); in here: http://github.com/dhubler/sipxecs/blob/master-4.2/sipXconfig/neoconf/src/org/sipfoundry/sipxconfig/security/DaoAuthenticationProvider.java This means that when you select only LDAP authenticator scheme the DAOAuthenticator will fail for all users except the superadmin Mircea > > Assuming this is a test system you can either blow away (dropdb) and > then restore from a snapshot, that may be the only way out of this > system if there is indeed a bug. If you're really in a pinch, i could > probably drum up a SQL command to unconfigure ldap > > Outstanding questions > What exact build are you using? If you cannot get to ui, then you can run > rpm -qi sipxconfig | head -n 3 > and send that. > _______________________________________________ > sipx-users mailing list > [email protected] > List Archive: http://list.sipfoundry.org/archive/sipx-users/ >
_______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users/
