More on LDAP: I can now use AD to authenticate in the web portal (thank you Douglas!)
Two issues: 1. I did an import of users/phones from a production sytem, logged out of of superadmin, logged back in with superadmin and it failed (this time I had a UI). I reset the superadmin password and am back in. Does an import also change superadmin, I wouldn't think it would.... 2. Openfire... with LDAP I can't authenticate, as soon as I turn it off and restart instant messaging, it works. Kyle On Thu, Sep 16, 2010 at 2:22 AM, Mircea Carasel <[email protected]> wrote: > > > On Wed, Sep 15, 2010 at 5:41 PM, Douglas Hubler > <[email protected]<mailto:[email protected]>> wrote: > On Wed, Sep 15, 2010 at 8:59 AM, Michael Picher > <[email protected]<mailto:[email protected]>> wrote: >> Kyle, >> You could try re-setting superadmin... >> http://wiki.sipfoundry.org/display/sipXecs/Useful+sipXecs+Service+Commands >> Mike > > you can try, but the catch-22 is that with ldap turned, auth is not > from local db. > > Development time was spent ensure user with name "superadmin" could > always check local db and my fear is that something is messed up here. > Two of the sipXconfig authenticators used are DAOAuthenticator (authenticates > against DB) and LdapAuthenticator (authenticates against configured LDAP) > The security model used walks through all defined authenticators, in the > order they are defined, and tries to authenticate. > Ldap Authenticator comes first and when it cannot authenticate using LDAP it > tries to authenticate using DAOAuthenticator automatically. > The DaoAuthenticator verifies if the user that tries to authenticate is > superadmin or not. If this is superadmin it always tries to authenticate > superadmin against DB no matter what authentication scheme is selected (LDAP > only, LDAP and PIN, no LDAP) > > Here is the piece of code that ensures that superadmin is always verified > against DB: > if (settings.isLdapOnly() && ! StringUtils.equals(username, > AbstractUser.SUPERADMIN)) { > throw new AuthenticationServiceException( > "Only LDAP authentication is permitted"); > in here: > > http://github.com/dhubler/sipxecs/blob/master-4.2/sipXconfig/neoconf/src/org/sipfoundry/sipxconfig/security/DaoAuthenticationProvider.java > > This means that when you select only LDAP authenticator scheme the > DAOAuthenticator will fail for all users except the superadmin > > Mircea > > Assuming this is a test system you can either blow away (dropdb) and > then restore from a snapshot, that may be the only way out of this > system if there is indeed a bug. If you're really in a pinch, i could > probably drum up a SQL command to unconfigure ldap > > Outstanding questions > What exact build are you using? If you cannot get to ui, then you can run > rpm -qi sipxconfig | head -n 3 > and send that. > _______________________________________________ > sipx-users mailing list > [email protected]<mailto:[email protected]> > List Archive: http://list.sipfoundry.org/archive/sipx-users/ > > _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users/
