LDAP users won't authenticate

Camunda 7 Topics Discussion & Questions
,
1

I’m working on using the LdapIdentityProviderPlugin. It seems to work most of the way.
Here is my bpm-platform.xml
<plugin>

&lt;class&gt;org.camunda.bpm.identity.impl.ldap.plugin.LdapIdentityProviderPlugin&lt;/class&gt;

&lt;properties&gt;

&lt;property name="serverUrl"&gt;ldap://host.docker.internal:10389/&lt;/property&gt;

&lt;property name="acceptUntrustedCertificates"&gt;true&lt;/property&gt;

&lt;property name="managerDn"&gt;uid=jtsTestAdminUser,ou=People,dc=example,dc=com&lt;/property&gt;

&lt;property name="managerPassword"&gt;password1&lt;/property&gt;

&lt;property name="baseDn"&gt;dc=example,dc=com&lt;/property&gt;

&lt;property name="userSearchBase"&gt;ou=People&lt;/property&gt;

&lt;property name="userSearchFilter"&gt;(objectclass=person)&lt;/property&gt;

&lt;property name="userIdAttribute"&gt;uid&lt;/property&gt;

&lt;property name="userFirstnameAttribute"&gt;cn&lt;/property&gt;

&lt;property name="userLastnameAttribute"&gt;sn&lt;/property&gt;

&lt;property name="userEmailAttribute"&gt;mail&lt;/property&gt;

&lt;property name="userPasswordAttribute"&gt;userPassword&lt;/property&gt;

&lt;property name="groupSearchBase"&gt;ou=Roles,ou=RBAC&lt;/property&gt;

&lt;property name="groupSearchFilter"&gt;(objectclass=organizationalRole)&lt;/property&gt;

&lt;property name="groupIdAttribute"&gt;cn&lt;/property&gt;

&lt;property name="groupTypeAttribute"&gt;cn&lt;/property&gt;

&lt;property name="groupNameAttribute"&gt;cn&lt;/property&gt;

&lt;property name="groupMemberAttribute"&gt;roleOccupant&lt;/property&gt;

&lt;property name="sortControlSupported"&gt;false&lt;/property&gt;

&lt;/properties&gt;

&lt;/plugin&gt;

&lt;!-- LDAP CONFIGURATION --&gt;

&lt;!-- The following plugin allows you to grant administrator authorizations to an existing LDAP user --&gt;

&lt;plugin&gt;

&lt;class&gt;org.camunda.bpm.engine.impl.plugin.AdministratorAuthorizationPlugin&lt;/class&gt;

&lt;properties&gt;

&lt;property name="administratorUserName"&gt;jtsTestAdminUser&lt;/property&gt;

&lt;property name="administratorGroupName"&gt;oamROLE1&lt;/property&gt;

&lt;/properties&gt;

&lt;/plugin&gt;

I’m able to log in as jtsTestAdminUser

and you can see my users:
ldap-int-1

that are in my ldap

and you can see the groups.
ldap-int-2

and you can see users in the groups.

ldap-int-3

and the authorization to the group (plus I added a specific user)

ldap-int-4

However, when I try to log in with jtsUser1/password (I set it write in my LDAP browser) login fails:

ldap-int-5

ldap-int-6

Please let me know how I could trouble shoot this, or how to fix. thank you!

2

Hi @Brent_Fisher,

If your version is 7.9 - please try lowercase user name

BR,
Ilya

3

OK, I’ll try.

ldap-int-7
ldap-int-71044×600 13.4 KB

still seems the same. I’m on 7.10, BTW. Please let me know if there is some other info I might provide. Sorry about the formatting. Not sure why it does that.

4

ldap-int-8
ldap-int-8872×296 15.4 KB

5

Not sure if it helps - extracts from my config:

      <property name="baseDn">dc=pxed,dc=my_company,dc=com</property>
      <property name="userSearchBase"></property>
      <property name="userIdAttribute">cn</property>
6

Thank you, I think I can find the users, but somehow it isn’t able to validate the passwords. You can see my screenshots above pull in all of the users.

7

Hi @Brent_Fisher,

The user doesn’t have access rights to the tasklist application.
You can grant permissions from the admin app.

Log in to admin app using admin user “jtsTestAdminUser” to grant permissions to other users.

https://docs.camunda.org/manual/latest/webapps/admin/authorization-management/

1 Like
8

Hi @hassang, I think that’s what I did.

But, interestingly enough, I use my AD studio to try to bind to the user and received this error.
ldap-int-9

I search google and found an SO article:

which recommends I need to manually unlock the account by fetching the accounts operational values and deleting ‘pwdAccountLockedTime’

So, I logged into Active Directory and deleted the value, and then I was able to bind!
ldap-int-10

And I was able to log in!

3 Likes