LDAP problem during upgrade 5.02 to 6.0.2 of Jazz RTC
Jean-Yves Buzenet (16●1●2)
| asked Jul 26 '16, 6:07 a.m.
retagged Aug 05 '16, 5:09 p.m. by Ken Tessier (841●1●7)
Hello
I followed these URLs :
Thanks a lot
|
4 answers
Hello,
Same problem here,
Ldap connection migration from tomcat to liberty doesn't seem to work.
|
Hello,
I have had the same problem during my upgrade from 5.0.2. to 6.0.2. Please note that I use OpenLDAP to save user credentials. I have changed the authentication method on this file : cat /opt/RTC_V6.0.2/server/liberty/servers/clm/server.xml ......... < ! --include location="conf/basicUserRegistry.xml"/--> <include location="conf/ldapUserRegistry.xml"/> ......... Then I have add the LDAP configuration on this file
cat /opt/RTC_V6.0.2/server/liberty/servers/clm/conf/ldapUserRegistry.xml
<?xml version="1.0" encoding="UTF-8"?><server>
<featureManager>
<feature>ldapRegistry-3.0</feature>
</featureManager>
<ldapRegistry baseDN="dc=compagny,dc=com"
bindDN="uid=root,cn=admins,dc=compagny,dc=com"
bindPassword="clearPassword"
host="myLdap"
id="myLdap:389"
ignoreCase="true"
ldapType="Custom"
port="389"
realm="myLdap:389"
recursiveSearch="true"
sslEnabled="false">
<customFilters
groupFilter="(&(cn=%v)(|(objectclass=groupOfNames)(objectclass=posixGroup)))"
groupIdMap="*:cn"
groupMemberIdMap="*:memberUid"
userFilter="(&(uid=%v)(objectclass=posixAccount))"
userIdMap="*:uid">
</customFilters>
</ldapRegistry>
</server>
After this modification, the upgrade has finished. But, now login on the application is impossible ... User is correctly mapped with the LDAP but groups mapping should be impossible. I have this message : Permission Denied Your account does not have the group memberships required to access the requested resource. I think I have found my problem. On tomcat, on the version 5.0.2., I have this configuration :
cat /opt/RTC_V5.0.2/server/tomcat/conf/server.xml
<Realm
className="org.apache.catalina.realm.JNDIRealm"
connectionName="uid=root,cn=admins,dc=compagny,dc=com"
connectionPassword="clearPassword"
connectionURL="ldap://myLdap:389"
debug="99"
roleBase="ou=JazzGroups,ou=groups,dc=compagny,dc=com"
roleName="cn"
roleSearch="(memberUid={1})"
roleSubtree="true"
userBase="ou=people,dc=compagny,dc=com"
userSearch="(uid={0})"
userSubtree="true"/>
I see that user definition is correctly reported from tomcat configuration to the liberty configuration. But, group definition (For example attribute roleBase) is missing on the liberty configuration and I don't find on google the mapping attribute to RoleBase from tomcat to liberty ... Thanks for your help Mathieu |
Hi
I have not tried OpenLdap but we have documented the config with ApacheDS, not sure if the setting are same.
Since it is the only that groups that seems to be affected , you could try using the ObjectClass from that of ApacheDS configuration and see if that works:
In addition to this, if the groups are not the default name "JazzAdmins" etc, then you would have to change then in application.xml , same location as ldapUserRegistry.xml
Regards
Shubjit
Comments Hello,
It picks it from the baseDN. You could map Group DN directly for specific Groups in application.xml
Example, in application.xml for jts.war you can enter the Group name or directly a user:
group name="uid=JazzAdmins, dc=Groups, ou=example.com"
user name= "uid=clmadmin,dc=Users,ou=example.com"
However when running the setup for JTS, there you still have the entries for Base Group CN and Base User DN. I have tried your solution but it doesn't work ...
cat /opt/RTC_V6.0.2/server/liberty/servers/clm/conf/application.xml
<application id="jts" location="${server.config.dir}/apps/jts.war" name="jts" type="war">
<application-bnd>
<security-role name="JazzAdmins">
<group name="cn=JazzAdmins,ou=JazzGroups,ou=groups,dc=company,dc=com"/>
</security-role>
<security-role name="JazzProjectAdmins">
<group name="cn=JazzProjectAdmins,ou=JazzGroups,ou=groups,dc=company,dc=com"/>
</security-role>
<security-role name="JazzUsers">
<group name="cn=JazzUsers,ou=JazzGroups,ou=groups,dc=company,dc=com"/>
</security-role>
<security-role name="JazzGuests">
<group name="cn=JazzGuests,ou=JazzGroups,ou=groups,dc=company,dc=com"/>
</security-role>
</application-bnd>
</application>
I have the same error message. I have also tried to use on the same file the attribute "access-id" on group tag but it fails ... Have you got another idea ? Thanks for your help. Regards Mathieu Can you share you ldapUserRegistry.xml as well? Is your baseDN set to dc=company,dc=com? My ldapUserRegistry.xml file is on my first post.
I was looking for updated one.
I have tried with your ObjectClass and I have restarted the liberty server.
showing 5 of 7
show 2 more comments
|
I used this in the ldapserverregistry.xml in liberty/conf...
working one
<ldapRegistry id="ldap" realm="myladap:3268"
host="server.company1.com" port="3268" ignoreCase="true"
baseDN="dc=company1,dc=com"
bindDN="cn=user1,cn=users,DC=company1,DC=com"
bindPassword="password"
ldapType="Microsoft Active Directory">
<activedFilters
userFilter="(&(sAMAccountName=%v)(objectcategory=user))"
groupFilter="(&(cn=%v)(objectcategory=group))"
userIdMap="user:sAMAccountName"
groupIdMap="*:cn"
groupMemberIdMap="memberOf:member">
</activedFilters>
</ldapRegistry>
I then removed in liberty/..apps/web.../jts.war and ccm.war directories
and recreated them and unzipped the jts.war.zip....etc into the recreated folder
then restarted the RTC server and all worked fine.
|
Your answer
Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.