LDAP, Build Account gets (Invalid user ID or password)

Boris Kivshar (86●8●6) | asked Aug 09 '11, 11:09 p.m.

Hi Guys,
I needs some assistance with troubleshooting my JAZZ setup, running all version 3.0.1. (JTS/CCM/RM/QM)

Initial Question:
How do I enable LDAP logging, so that when I log in via the WebUI it tell me success or failure, and possibly why. And in which of the dozens of log files would this be in?

Problem Statement:
All general LDAP logins are fine, and are already configured with the 5x AD groups. I had our helpdesk create a build account with some limitations such as specific machine loggon and no internet etc.. Upon loggin into via the WebUI I get "Invalid user ID or password"

Some facts:
- BuildAcc is within the AD with the JAZZ Users group.
- BuildAcc can login to all the JAZZ servers via RDP
- I can see in the logs that the BuildAcc gets synced nightly
- BuildAcc is visible from within JTS and has been imported and assigned licences within JTS User Administration
- BuildAcc seems to have all appropriate details filled in within the AD object (email, name etc)

My problem is very very similar to Alan's unresolved question here:
https://jazz.net/forums/viewtopic.php?t=10810

Any help in troubleshooting this issue will help me greatly!
Thanks
Boris

5 answers

Most liked answers ↑|Newest answers|Oldest answers

permanent link

Ralph Schoon (63.6k●3●36●46) | answered Aug 10 '11, 3:25 a.m.
FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER

Hi Guys,
I needs some assistance with troubleshooting my JAZZ setup, running all version 3.0.1. (JTS/CCM/RM/QM)

Initial Question:
How do I enable LDAP logging, so that when I log in via the WebUI it tell me success or failure, and possibly why. And in which of the dozens of log files would this be in?

Problem Statement:
All general LDAP logins are fine, and are already configured with the 5x AD groups. I had our helpdesk create a build account with some limitations such as specific machine loggon and no internet etc.. Upon loggin into via the WebUI I get "Invalid user ID or password"

Some facts:
- BuildAcc is within the AD with the JAZZ Users group.
- BuildAcc can login to all the JAZZ servers via RDP
- I can see in the logs that the BuildAcc gets synced nightly
- BuildAcc is visible from within JTS and has been imported and assigned licences within JTS User Administration
- BuildAcc seems to have all appropriate details filled in within the AD object (email, name etc)

My problem is very very similar to Alan's unresolved question here:
https://jazz.net/forums/viewtopic.php?t=10810

Any help in troubleshooting this issue will help me greatly!
Thanks
Boris

Hi Boris, there are options for logging LDAP related issues in the log4j.properties file of each application. You can try to enable those in the conf/<application> folder of the application you are interested. That would be CCM or JAZZ if you migrated from 2.x. The logging goes into a <application>.log on that server. in WAS it is going into the profiles folder in tomcat it is located in server/tomcat/logs.

More options to track this down could be provided by suppot if you open a PMR or you could try to open a work item where the right people could look into it (please subscribe Alan from the other post if you create one).

permanent link

Boris Kivshar (86●8●6) | answered Aug 10 '11, 9:13 p.m.

Thanks for the reply.

I enabled the LDAP Debugging within the log4j.propoerties file:

log4j.logger.com.ibm.team.repository.service.jts.internal.userregistry.ldap.LDAPUserRegistry=DEBUG

In both the CCM & JTS applications:

C&#58;\IBM\JazzTeamServer_3.0.1\server\conf\jts\log4j.properties

C&#58;\IBM\JazzTeamServer_3.0.1\server\conf\ccm\log4j.properties

After clearing all logs, and restarting, this is what i get:
- When I log in as myself no log entries appear
- When I attempt to log in as myself with an incorrect password I get "Invalid user ID or password.", and no log entries.
- When I attempt to log in with the Build account I get "Invalid user ID or password.", and no log entries.

The logs that I am refering to are:

C&#58;\IBM\JazzTeamServer_3.0.1\server\logs\ccm.log

C&#58;\IBM\JazzTeamServer_3.0.1\server\logs\jts.log

The only ldap error I get that I cannot work out what it is below. However there are no indication that user authentication is not working anywhere else, and all other users are fine.

This is from

C&#58;\IBM\JazzTeamServer_3.0.1\server\tomcat\logs\catalina.2011-08-11.log

11/08/2011 10&#58;54&#58;26 org.apache.catalina.realm.JNDIRealm authenticate

WARNING&#58; Exception performing authentication

javax.naming.CommunicationException&#58; connection closed &#91;Root exception is java.io.IOException&#58; connection closed&#93;; remaining name 'DC=&#123;name4&#125;,DC=&#123;name3&#125;,DC=&#123;name2&#125;,DC=&#123;name1&#125;'

	at com.sun.jndi.ldap.LdapCtx.doSearch&#40;LdapCtx.java&#58;2002&#41;

	at com.sun.jndi.ldap.LdapCtx.searchAux&#40;LdapCtx.java&#58;1847&#41;

	at com.sun.jndi.ldap.LdapCtx.c_search&#40;LdapCtx.java&#58;1772&#41;

	at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search&#40;ComponentDirContext.java&#58;383&#41;

	at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search&#40;PartialCompositeDirContext.java&#58;353&#41;

	at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search&#40;PartialCompositeDirContext.java&#58;336&#41;

	at javax.naming.directory.InitialDirContext.search&#40;InitialDirContext.java&#58;259&#41;

	at org.apache.catalina.realm.JNDIRealm.getUserBySearch&#40;JNDIRealm.java&#58;1069&#41;

	at org.apache.catalina.realm.JNDIRealm.getUser&#40;JNDIRealm.java&#58;977&#41;

	at org.apache.catalina.realm.JNDIRealm.authenticate&#40;JNDIRealm.java&#58;926&#41;

	at org.apache.catalina.realm.JNDIRealm.authenticate&#40;JNDIRealm.java&#58;812&#41;

	at org.apache.catalina.authenticator.FormAuthenticator.authenticate&#40;FormAuthenticator.java&#58;259&#41;

	at org.apache.catalina.authenticator.AuthenticatorBase.invoke&#40;AuthenticatorBase.java&#58;454&#41;

	at org.apache.catalina.core.StandardHostValve.invoke&#40;StandardHostValve.java&#58;127&#41;

	at org.apache.catalina.valves.ErrorReportValve.invoke&#40;ErrorReportValve.java&#58;117&#41;

	at org.apache.catalina.authenticator.SingleSignOn.invoke&#40;SingleSignOn.java&#58;420&#41;

	at org.apache.catalina.core.StandardEngineValve.invoke&#40;StandardEngineValve.java&#58;108&#41;

	at org.apache.catalina.connector.CoyoteAdapter.service&#40;CoyoteAdapter.java&#58;174&#41;

	at org.apache.coyote.http11.Http11Processor.process&#40;Http11Processor.java&#58;879&#41;

	at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection&#40;Http11BaseProtocol.java&#58;665&#41;

	at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket&#40;PoolTcpEndpoint.java&#58;528&#41;

	at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt&#40;LeaderFollowerWorkerThread.java&#58;81&#41;

	at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run&#40;ThreadPool.java&#58;689&#41;

	at java.lang.Thread.run&#40;Thread.java&#58;811&#41;

Caused by&#58; java.io.IOException&#58; connection closed

	at com.sun.jndi.ldap.LdapClient.ensureOpen&#40;LdapClient.java&#58;1590&#41;

	at com.sun.jndi.ldap.LdapClient.search&#40;LdapClient.java&#58;536&#41;

	at com.sun.jndi.ldap.LdapCtx.doSearch&#40;LdapCtx.java&#58;1985&#41;

	... 23 more

I also found an old article: https://jazz.net/library/article/479/
I realized that the JAZZ Validation tool mentioned in it is for for V2. I did try it but it did not work. Is there an updated version for V3, i could not find anything?

So, is there a way to enable even deeper ldap logging where it can output results on everything?

Alternatively, how do I create a PMR? I can create a WI, which ever is best...

permanent link

Ralph Schoon (63.6k●3●36●46) | answered Aug 11 '11, 5:42 a.m.
FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER

Hi,

I am not sure, I am missing information about your environment. Since you mention RDP and the build user as you say can log in using RDP (Also over the web?) could this be an issue on the server?

The error message on the other hand seems to indicate that the user ID or password are not matching. Could it be an issue on the host or maybe based on case sensitivity?

You can create a work item any time. For a PMR you need to have support . You can create a PMR here http://www-947.ibm.com/support/entry/portal/Open_service_request/Software/Rational/Rational_brand_support_%28general%29

permanent link

Boris Kivshar (86●8●6) | answered Aug 23 '11, 2:04 a.m.

I have found the problem in my configuration. Just though I would share it for anyone else that might be experiencing the same thing.

Essentially the base LDAP logging withing RTC/CCM did not really help. So I had my helpdesk AD guys investigage the logs on the regional controller and found the following error:

Logon Failure:
Reason: User not allowed to logon at this computer
User Name: <BuildAccount>
Domain: <Domain>
Logon Type: 3
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: <DC>
Caller User Name: <DC>$
Caller Domain: <Domain>
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 440
Transited Services: -
Source Network Address: <IP>
Source Port: 62195

Please note. As originally stated the helpdesk created a limited network account, the actual build account did not have appropriate permissions to login/authenticate into the domain controller.

After this was fixed my build accoutn was able to login perfectly.

0	permanent link Ralph Schoon (63.6k●3●36●46) \| answered Aug 23 '11, 3:08 a.m. FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER Thanks for sharing Boris!

Your answer

Register or log in to post your answer.

Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.

It's all about the answers!

Related questions

LDAP, Build Account gets (Invalid user ID or password)

5 answers

Your answer