LDAPS bind error on JTS running RTC
I have a problem with RTC v4.0.0.1 running the JTS with LDAPS.
I have installed the Certs in the Trusted cacerts files using keyman.
I ran through the setup process specifically step 6, and when pressing Test Connection the connection to LDAPS indicates that the connection worked. I also get the message to copy all the xml files.
Once I copy the files and restart the server, I then try to log in which fails.
The log files in tomcat7-stderr reports that the ldap connection requires a bind to complete the connection.
So why does the setup step work, connect the server, but when the server is started the connection fails?
I have installed the Certs in the Trusted cacerts files using keyman.
I ran through the setup process specifically step 6, and when pressing Test Connection the connection to LDAPS indicates that the connection worked. I also get the message to copy all the xml files.
Once I copy the files and restart the server, I then try to log in which fails.
The log files in tomcat7-stderr reports that the ldap connection requires a bind to complete the connection.
So why does the setup step work, connect the server, but when the server is started the connection fails?
One answer
It looks like JNDIRealm might be in there someplace because the error does reference dc=<xxx>,dc=US, dc=<yyy>, dc=com which suggests tomcat knows something about your LDAP server.
If I take out the following values from that element I can reproduce your error.
connectionName="CN=user,CN=Users,DC=domain,DC=ibm,DC=com"
connectionPassword="password"
If I completely remove the element I don't get any error but I can't log in.
And if I use the wrong password I get an error trying to start tomcat.
Here's what mine looks like formatted to be easier to read as it was on one line in the file.
The bold text is the stuff I removed to reproduce your error.
<Realm className="org.apache.catalina.realm.JNDIRealm"
connectionName="CN=user,CN=Users,DC=domain,DC=ibm,DC=com"
connectionPassword="password"
connectionURL="ldap://server:3268"
debug="99" referrals="follow"
roleBase="CN=Users,DC=domain,DC=ibm,DC=com"
roleName="cn" roleSearch="(member={0})"
roleSubtree="true"
userBase="CN=Users,DC=domain,DC=ibm,DC=com"
userSearch="(sAMAccountName={0})"
userSubtree="true"/>
If I take out the following values from that element I can reproduce your error.
connectionName="CN=user,CN=Users,DC=domain,DC=ibm,DC=com"
connectionPassword="password"
If I completely remove the element I don't get any error but I can't log in.
And if I use the wrong password I get an error trying to start tomcat.
Here's what mine looks like formatted to be easier to read as it was on one line in the file.
The bold text is the stuff I removed to reproduce your error.
<Realm className="org.apache.catalina.realm.JNDIRealm"
connectionName="CN=user,CN=Users,DC=domain,DC=ibm,DC=com"
connectionPassword="password"
connectionURL="ldap://server:3268"
debug="99" referrals="follow"
roleBase="CN=Users,DC=domain,DC=ibm,DC=com"
roleName="cn" roleSearch="(member={0})"
roleSubtree="true"
userBase="CN=Users,DC=domain,DC=ibm,DC=com"
userSearch="(sAMAccountName={0})"
userSubtree="true"/>
Comments
Karl Weinert
JAZZ DEVELOPER Dec 20 '12, 11:56 a.m.Mark Blaschke
Dec 20 '12, 12:27 p.m.Karl Weinert
JAZZ DEVELOPER Dec 20 '12, 12:28 p.m.