Hallo,
ich teste gerade die letzte Version 0.9.9-5 und komme bei der Verwendung des LDAP Moduls nicht weiter. Es handelt sich um eine frische Installation, von daher also keine Altlasten.
Ich verwende als LDAP Backend ein Active-Directory auf Basis Windows 2003 R2. Das Problem stellt sich nun wie folgt dar:
1. Konfiguration ist genau nach der Dokumentation im WIKI erstellt. Der Test ist auch erfolgreich.
2011-05-31 16:47:13 ldap: Testing connection to muc-dc001.siepha.net:389 (CN=svc-idoit,OU=ServiceAccounts,DC=siepha,DC=net)
2011-05-31 16:47:13 ldap: Connected to muc-dc001.siepha.net
2011-05-31 16:47:13 ldap: Connection successfull.
2011-05-31 16:47:13 ldap: Found 45 object(s) in OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net.
2011-05-31 16:58:30 ldap: LDAP Module launched for mandator: idoit_data_siepha
2011-05-31 16:58:30 ldap: Found 1 configured LDAP Servers.
2011-05-31 16:58:30 ldap: 1: muc-dc001.siepha.net (OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net)
2. Die LDAP-Attribute-Mappings für das ADS-Objekt sind ebenfalls genau nach Doku angepasst. Das Gruppen-LDAP-Mapping ist ebenfalls konfiguriert.
3. Erstmalige Anmeldung mit einem ADS-User scheint zu funktionieren. Es erscheint nach der erfolgreichen Anmeldung die Auswahl des Mandanten. Danach erscheint allerdings eine Fehlermeldung: "Invalid credentials". Die Log-Meldungen zeigen folgendes:
2011-05-31 17:01:53 ldap: –--------------------------------------------------------------------------------------------
2011-05-31 17:01:53 ldap: Creating new ldap-library connection to: muc-dc001.siepha.net:389, user: CN=svc-idoit,OU=ServiceAccounts,DC=siepha,DC=net
2011-05-31 17:01:53 ldap: Connected to muc-dc001.siepha.net
2011-05-31 17:01:53 ldap: Searching for username: mantlikm
2011-05-31 17:01:53 ldap: Getting user(s) using filter: (&(objectClass=user)(sAMAccountName=mantlikm)) in search-path: OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net
2011-05-31 17:01:53 ldap: Found DN: CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net. Trying to login with it.
2011-05-31 17:01:53 ldap: Auth successfull (CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net).
2011-05-31 17:01:53 ldap: User account created. User-ID: 7
2011-05-31 17:01:53 ldap: Getting groups of CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net (Servertype: )
2011-05-31 17:01:53 ldap: Found CN=G-Nagios_Users,OU=Groups,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 17:01:53 ldap: -- Group pendant for "G-Nagios_Users" not found. Edit LDAP-Mapping in group settings if you want to use this as a right group.
2011-05-31 17:01:53 ldap: Found CN=G-VPN-Users,OU=Groups,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 17:01:53 ldap: -- Group pendant for "G-VPN-Users" not found. Edit LDAP-Mapping in group settings if you want to use this as a right group.
2011-05-31 17:01:53 ldap: Found CN=G-CMDB_Users,OU=Groups,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 17:01:53 ldap: ** i-doit group pendant for "G-CMDB_Users" found: Author
2011-05-31 17:01:53 ldap: Found CN=G-HOE-WLAN-Users,OU=WLAN,OU=Groups,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 17:01:53 ldap: -- Group pendant for "G-HOE-WLAN-Users" not found. Edit LDAP-Mapping in group settings if you want to use this as a right group.
2011-05-31 17:01:53 ldap: Found CN=G-MUC-WLAN-Users,OU=WLAN,OU=Groups,OU=Munich,OU=Sites,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 17:01:53 ldap: -- Group pendant for "G-MUC-WLAN-Users" not found. Edit LDAP-Mapping in group settings if you want to use this as a right group.
2011-05-31 17:01:53 ldap: Found CN=G-OTRS_Agents,OU=Groups,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 17:01:53 ldap: -- Group pendant for "G-OTRS_Agents" not found. Edit LDAP-Mapping in group settings if you want to use this as a right group.
2011-05-31 17:01:53 ldap: Syncing groups..
2011-05-31 17:01:53 ldap: Attached user(7) to group: Author
2011-05-31 17:02:58 ldap: LDAP Module launched for mandator: idoit_data_siepha
2011-05-31 17:02:58 ldap: Found 1 configured LDAP Servers.
2011-05-31 17:02:58 ldap: 1: muc-dc001.siepha.net (OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net)
2011-05-31 17:02:58 ldap: ----------------------------------------------------------------------------------------------
2011-05-31 17:02:58 ldap: Creating new ldap-library connection to: muc-dc001.siepha.net:389, user: CN=svc-idoit,OU=ServiceAccounts,DC=siepha,DC=net
2011-05-31 17:02:58 ldap: Connected to muc-dc001.siepha.net
2011-05-31 17:02:58 ldap: Trying to auth with DN: CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net
2011-05-31 17:02:58 ldap: CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net / mantlikm auth failed. LDAP-Result: Invalid credentials
2011-05-31 17:02:58 ldap: ----------------------------------------------------------------------------------------------
Man sieht, dass der LDAP-User gefunden wird, dass der User in Idoit angelegt wird und der Gruppe Author zugeordnet wird. Das Passwort ist definitiv richtig. Ich habe den Prozess mehrfach durchgespielt. Auch mit anderen Usern, daran kann es nicht liegen. Das Kuriose ist aber jetzt, dass alle weiteren Login's mit diesem User laut Debug Log im ersten Schritt nicht erfolgreich sind und abschließend als "Auth successfull" gemeldet werden, man aber immer wieder die Fehlermeldung "Invalid credentials or password" bekommt.
2011-05-31 17:44:51 ldap: LDAP Module launched for mandator: idoit_data_siepha
2011-05-31 17:44:51 ldap: Found 1 configured LDAP Servers.
2011-05-31 17:44:51 ldap: 1: muc-dc001.siepha.net (OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net)
2011-05-31 17:44:51 ldap: –--------------------------------------------------------------------------------------------
2011-05-31 17:44:51 ldap: Creating new ldap-library connection to: muc-dc001.siepha.net:389, user: CN=svc-idoit,OU=ServiceAccounts,DC=siepha,DC=net
2011-05-31 17:44:51 ldap: Connected to muc-dc001.siepha.net
2011-05-31 17:44:51 ldap: Trying to auth with DN: CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net
2011-05-31 17:44:51 ldap: CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net / mantlikm auth failed. LDAP-Result: Invalid credentials
2011-05-31 17:44:51 ldap: ----------------------------------------------------------------------------------------------
2011-05-31 17:44:51 ldap: LDAP Module launched for mandator: idoit_data_siepha
2011-05-31 17:44:51 ldap: Found 1 configured LDAP Servers.
2011-05-31 17:44:51 ldap: 1: muc-dc001.siepha.net (OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net)
2011-05-31 17:44:51 ldap: ----------------------------------------------------------------------------------------------
2011-05-31 17:44:51 ldap: Creating new ldap-library connection to: muc-dc001.siepha.net:389, user: CN=svc-idoit,OU=ServiceAccounts,DC=siepha,DC=net
2011-05-31 17:44:51 ldap: Connected to muc-dc001.siepha.net
2011-05-31 17:44:51 ldap: Searching for username: mantlikm
2011-05-31 17:44:51 ldap: Getting user(s) using filter: (&(objectClass=user)(sAMAccountName=mantlikm)) in search-path: OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net
2011-05-31 17:44:51 ldap: Found DN: CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net. Trying to login with it.
2011-05-31 17:44:51 ldap: Auth successfull (CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net).
Mit falschem Passwort sieht es wie folgt aus, daran kann es also nicht liegen:
2011-05-31 18:31:29 ldap: LDAP Module launched for mandator: idoit_data_siepha
2011-05-31 18:31:29 ldap: Found 1 configured LDAP Servers.
2011-05-31 18:31:29 ldap: 1: muc-dc001.siepha.net (OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net)
2011-05-31 18:31:29 ldap: –--------------------------------------------------------------------------------------------
2011-05-31 18:31:29 ldap: Creating new ldap-library connection to: muc-dc001.siepha.net:389, user: CN=svc-idoit,OU=ServiceAccounts,DC=siepha,DC=net
2011-05-31 18:31:29 ldap: Connected to muc-dc001.siepha.net
2011-05-31 18:31:29 ldap: Searching for username: mantlikm
2011-05-31 18:31:29 ldap: Getting user(s) using filter: (&(objectClass=user)(sAMAccountName=mantlikm)) in search-path: OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net
2011-05-31 18:31:29 ldap: Found DN: CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net. Trying to login with it.
2011-05-31 18:31:29 ldap: ** Auth failed. LDAP-Result: Invalid credentials
2011-05-31 18:31:29 ldap: ----------------------------------------------------------------------------------------------
2011-05-31 18:31:29 ldap: *** LDAP Auth failed. (false)
Nachdem ich den User in Idoit gelöscht habe und den Anmeldeversuch gestartet hatte, sagt das Log-File:
2011-05-31 18:32:45 ldap: LDAP Module launched for mandator: idoit_data_siepha
2011-05-31 18:32:45 ldap: Found 1 configured LDAP Servers.
2011-05-31 18:32:45 ldap: 1: muc-dc001.siepha.net (OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net)
2011-05-31 18:32:45 ldap: –--------------------------------------------------------------------------------------------
2011-05-31 18:32:45 ldap: Creating new ldap-library connection to: muc-dc001.siepha.net:389, user: CN=svc-idoit,OU=ServiceAccounts,DC=siepha,DC=net
2011-05-31 18:32:45 ldap: Connected to muc-dc001.siepha.net
2011-05-31 18:32:45 ldap: Searching for username: mantlikm
2011-05-31 18:32:45 ldap: Getting user(s) using filter: (&(objectClass=user)(sAMAccountName=mantlikm)) in search-path: OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net
2011-05-31 18:32:45 ldap: Found DN: CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net. Trying to login with it.
2011-05-31 18:32:45 ldap: Auth successfull (CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net).
2011-05-31 18:32:45 ldap: User account created. User-ID: 53
2011-05-31 18:32:45 ldap: Getting groups of CN=Mantlik, Markus,OU=Users,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net (Servertype: )
2011-05-31 18:32:45 ldap: Found CN=G-Nagios_Users,OU=Groups,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 18:32:45 ldap: -- Group pendant for "G-Nagios_Users" not found. Edit LDAP-Mapping in group settings if you want to use this as a right group.
2011-05-31 18:32:45 ldap: Found CN=G-VPN-Users,OU=Groups,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 18:32:45 ldap: -- Group pendant for "G-VPN-Users" not found. Edit LDAP-Mapping in group settings if you want to use this as a right group.
2011-05-31 18:32:45 ldap: Found CN=G-CMDB_Users,OU=Groups,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 18:32:45 ldap: ** i-doit group pendant for "G-CMDB_Users" found: Author
2011-05-31 18:32:45 ldap: Found CN=G-HOE-WLAN-Users,OU=WLAN,OU=Groups,OU=Hoechstaedt,OU=Sites,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 18:32:45 ldap: -- Group pendant for "G-HOE-WLAN-Users" not found. Edit LDAP-Mapping in group settings if you want to use this as a right group.
2011-05-31 18:32:45 ldap: Found CN=G-MUC-WLAN-Users,OU=WLAN,OU=Groups,OU=Munich,OU=Sites,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 18:32:45 ldap: -- Group pendant for "G-MUC-WLAN-Users" not found. Edit LDAP-Mapping in group settings if you want to use this as a right group.
2011-05-31 18:32:45 ldap: Found CN=G-OTRS_Agents,OU=Groups,DC=siepha,DC=net (Filter: (objectclass=)): 1
2011-05-31 18:32:45 ldap: -- Group pendant for "G-OTRS_Agents" not found. Edit LDAP-Mapping in group settings if you want to use this as a right group.
2011-05-31 18:32:45 ldap: Syncing groups..
2011-05-31 18:32:45 ldap: isys_exception_database : Query error: 'INSERT INTO isys_person_2_group SET isys_person_2_group__isys_obj__id__person = '53', isys_person_2_group__isys_obj__id__group = '12';':
Cannot add or update a child row: a foreign key constraint fails (idoit_data_siepha/isys_person_2_group
, CONSTRAINT isys_person_2_group_ibfk_1
FOREIGN KEY (isys_person_2_group__isys_obj__id__person
) REFERENCES isys_obj
(isys_obj__id
) ON DELETE CASC)
Ich komme hier nicht mehr weiter, hat sonst jemand ähnliche Probleme bzw. Hinweise? Eventuell handelt es sich hier auch um einen Bug?
Danke und viele Grüße
Markus