Repository: hygieia/hygieia

Issue #2839: API not able to login using LDAP authentication
Created: 2019-04-19T05:26:27Z
Hello, I am trying to use the next configuration for api.properties

dbname=dashboarddb
dbusername=dashboarduser
dbpassword=dbpassword
dbhost=127.0.0.1
dbport=27017
dbreplicaset=false
dbhostport=[localhost:27017,127.0.0.1:27017]
server.contextPath=/api
server.port=8085
logging.level.com.capitalone.dashboard=DEBUG
auth.authenticationProviders=LDAP,STANDARD
auth.ldapServerUrl=ldap://ip:port/dc=corp,dc=corp2,dc=com,dc=co
auth.ldapUserDnPattern=cn={0},uid={0},ou=user
auth.expirationTime=6000000
auth.adDomain=corp.corp2.com.co
auth.adRootDn=dc=corp,dc=corp2,dc=com,dc=co
auth.adUrl=ldap://ip:port

But still is not enough that get up successful authentication through ldap.
The console has the output, where the userDn is not set, i don't have idea where set him

2019-04-19 00:19:11,010 INFO  org.mongodb.driver.connection - Opened connection [connectionId{localValue:2, serverValue:572}] to 127.0.0.1:27017
2019-04-19 00:19:11,225 INFO  o.s.s.l.DefaultSpringSecurityContextSource -  URL 'ldap://10.1.0.15:3268/dc=corp,dc=epm,dc=com,dc=co', root DN is 'dc=corp,dc=epm,dc=com,dc=co'
2019-04-19 00:19:11,229 INFO  o.s.l.c.s.AbstractContextSource - Property 'userDn' not set - anonymous context will be used for read-write operations
2019-04-19 00:19:11,271 INFO  o.s.s.l.u.DefaultLdapAuthoritiesPopulator - groupSearchBase is empty. Searches will be performed from the context source base
2019-04-19 00:19:11,395 INFO  o.s.b.c.e.FilterRegistrationBean - Mapping filter: 'characterEncodingFilter' to: [/]
2019-04-19 00:19:11,399 INFO  o.s.b.c.e.DelegatingFilterProxyRegistrationBean - Mapping filter: 'springSecurityFilterChain' to: [/]
2019-04-19 00:19:11,401 INFO  o.s.b.c.e.FilterRegistrationBean - Mapping filter: 'ssoAuthenticationFilter' to: [/]
2019-04-19 00:19:11,402 INFO  o.s.b.c.e.FilterRegistrationBean - Mapping filter: 'jwtAuthenticationFilter' to: [/]
2019-04-19 00:19:11,403 INFO  o.s.b.c.e.FilterRegistrationBean - Mapping filter: 'standardLoginRequestFilter' to: [/]
2019-04-19 00:19:11,404 INFO  o.s.b.c.e.FilterRegistrationBean - Mapping filter: 'githubWebhookRequestFilter' to: [/]
2019-04-19 00:19:11,406 INFO  o.s.b.c.e.FilterRegistrationBean - Mapping filter: 'ldapLoginRequestFilter' to: [/]
2019-04-19 00:19:11,407 INFO  o.s.b.c.e.FilterRegistrationBean - Mapping filter: 'apiTokenRequestFilter' to: [/]
2019-04-19 00:19:11,409 INFO  o.s.b.c.e.ServletRegistrationBean - Mapping servlet: 'dispatcherServlet' to [/]
2019-04-19 00:19:11,445 DEBUG c.c.d.a.t.JwtAuthenticationFilter - Initializing filter 'jwtAuthenticationFilter'
2019-04-19 00:19:11,449 DEBUG c.c.d.a.t.JwtAuthenticationFilter - Filter 'jwtAuthenticationFilter' configured successfully
2019-04-19 00:19:11,451 DEBUG c.c.d.a.a.ApiTokenRequestFilter - Initializing filter 'apiTokenRequestFilter'
2019-04-19 00:19:11,452 DEBUG c.c.d.a.a.ApiTokenRequestFilter - Filter 'apiTokenRequestFilter' configured successfully
2019-04-19 00:19:11,454 DEBUG c.c.d.a.ldap.LdapLoginRequestFilter - Initializing filter 'ldapLoginRequestFilter'
2019-04-19 00:19:11,455 DEBUG c.c.d.a.ldap.LdapLoginRequestFilter - Filter 'ldapLoginRequestFilter' configured successfully
2019-04-19 00:19:11,458 DEBUG c.c.d.a.w.g.GithubWebHookRequestFilter - Initializing filter 'githubWebhookRequestFilter'
2019-04-19 00:19:11,459 DEBUG c.c.d.a.w.g.GithubWebHookRequestFilter - Filter 'githubWebhookRequestFilter' configured successfully
2019-04-19 00:19:11,753 INFO  o.s.s.web.DefaultSecurityFilterChain - Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@56cd2efe, org.springframework.security.web.context.SecurityContextPersistenceFilter@344ae67b, org.springframework.security.web.header.HeaderWriterFilter@5892ef6c, org.springframework.security.web.authentication.logout.LogoutFilter@4052896d, com.capitalone.dashboard.auth.standard.StandardLoginRequestFilter@421a9bc8, com.capitalone.dashboard.auth.sso.SsoAuthenticationFilter@6dbd2786, com.capitalone.dashboard.auth.ldap.LdapLoginRequestFilter@496e0b98, com.capitalone.dashboard.auth.apitoken.ApiTokenRequestFilter@15f5a158, com.capitalone.dashboard.auth.token.JwtAuthenticationFilter@3e3e97b5, com.capitalone.dashboard.auth.webhook.github.GithubWebHookRequestFilter@4d6b94a4, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@2e6d2caa, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@52fb5cdc, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@2f45fbb8, org.springframework.security.web.session.SessionManagementFilter@4e810743, org.springframework.security.web.access.ExceptionTranslationFilter@5e729b99, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@1b70c00c]
2019-04-19 00:19:11,770 DEBUG c.c.d.a.s.StandardLoginRequestFilter - Initializing filter 'standardLoginRequestFilter'
2019-04-19 00:19:11,771 DEBUG c.c.d.a.s.StandardLoginRequestFilter - Filter 'standardLoginRequestFilter' configured successfully
2019-04-19 00:19:11,774 DEBUG c.c.d.a.sso.SsoAuthenticationFilter - Initializing filter 'ssoAuthenticationFilter'
2019-04-19 00:19:11,775 DEBUG c.c.d.a.sso.SsoAuthenticationFilter - Filter 'ssoAuthenticationFilter' configured successfully
2019-04-19 00:19:13,220 INFO  o.s.b.a.s.AuthenticationManagerConfiguration -

And login failed

2019-04-19 00:24:09,776 DEBUG c.c.d.a.ldap.LdapLoginRequestFilter - Request is to process authentication
2019-04-19 00:24:10,106 DEBUG c.c.d.a.ldap.LdapLoginRequestFilter - Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
2019-04-19 00:24:10,107 DEBUG c.c.d.a.ldap.LdapLoginRequestFilter - Updated SecurityContextHolder to contain null Authentication
2019-04-19 00:24:10,113 DEBUG c.c.d.a.ldap.LdapLoginRequestFilter - Delegating to authentication failure handler org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@4b5f26d3

I appreciate your help
Regards

Duplicate issue #2914: Enable ldap for Hygieia 
Created: 2019-05-16T20:59:53Z
I am getting "Bad credentials" error while attempting to authenticate through Ldap from Hygieia.
I read almost all the issues posted related to hygieia + Ldap and AD too.
But didnt any solution work for me.
api property file:
JWT expiration time in milliseconds
auth.expirationTime=600
Secret Key used to validate the JWT tokens
auth.secret=${AUTH_SECRET:-}
auth.authenticationProviders=LDAP,STANDARD
LDAP Server Url, including port of your LDAP server
auth.ldapServerUrl=ldap://xxxx:port/DC=xxx,DC=xxx
auth.ldapUserDnPattern=uid={0},CN={0},OU=Application,OU=ServiceAccounts,DC=xxx,DC=xxx
auth.ldapDisableGroupAuthorization=${AUTH_LDAP_DISABLE_GROUP_AUTHORIZATION:-false}
logging.level.com.capitalone.dashboard=DEBUG
Needed if you want to query ldap
auth.ldapBindUser=user
auth.ldapBindPass=password
API logs:
2019-05-16 20:48:15,294 INFO  o.s.s.l.DefaultSpringSecurityContextSource -  URL 'ldap://xxxx:port/DC=xxx,DC=xxx', root DN is 'DC=xxx,DC=xxx'
2019-05-16 20:48:15,418 INFO  o.s.l.c.s.AbstractContextSource - Property 'userDn' not set - anonymous context will be used for read-write operations
2019-05-16 20:48:16,432 INFO  o.s.s.l.u.DefaultLdapAuthoritiesPopulator - groupSearchBase is empty. Searches will be performed from the context source base
API logs errors onlogin attempt:
2019-05-16 20:50:38,068 DEBUG c.c.d.a.ldap.LdapLoginRequestFilter - Request is to process authentication
2019-05-16 20:50:38,103 DEBUG c.c.d.a.ldap.LdapLoginRequestFilter - Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
2019-05-16 20:50:38,103 DEBUG c.c.d.a.ldap.LdapLoginRequestFilter - Updated SecurityContextHolder to contain null Authentication
2019-05-16 20:50:38,103 DEBUG c.c.d.a.ldap.LdapLoginRequestFilter - Delegating to authentication failure handler org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler@71dbb61a
Note: I have verified that my ldap URL and credentials are correct.
Can you please help here to find the issue?

Closing comment (2019-05-23T17:46:22Z): But closing this as this is a duplicate of #2839