No worries! Reading the documents again, it looks like I may confused a
couple of things.
AD Acive Directory - Users authenticate with sAMAccountName typically using
a DN format.
It says that it authenticates using the sAMAccountName which should get
passed in if we use cas.authn.ldap[0].userFilter=sAMAccountName={user}
correct?
Right now, I can put anything in the username field and it gets
authenticated. That can't be right?
On Monday, February 26, 2018 at 3:11:51 PM UTC-6, David Curry wrote:
>
> Sorry, I don't. But some other folks on the list have been doing other
> kinds of logins, so maybe they do.
>
>
> --
>
> DAVID A. CURRY, CISSP
> *DIRECTOR OF INFORMATION SECURITY*
> INFORMATION TECHNOLOGY
>
> 71 FIFTH AVE., 9TH FL., NEW YORK, NY 10003
> +1 212 229-5300 x4728 • [email protected] <javascript:>
>
> [image: The New School]
>
> On Mon, Feb 26, 2018 at 3:54 PM, Kevin Liu <[email protected]
> <javascript:>> wrote:
>
>> Thanks, got it working!
>>
>> I hope you don't mind me picking your brain a little further. Do you
>> have any experience with principalAttributeId fields? I'm wondering if I
>> can first bind to LDAP, and then use username and password to authenticate
>> instead and it looks like principalAttribute fields might be it.
>>
>> On Monday, February 26, 2018 at 2:36:13 PM UTC-6, David Curry wrote:
>>>
>>> I haven't tried it myself, but you ought to be able to put cas.log.level
>>> back to "warn" and then add something like
>>>
>>> <AsyncLogger name="org.apereo.cas.authentication" level="debug"
>>> includeLocation="true"/>
>>>
>>>
>>> in the <Loggers> section (down around line 61). See the comment right
>>> there in the file for a little more info.
>>>
>>> --Dave
>>>
>>>
>>>
>>>
>>> --
>>>
>>> DAVID A. CURRY, CISSP
>>> *DIRECTOR OF INFORMATION SECURITY*
>>> INFORMATION TECHNOLOGY
>>>
>>> 71 FIFTH AVE., 9TH FL., NEW YORK, NY 10003
>>> <https://maps.google.com/?q=71+FIFTH+AVE.,+9TH+FL.,+NEW+YORK,+NY+10003&entry=gmail&source=g>
>>> +1 212 229-5300 x4728 • [email protected]
>>>
>>> [image: The New School]
>>>
>>> On Mon, Feb 26, 2018 at 3:23 PM, Kevin Liu <[email protected]> wrote:
>>>
>>>> I'm messing with the logger. Is it possible to have just LDAP debug
>>>> codes output? If so, how? Cause I can't seem to be able to shut off the
>>>> others without shutting off debug all together.
>>>>
>>>> On Monday, February 26, 2018 at 11:53:16 AM UTC-6, David Curry wrote:
>>>>>
>>>>> Well, you can start with log4j2.xml, and change
>>>>>
>>>>> <Property name="cas.log.level" >warn</Property>
>>>>>
>>>>>
>>>>> to
>>>>>
>>>>> <Property name="cas.log.level" >debug</Property>
>>>>>
>>>>>
>>>>> which will give you a lot of detail (all in cas.log) about what's
>>>>> going on. If that doesn't give you want you want, you can also (or
>>>>> instead)
>>>>> change
>>>>>
>>>>> <AsyncLogger name="org.ldaptive" level="warn" />
>>>>>
>>>>>
>>>>> to
>>>>>
>>>>> <AsyncLogger name="org.ldaptive" level="debug" />
>>>>>
>>>>>
>>>>> to get debugging from the LDAP code itself.
>>>>>
>>>>> As for your second question... you've exceeded my level of knowledge
>>>>> of AD/LDAP. I think the answer might be that you can't use the "AD" type
>>>>> of
>>>>> LDAP setup and will have to switch to the "AUTHENTICATED" type, but I'm
>>>>> not
>>>>> very sure of that answer.
>>>>>
>>>>> Perhaps someone else on the list can jump in.
>>>>>
>>>>> --Dave
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>>
>>>>> DAVID A. CURRY, CISSP
>>>>> *DIRECTOR OF INFORMATION SECURITY*
>>>>> INFORMATION TECHNOLOGY
>>>>>
>>>>> 71 FIFTH AVE., 9TH FL., NEW YORK, NY 10003
>>>>> <https://maps.google.com/?q=71+FIFTH+AVE.,+9TH+FL.,+NEW+YORK,+NY+10003&entry=gmail&source=g>
>>>>> +1 212 229-5300 x4728 • [email protected]
>>>>>
>>>>> [image: The New School]
>>>>>
>>>>> On Mon, Feb 26, 2018 at 12:43 PM, Kevin Liu <[email protected]>
>>>>> wrote:
>>>>>
>>>>>> Thank you Dave for providing additonal insight!
>>>>>>
>>>>>> Just to add, my MSDN I was refering above is actually an Microsoft
>>>>>> Active Directory Server which I'm using the LDAP protocol to talk to (at
>>>>>> least that is my understanding).
>>>>>>
>>>>>> I've got a few more questions. Is it possible to see what the LDAP is
>>>>>> returning to CAS? Maybe via logs? Getting insight to what is being
>>>>>> returned
>>>>>> will help me get a better grasp on the LDAP CAS connections and
>>>>>> communications.
>>>>>>
>>>>>> Also, in addition to multiple OUs, it turns out that the DN that is
>>>>>> being used doesn't utilize a user's username but rather a user's full
>>>>>> name
>>>>>> as part of the DN. For example, my DN is CN=Kevin Liu, OU=Alpha,
>>>>>> DC=beta,
>>>>>> DC=gamma instead of CN=kliu. Do you have any ideas on how I might get
>>>>>> around that?
>>>>>>
>>>>>> On Friday, February 23, 2018 at 2:24:37 PM UTC-6, David Curry wrote:
>>>>>>>
>>>>>>>
>>>>>>> There are smarter (way smarter) LDAP people than me, but yeah,
>>>>>>> that's kind of it. Some LDAPs (like AD) will let you bind as the user
>>>>>>> him/herself to authenticate, others require you to use a special
>>>>>>> account to
>>>>>>> make the bind, and then authenticate the user. Although come to think
>>>>>>> of
>>>>>>> it, I think AD might only permit that over an LDAPS connection, which
>>>>>>> might
>>>>>>> be why you were having trouble.
>>>>>>>
>>>>>>> Likewise, some LDAPs will let you retrieve attributes at the same
>>>>>>> time that you authenticate, and others require you to make a separate
>>>>>>> request for that. In our particular case, our LDAP contains a superset
>>>>>>> of
>>>>>>> the users in AD (AD has "active" people, LDAP has "active" and
>>>>>>> "alumni").
>>>>>>> But the two directories have different (overlapping) sets of
>>>>>>> attributes,
>>>>>>> and we always want to get all of them and merge them together, so in my
>>>>>>> CAS
>>>>>>> config, I do the authentication and attribute retrieval separately.
>>>>>>>
>>>>>>> I'm not sure how you get a dnFormat that handles multiple OUs, or if
>>>>>>> you even can. In my case, we have almost everyone in a single OU,
>>>>>>> except
>>>>>>> for some administrator accounts, which are in a separate OU. Rather
>>>>>>> than
>>>>>>> try and handle them all together, I just punted and defined two
>>>>>>> different
>>>>>>> AD configs for them, one for each OU. If you look at my documentation,
>>>>>>> you'll note that ldap[0] and ldap[2] are actually the SAME AD server,
>>>>>>> they
>>>>>>> just have different baseDN and dnFormat settings.
>>>>>>>
>>>>>>> --Dave
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>>
>>>>>>> DAVID A. CURRY, CISSP
>>>>>>> *DIRECTOR OF INFORMATION SECURITY*
>>>>>>> INFORMATION TECHNOLOGY
>>>>>>>
>>>>>>> 71 FIFTH AVE., 9TH FL., NEW YORK, NY 10003
>>>>>>> <https://maps.google.com/?q=71+FIFTH+AVE.,+9TH+FL.,+NEW+YORK,+NY+10003&entry=gmail&source=g>
>>>>>>> +1 212 229-5300 x4728 • [email protected]
>>>>>>>
>>>>>>> [image: The New School]
>>>>>>>
>>>>>>> On Fri, Feb 23, 2018 at 3:12 PM, Kevin Liu <[email protected]>
>>>>>>> wrote:
>>>>>>>
>>>>>>>> Just to make sure I understand the LDAP and CAS connection
>>>>>>>> properly, CAS is sending over a set of credentials to first access the
>>>>>>>> LDAP
>>>>>>>> correct? Is that the bindDN and bindCredential? Does it then search
>>>>>>>> through
>>>>>>>> the result query for userFilter for a match?
>>>>>>>>
>>>>>>>> Also, I'm a little confused about the dNFormat. I inputed directly
>>>>>>>> what is the DN for user 1. However, for other users, since they belong
>>>>>>>> to
>>>>>>>> different OU, how do I change the code such that it becomes more
>>>>>>>> versatile?
>>>>>>>>
>>>>>>>> My eventual goal is for cas to authenticate users from a single OU.
>>>>>>>>
>>>>>>>> Thank you all for bearing with me so far and all my questions.
>>>>>>>>
>>>>>>>> On Friday, February 23, 2018 at 11:44:35 AM UTC-6, Kevin Liu wrote:
>>>>>>>>>
>>>>>>>>> I finally got it to talk to my LDAP! I've realized I should also
>>>>>>>>> put that my LDAP is really a MSDN. It is in a very limited capacity
>>>>>>>>> though.
>>>>>>>>> Here is my cas.properties and I hope someone can help me figure out
>>>>>>>>> how to
>>>>>>>>> expand the scope of authentication. My apologies about the
>>>>>>>>> obfuscation.
>>>>>>>>>
>>>>>>>>> #AD Configurations
>>>>>>>>> cas.authn.ldap[0].type=AD
>>>>>>>>> cas.authn.ldap[0].ldapUrl=ldap://ladpserver:389
>>>>>>>>> cas.authn.ldap[0].useSsl=false
>>>>>>>>> cas.authn.ldap[0].useStartTls=false
>>>>>>>>> cas.authn.ldap[0].connectTimeout=5000
>>>>>>>>> cas.authn.ldap[0].subtreeSearch=true
>>>>>>>>> cas.authn.ldap[0].baseDn=dc=beta,dc=gamma
>>>>>>>>> cas.authn.ldap[0].userFilter=cn={user}
>>>>>>>>> cas.authn.ldap[0][email protected]
>>>>>>>>> cas.authn.ldap[0].bindCredential=user1Password
>>>>>>>>> cas.authn.ldap[0].dnFormat=CN=User
>>>>>>>>> 1,OU=Test,OU=alpha,DC=beta,DC=gamma
>>>>>>>>>
>>>>>>>>> This configuration only works for 1 user, user1. How do I expand
>>>>>>>>> it such that any user can input their credentials for validation?
>>>>>>>>> Also interesting, for user1, they can input either user1 or
>>>>>>>>> [email protected] and be able to login with the correct password.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> On Friday, February 23, 2018 at 9:17:02 AM UTC-6, David Curry
>>>>>>>>> wrote:
>>>>>>>>>>
>>>>>>>>>> Yes, that looks like your DN.
>>>>>>>>>>
>>>>>>>>>> But if CAS is not starting, it's something else. Are you using
>>>>>>>>>> 5.2.2? Can you post your pom.xml and cas.log files as attachments?
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> --
>>>>>>>>>>
>>>>>>>>>> DAVID A. CURRY, CISSP
>>>>>>>>>> *DIRECTOR OF INFORMATION SECURITY*
>>>>>>>>>> INFORMATION TECHNOLOGY
>>>>>>>>>>
>>>>>>>>>> 71 FIFTH AVE., 9TH FL., NEW YORK, NY 10003
>>>>>>>>>> <https://maps.google.com/?q=71+FIFTH+AVE.,+9TH+FL.,+NEW+YORK,+NY+10003&entry=gmail&source=g>
>>>>>>>>>> +1 212 229-5300 x4728 • [email protected]
>>>>>>>>>>
>>>>>>>>>> [image: The New School]
>>>>>>>>>>
>>>>>>>>>> On Fri, Feb 23, 2018 at 9:56 AM, Kevin Liu <[email protected]>
>>>>>>>>>> wrote:
>>>>>>>>>>
>>>>>>>>>>> For my own account, when I execute the LDAP query in my first
>>>>>>>>>>> post, I can't see my own DN but I can see what I'm a member of. Is
>>>>>>>>>>> the
>>>>>>>>>>> listed member field my DN?
>>>>>>>>>>>
>>>>>>>>>>> member: CN=Kevin Liu,OU=Delta,OU=Alpha,DC=Beta,DC=Gamma
>>>>>>>>>>>
>>>>>>>>>>> Would this be my DN?
>>>>>>>>>>>
>>>>>>>>>>> On Friday, February 23, 2018 at 6:17:22 AM UTC-6, alberto wrote:
>>>>>>>>>>>>
>>>>>>>>>>>> On Thu, 22 Feb 2018 13:43:05 -0800 (PST)
>>>>>>>>>>>> Kevin Liu <[email protected]> wrote:
>>>>>>>>>>>>
>>>>>>>>>>>> > Correct me if I'm wrong but looking at the directory, not
>>>>>>>>>>>> everyone
>>>>>>>>>>>> > has a DN. Some users are only members of a group it looks
>>>>>>>>>>>> like.
>>>>>>>>>>>>
>>>>>>>>>>>> I don't think so. DN is the ultimate identifier in LDAP/AD. As
>>>>>>>>>>>> stated
>>>>>>>>>>>> in MSDN: «The LDAP API references an LDAP object by its
>>>>>>>>>>>> distinguished
>>>>>>>>>>>> name (DN)». Even a group have a DN so you can perform
>>>>>>>>>>>> operations on it.
>>>>>>>>>>>>
>>>>>>>>>>>> ( Source:
>>>>>>>>>>>> https://msdn.microsoft.com/en-us/library/aa366101(v=vs.85).aspx
>>>>>>>>>>>> )
>>>>>>>>>>>>
>>>>>>>>>>>> --
>>>>>>>>>>>> Alberto Cabello Sánchez
>>>>>>>>>>>> Servicio de Informática
>>>>>>>>>>>> Universidad de Extremadura
>>>>>>>>>>>>
>>>>>>>>>>> --
>>>>>>>>>>> - Website: https://apereo.github.io/cas
>>>>>>>>>>> - Gitter Chatroom: https://gitter.im/apereo/cas
>>>>>>>>>>> - List Guidelines: https://goo.gl/1VRrw7
>>>>>>>>>>> - Contributions: https://goo.gl/mh7qDG
>>>>>>>>>>> ---
>>>>>>>>>>> You received this message because you are subscribed to the
>>>>>>>>>>> Google Groups "CAS Community" group.
>>>>>>>>>>> To unsubscribe from this group and stop receiving emails from
>>>>>>>>>>> it, send an email to [email protected].
>>>>>>>>>>> To view this discussion on the web visit
>>>>>>>>>>> https://groups.google.com/a/apereo.org/d/msgid/cas-user/4c960c01-c31d-4c3b-8386-c9dadafaf812%40apereo.org
>>>>>>>>>>>
>>>>>>>>>>> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/4c960c01-c31d-4c3b-8386-c9dadafaf812%40apereo.org?utm_medium=email&utm_source=footer>
>>>>>>>>>>> .
>>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> --
>>>>>>>> - Website: https://apereo.github.io/cas
>>>>>>>> - Gitter Chatroom: https://gitter.im/apereo/cas
>>>>>>>> - List Guidelines: https://goo.gl/1VRrw7
>>>>>>>> - Contributions: https://goo.gl/mh7qDG
>>>>>>>> ---
>>>>>>>> You received this message because you are subscribed to the Google
>>>>>>>> Groups "CAS Community" group.
>>>>>>>> To unsubscribe from this group and stop receiving emails from it,
>>>>>>>> send an email to [email protected].
>>>>>>>> To view this discussion on the web visit
>>>>>>>> https://groups.google.com/a/apereo.org/d/msgid/cas-user/197ffc37-0e97-4a1b-b997-30c462259b65%40apereo.org
>>>>>>>>
>>>>>>>> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/197ffc37-0e97-4a1b-b997-30c462259b65%40apereo.org?utm_medium=email&utm_source=footer>
>>>>>>>> .
>>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>> - Website: https://apereo.github.io/cas
>>>>>> - Gitter Chatroom: https://gitter.im/apereo/cas
>>>>>> - List Guidelines: https://goo.gl/1VRrw7
>>>>>> - Contributions: https://goo.gl/mh7qDG
>>>>>> ---
>>>>>> You received this message because you are subscribed to the Google
>>>>>> Groups "CAS Community" group.
>>>>>> To unsubscribe from this group and stop receiving emails from it,
>>>>>> send an email to [email protected].
>>>>>> To view this discussion on the web visit
>>>>>> https://groups.google.com/a/apereo.org/d/msgid/cas-user/73cfed99-5049-4eff-a0f9-880e8edf37df%40apereo.org
>>>>>>
>>>>>> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/73cfed99-5049-4eff-a0f9-880e8edf37df%40apereo.org?utm_medium=email&utm_source=footer>
>>>>>> .
>>>>>>
>>>>>
>>>>> --
>>>> - Website: https://apereo.github.io/cas
>>>> - Gitter Chatroom: https://gitter.im/apereo/cas
>>>> - List Guidelines: https://goo.gl/1VRrw7
>>>> - Contributions: https://goo.gl/mh7qDG
>>>> ---
>>>> You received this message because you are subscribed to the Google
>>>> Groups "CAS Community" group.
>>>> To unsubscribe from this group and stop receiving emails from it, send
>>>> an email to [email protected].
>>>> To view this discussion on the web visit
>>>> https://groups.google.com/a/apereo.org/d/msgid/cas-user/f8568e68-b156-44fc-b2fd-5d42841b47a9%40apereo.org
>>>>
>>>> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/f8568e68-b156-44fc-b2fd-5d42841b47a9%40apereo.org?utm_medium=email&utm_source=footer>
>>>> .
>>>>
>>>
>>> --
>> - Website: https://apereo.github.io/cas
>> - Gitter Chatroom: https://gitter.im/apereo/cas
>> - List Guidelines: https://goo.gl/1VRrw7
>> - Contributions: https://goo.gl/mh7qDG
>> ---
>> You received this message because you are subscribed to the Google Groups
>> "CAS Community" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to [email protected] <javascript:>.
>> To view this discussion on the web visit
>> https://groups.google.com/a/apereo.org/d/msgid/cas-user/e69a02bf-4b0f-4ccf-a8f2-2a2540d91fc0%40apereo.org
>>
>> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/e69a02bf-4b0f-4ccf-a8f2-2a2540d91fc0%40apereo.org?utm_medium=email&utm_source=footer>
>> .
>>
>
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/bfcb11c7-2b31-4c02-9128-4deab371f77c%40apereo.org.
