Hello Root Sir, Thank you so much for guiding me and helping me to resolve problem. Appreciated..
Thanks and Regards Arti On Thursday, July 9, 2020 at 5:18:57 AM UTC+5:30, Root wrote: > > > SHA is pretty simple algorithm, but weak too, if you are testing its fine, > but not good for production. > Yes, you should give a try with 636 and as new browsers are pushing > towards https, using encrypted connection should become default. > > > > On Wed, Jul 8, 2020 at 8:27 PM arti wavale <[email protected] > <javascript:>> wrote: > >> Hello root, >> >> Thanks for quick response >> >> i have used SHA format for LDAP password. >> >> and also tried below properties in cas.properties file but still problem >> is same which is "could not update account password" >> >> # LDAP Password Encoding >> cas.authn.ldap[0].passwordEncoder.type=DEFAULT >> cas.authn.ldap[0].passwordEncoder.characterEncoding=UTF-8 >> cas.authn.ldap[0].passwordEncoder.encodingAlgorithm=SHA >> >> I have a one doubt, right now I am using simple ldap database connection >> means url=ldap://localhost:389 so is it a reason password management not >> working? >> is there any complusion to use ssl ldap connection means >> url=ldaps://localhost:636 then and oly then password management work? >> >> Thanks and Regards >> Arti >> >> On Wednesday, July 8, 2020 at 5:10:33 PM UTC+5:30, Root wrote: >>> >>> Log is too much, but i can see the error is related to storing the LDAP >>> password type, what type of algorithm is used to store password?, (SSHA >>> ,SHA-512, scrypt, MD5.....etc) and the character encoding, the default >>> should be UTF-8 >>> >>> Try to keep default and try or just don't specify too much variables >>> relating to this in the cas properties. >>> >>> >>> >>> >>> >>> >>> >>> >>> >>> >>> On Wednesday, July 8, 2020 at 10:03:18 AM UTC+5:30 arti wavale wrote: >>> >>>> Hello, >>>> >>>> I am providing cas.log file, please once check it and if got any idea >>>> to resolve password managemnt problem then please guide me >>>> >>>> On Tuesday, June 23, 2020 at 4:01:08 PM UTC+5:30, Root wrote: >>>>> >>>>> >>>>> OK, but what about the logs?, looking at logs you can get some hint, >>>>> have you enabled CAS debug mode ( <Root level="DEBUG">) in >>>>> cas-log4j2.xml >>>>> file?, and also in your LDAP server some option to enable debug/verbose >>>>> mode, after enable and restarting the services, tail both the logs and >>>>> try to change the LDAP password, and see what error you get in logs. >>>>> >>>>> >>>>> >>>>> >>>>> On Tuesday, June 23, 2020 at 2:28:14 PM UTC+5:30, arti wavale wrote: >>>>>> >>>>>> Hello Root, >>>>>> >>>>>> First of all, >>>>>> Thank you so much for your reply.. >>>>>> >>>>>> I'm using CAS v5.2 in which I have used "cas.authn.pm.ldap.userFilter >>>>>> =cn={user}" in cas.properties file. The userFilter attribute was >>>>>> renamed to searchFilter in CAS v5.3 but Still I have tried " >>>>>> cas.authn.pm.ldap.searchFilter=cn={user}" in cas.properties file and >>>>>> check it but same error occurred. >>>>>> >>>>>> Thanks and Regards >>>>>> Arti >>>>>> >>>>>> On Tuesday, June 23, 2020 at 11:58:16 AM UTC+5:30, Root wrote: >>>>>>> >>>>>>> >>>>>>> @Arthi, >>>>>>> >>>>>>> Have you included "cas.authn.pm.ldap.searchFilter=cn={user}" in >>>>>>> cas.properties?, and you should enable debug mode in both CAS and LDAP >>>>>>> server side and check both logs to get more detail. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Tuesday, June 23, 2020 at 11:14:12 AM UTC+5:30, arti wavale wrote: >>>>>>>> >>>>>>>> All detail information provided in a document . Please find the >>>>>>>> attachment >>>>>>>> >>>>>>>> I am facing error such as "could not update the account password " >>>>>>>> >>>>>>>> If anyone can help to resolve this issue >>>>>>>> >>>>>>>> >>>>>>>> ------------------------------------------------------------------------------------------------- >>>>>>>> >>>>>>>> *Pom.xml:* >>>>>>>> <dependency> <groupId>org.apereo.cas</groupId> >>>>>>>> <artifactId>cas-server-support-pm-ldap</artifactId> >>>>>>>> <version>${cas.version}</version></dependency> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> *cas.properties:* >>>>>>>> >>>>>>>> >>>>>>>> cas.authn.accept.users= cas.authn.ldap[0].order=0 >>>>>>>> cas.authn.ldap[0].name=LDAP >>>>>>>> Server cas.authn.ldap[0].type=AUTHENTICATED >>>>>>>> cas.authn.ldap[0].ldapUrl=ldap://localhost >>>>>>>> cas.authn.ldap[0].useSsl=false cas.authn.ldap[0].useStartTls=false >>>>>>>> cas.authn.ldap[0].connectTimeout=50000 >>>>>>>> cas.authn.ldap[0].subtreeSearch=true >>>>>>>> cas.authn.ldap[0].validatePeriod=270 >>>>>>>> cas.authn.ldap[0].userFilter=cn={user} >>>>>>>> #cas.authn.ldap[0].userFilter=(|(uid={user})(cn={user})(mail={user})) >>>>>>>> cas.authn.ldap[0].baseDn=dc=example,dc=com >>>>>>>> #cas.authn.ldap[0].enhanceWithEntryResolver=true >>>>>>>> #cas.authn.ldap[0].dnFormat:cn=%s,cn=admin,dc=example,dc=com >>>>>>>> cas.authn.ldap[0].bindDn=cn=admin,dc=example,dc=com >>>>>>>> cas.authn.ldap[0].bindCredential=administrator >>>>>>>> cas.authn.ldap[0].enhanceWithEntryResolver=true >>>>>>>> cas.authn.ldap[0].dnFormat:cn=%s,cn=admin,dc=example,dc=com >>>>>>>> cas.authn.ldap[0].principalAttributeList=memberOf,uid,cn,mail >>>>>>>> cas.authn.ldap[0].collectDnAttribute=false >>>>>>>> >>>>>>>> >>>>>>>> cas.authn.ldap[0].principalAttributeId=cncas.authn.ldap[0].principalAttributePassword=userPassword# >>>>>>>> attributes to be retrieved from LDAP >>>>>>>> userPassword#cas.authn.ldap[0].principalAttributeList=uid,cn,mail#cas.authn.ldap[0].collectDnAttribute=falsecas.authn.ldap[0].principalDnAttributeName=principalLdapDncas.authn.ldap[0].allowMultiplePrincipalAttributeValues=truecas.authn.ldap[0].allowMissingPrincipalAttributeValue=true# >>>>>>>> cas.authn.ldap[0].credentialCriteria=# LDAP Password Encoding# >>>>>>>> cas.authn.ldap[0].passwordEncoder.type=# >>>>>>>> cas.authn.ldap[0].passwordEncoder.characterEncoding=UTF-8# >>>>>>>> cas.authn.ldap[0].passwordEncoder.encodingAlgorithm=SHA# LDAP >>>>>>>> Poolingcas.authn.ldap[0].minPoolSize=3cas.authn.ldap[0].maxPoolSize=50cas.authn.ldap[0].validateOnCheckout=truecas.authn.ldap[0].validatePeriodically=truecas.authn.ldap[0].validatePeriod=600cas.authn.ldap[0].failFast=truecas.authn.ldap[0].idleTime=5000cas.authn.ldap[0].prunePeriod=5000cas.authn.ldap[0].blockWaitTime=5000 >>>>>>>> cas.authn.ldap[0].providerClass=org.ldaptive.provider.unboundid.UnboundIDProvidercas.authn.ldap[0].allowMultipleDns=false >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> #Password Management >>>>>>>> spring.mail.host=mail.technology.comspring.mail.port=587spring.mail.username=x...@technology.comspring.mail.password=xxxxxxspring.mail.testConnection=truespring.mail.properties.mail.smtp.auth=truespring.mail.properties.mail.smtp.starttls.enable=true >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> cas.authn.pm.enabled=true#cas.authn.pm.policyPattern=^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%~()_{}-]).{8,}$ >>>>>>>> #cas.authn.pm.reset.text=password >>>>>>>> reset:%scas.authn.pm.reset.text=Reset your password with this link: >>>>>>>> %s#cas.authn.pm.reset.subject=armor password >>>>>>>> resetcas.authn.pm.reset.subject=Password Reset >>>>>>>> Requestcas.authn.pm.reset.from=${spring.mail.username}cas.authn.pm.reset.expirationMinutes=10cas.authn.pm.reset.emailAttribute=mailcas.authn.pm.reset.securityQuestionsEnabled=falsecas.authn.pm.autoLogin=false >>>>>>>> cas.authn.pm.reset.crypto.encryption.key=xxxxxxxxxxxxxxxxxxxxxxxxcas.authn.pm.reset.crypto.signing.key=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxcas.authn.pm.reset.crypto.enabled=true >>>>>>>> >>>>>>>> #cas.authn.pm.enabled=truecas.authn.pm.ldap.type=GENERICcas.authn.pm.ldap.ldapUrl=${cas.authn.ldap[0].ldapUrl}cas.authn.pm.ldap.useSsl=falsecas.authn.pm.ldap.connectTimeout=5000cas.authn.pm.ldap.baseDn=${cas.authn.ldap[0].baseDn}cas.authn.pm.ldap.userFilter=${cas.authn.ldap[0].userFilter}cas.authn.pm.ldap.subtreeSearch=truecas.authn.pm.ldap.bindDn=cn=admin,dc=example,dc=comcas.authn.pm.ldap.bindCredential=administratorcas.authn.pm.ldap.poolPassivator=BINDcas.authn.pm.ldap.minPoolSize=3cas.authn.pm.ldap.maxPoolSize=10cas.authn.pm.ldap.validateOnCheckout=truecas.authn.pm.ldap.validatePeriodically=truecas.authn.pm.ldap.validatePeriod=600cas.authn.pm.ldap.validateTimeout=5000cas.authn.pm.ldap.failFast=true >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> cas.authn.pm.ldap.idleTime=500cas.authn.pm.ldap.prunePeriod=600cas.authn.pm.ldap.blockWaitTime=5000cas.authn.pm.ldap.providerClass=org.ldaptive.provider.unboundid.UnboundIDProvider >>>>>>>> #validatorcas.authn.pm.ldap.validator.type=SEARCHcas.authn.pm.ldap.validator.baseDn=dc=example,dc=com#cas.authn.pm.ldap.validator.searchFilter=(objectClass=*)cas.authn.pm.ldap.validator.scope=SUBTREE >>>>>>>> >>>>>>>> ----------------------------------------------------------------------- >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Thanks and Regards >>>>>>>> Arti >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> On Monday, June 22, 2020 at 12:23:54 PM UTC-7, Vikash Chandra Ansh >>>>>>>> wrote: >>>>>>>>> >>>>>>>>> Hi Arti, >>>>>>>>> >>>>>>>>> How are you proceeding with ldap password management. Please >>>>>>>>> involve me as well as I want to incorporate this in my application. >>>>>>>>> >>>>>>>>> Thanks and Regards >>>>>>>>> >>>>>>>>> On Sat, Jun 20, 2020 at 9:59 AM arti wavale <[email protected]> >>>>>>>>> wrote: >>>>>>>>> >>>>>>>>>> can you explain me, how implemented password management in cas >>>>>>>>>> 5.2 and can share cas.properties file and which dependency are you >>>>>>>>>> used in >>>>>>>>>> pox.xml file? >>>>>>>>>> >>>>>>>>>> On Tuesday, November 20, 2018 at 10:33:06 PM UTC+5:30, MD. Fazla >>>>>>>>>> Rabby wrote: >>>>>>>>>>> >>>>>>>>>>> We are already using CAS5.2 and password management working >>>>>>>>>>> fine. But for CAS version 6 we are getting the ldap referral error >>>>>>>>>>> "java.security.cert.CertificateException: Hostname does not match >>>>>>>>>>> the >>>>>>>>>>> hostname in the server's certificate site:stackoverflow.com" >>>>>>>>>>> How to get around with this >>>>>>>>>>> >>>>>>>>>>> This is my cas.properties >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> cas.authn.pm.enabled=true >>>>>>>>>>> cas.authn.pm.policyPattern=^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9 >>>>>>>>>>> ])(?=.*?[#?!@$%~()_{}-]).{8,}$ >>>>>>>>>>> cas.authn.pm.reset.text=Reset your password with this link: %s >>>>>>>>>>> cas.authn.pm.reset.subject=Password Reset Request >>>>>>>>>>> cas.authn.pm.reset.from=myemail.mydomain.com >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> #password reset expiry is set to 1 day equivalent minutes >>>>>>>>>>> cas.authn.pm.reset.expirationMinutes=1440 >>>>>>>>>>> cas.authn.pm.reset.emailAttribute=secondaryEmail >>>>>>>>>>> cas.authn.pm.reset.securityQuestionsEnabled=true >>>>>>>>>>> >>>>>>>>>>> # Automatically log in after successful password change >>>>>>>>>>> cas.authn.pm.autoLogin=false >>>>>>>>>>> >>>>>>>>>>> # Used to sign/encrypt the password-reset link >>>>>>>>>>> cas.authn.pm.reset.crypto.encryption.key >>>>>>>>>>> =asdasdasdasdasdasdasdasdasdasd >>>>>>>>>>> cas.authn.pm.reset.crypto.signing.key >>>>>>>>>>> =asdasdasasdasdasdasdadsadasdasdasdasd >>>>>>>>>>> cas.authn.pm.reset.crypto.enabled=true >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> #Email Submissions >>>>>>>>>>> >>>>>>>>>>> spring.mail.host=smtp.office365.com >>>>>>>>>>> spring.mail.port=587 >>>>>>>>>>> [email protected] >>>>>>>>>>> spring.mail.password=pass >>>>>>>>>>> spring.mail.testConnection=true >>>>>>>>>>> spring.mail.properties.mail.smtp.auth=true >>>>>>>>>>> spring.mail.properties.mail.smtp.starttls.enable=true >>>>>>>>>>> >>>>>>>>>>> # >>>>>>>>>>> ##LDAP Password management >>>>>>>>>>> # >>>>>>>>>>> cas.authn.pm.ldap.type=AD >>>>>>>>>>> # >>>>>>>>>>> cas.authn.pm.ldap.ldapUrl=ldaps://myldap:636 >>>>>>>>>>> cas.authn.pm.ldap.useSsl=true >>>>>>>>>>> cas.authn.pm.ldap.useStartTls=false >>>>>>>>>>> cas.authn.pm.ldap.connectTimeout=50000 >>>>>>>>>>> cas.authn.pm.ldap.baseDn=DC=xx,DC=xx,DC=xx,DC=xx >>>>>>>>>>> cas.authn.pm.ldap.searchFilter=cn={user} >>>>>>>>>>> cas.authn.pm.ldap.subtreeSearch=true >>>>>>>>>>> cas.authn.pm.ldap.bindDn=CN=xx,OU=xx,DC=xx,DC=xx,DC=xx,DC=xx >>>>>>>>>>> cas.authn.pm.ldap.bindCredential=pass >>>>>>>>>>> # cas.authn.pm.ldap.connectionStrategy= >>>>>>>>>>> cas.authn.pm.ldap.trustCertificates=file:/etc/cas/myldap.cer >>>>>>>>>>> ## cas.authn.pm.ldap.keystore= >>>>>>>>>>> ## cas.authn.pm.ldap.keystorePassword= >>>>>>>>>>> ## cas.authn.pm.ldap.keystoreType=JKS|JCEKS|PKCS12 >>>>>>>>>>> cas.authn.pm.ldap.poolPassivator=BIND >>>>>>>>>>> cas.authn.pm.ldap.minPoolSize=3 >>>>>>>>>>> cas.authn.pm.ldap.maxPoolSize=10 >>>>>>>>>>> cas.authn.pm.ldap.validateOnCheckout=true >>>>>>>>>>> cas.authn.pm.ldap.validatePeriodically=true >>>>>>>>>>> cas.authn.pm.ldap.validatePeriod=600 >>>>>>>>>>> cas.authn.pm.ldap.validateTimeout=5000 >>>>>>>>>>> cas.authn.pm.ldap.failFast=true >>>>>>>>>>> cas.authn.pm.ldap.idleTime=500 >>>>>>>>>>> cas.authn.pm.ldap.prunePeriod=600 >>>>>>>>>>> cas.authn.pm.ldap.blockWaitTime=5000 >>>>>>>>>>> >>>>>>>>>>> ##cas.authn.pm.ldap.providerClass=org.ldaptive.provider.unboundid.UnboundIDProvider >>>>>>>>>>> # >>>>>>>>>>> ## Attributes that should be fetched to indicate security >>>>>>>>>>> questions and answers, >>>>>>>>>>> ## assuming security questions are enabled. >>>>>>>>>>> cas.authn.pm.ldap.securityQuestionsAttributes.attributeQuestion1 >>>>>>>>>>> =attributeAnswer1 >>>>>>>>>>> cas.authn.pm.ldap.securityQuestionsAttributes.attributeQuestion2 >>>>>>>>>>> =attributeAnswer2 >>>>>>>>>>> cas.authn.pm.ldap.securityQuestionsAttributes.attrQuestion3= >>>>>>>>>>> attributeAnswer2 >>>>>>>>>>> # >>>>>>>>>>> cas.authn.pm.ldap.validator.type=SEARCH >>>>>>>>>>> cas.authn.pm.ldap.validator.baseDn=DC=xx,DC=xx,DC=xx,DC=xx >>>>>>>>>>> ##cas.authn.pm.ldap.validator.searchFilter=(objectClass=*) >>>>>>>>>>> cas.authn.pm.ldap.validator.scope=SUBTREE >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> -- >>>>>>>>>> - Website: https://apereo.github.io/cas >>>>>>>>>> - Gitter Chatroom: https://gitter.im/apereo/cas >>>>>>>>>> - List Guidelines: https://goo.gl/1VRrw7 >>>>>>>>>> - Contributions: https://goo.gl/mh7qDG >>>>>>>>>> --- >>>>>>>>>> You received this message because you are subscribed to the >>>>>>>>>> Google Groups "CAS Community" group. >>>>>>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>>>>>> send an email to [email protected]. >>>>>>>>>> To view this discussion on the web visit >>>>>>>>>> https://groups.google.com/a/apereo.org/d/msgid/cas-user/1d2b5ab2-a319-47b7-a802-be92b1008802o%40apereo.org >>>>>>>>>> >>>>>>>>>> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/1d2b5ab2-a319-47b7-a802-be92b1008802o%40apereo.org?utm_medium=email&utm_source=footer> >>>>>>>>>> . >>>>>>>>>> >>>>>>>>> -- >> - Website: https://apereo.github.io/cas >> - Gitter Chatroom: https://gitter.im/apereo/cas >> - List Guidelines: https://goo.gl/1VRrw7 >> - Contributions: https://goo.gl/mh7qDG >> --- >> You received this message because you are subscribed to the Google Groups >> "CAS Community" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected] <javascript:>. >> To view this discussion on the web visit >> https://groups.google.com/a/apereo.org/d/msgid/cas-user/9ba35900-375c-4310-b1b4-e20319f82987o%40apereo.org >> >> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/9ba35900-375c-4310-b1b4-e20319f82987o%40apereo.org?utm_medium=email&utm_source=footer> >> . >> > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/4aa0e2c3-104b-4fbc-88a6-b1cd46d6a465o%40apereo.org.
