[xwiki-users] LDAP Authentication and Admin Approval
Hi all I have recently installed Xwiki and have had difficulty with the above mentioned topics. I have already searched through the site for solutions to LDAP/Active directory issues but can't seem to find a solution. I have turned on the logging for LDAP and it is telling me that I am supplying Invalid Credentials, I don't see how this can be true seeing as I have tried it with our server administrator account and received the same error. Does XWiki offer Admin approval for a new change to a page? We would like to check the changes before they are put up on the Wiki. Thanks -- View this message in context: http://n2.nabble.com/LDAP-Authentication-and-Admin-Approval-tp3173539p317353... Sent from the XWiki- Users mailing list archive at Nabble.com.
Le 29 juin 09 à 12:04, Reapepr a écrit :
Hi all
I have recently installed Xwiki and have had difficulty with the above mentioned topics. I have already searched through the site for solutions to LDAP/Active directory issues but can't seem to find a solution.
I have turned on the logging for LDAP and it is telling me that I am supplying Invalid Credentials, I don't see how this can be true seeing as I have tried it with our server administrator account and received the same error.
Invalid credential : your bind to the ldap server failed (but invalid credential error don't provide the explanation by itself). Are you storing plain text password or hash values within your ldap server ? I suspect xwiki to send clear text password (over a secure channel would you enable ldaps) so if you store hash values, the ldap server compare the plain text password to the hash version, resulting in invalid credential (password string being different). HTH and sorry would this be not relevant to your referred issue (I'm just a user ;-)).
Does XWiki offer Admin approval for a new change to a page? We would like to check the changes before they are put up on the Wiki.
Thanks
-- View this message in context: http://n2.nabble.com/LDAP-Authentication-and-Admin-Approval-tp3173539p317353... Sent from the XWiki- Users mailing list archive at Nabble.com.
_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
The server does hash the passwords so that could be the issue, though I had thought the server would hash the incoming password request and then compare it. What does HTH mean? -- View this message in context: http://n2.nabble.com/LDAP-Authentication-and-Admin-Approval-tp3173539p317996... Sent from the XWiki- Users mailing list archive at Nabble.com.
Le 30 juin 09 à 09:49, Reapepr a écrit :
The server does hash the passwords so that could be the issue, though I had thought the server would hash the incoming password request and then compare it.
Try to add another "uniquePassword" attribute with a plain text password for a user in the directiry, and retry authentication. If the auth work, we identified the problem. Else the issue is elsewhere. You need to test it. I am experiencing the same issue (hash pwd in directory, and xwiki sending plain text password). I guess the only way (without much work around on the application itself) would be to add SASL mechanism in front end to your directory (SASL would hash the password for the directoiry, if I'm correct !). I couldn't test this idea however (time :/) and therefore I am stuck at the very same point in xwiki adoption.
What does HTH mean?
Hope This Helps ;-)
-- View this message in context: http://n2.nabble.com/LDAP-Authentication-and-Admin-Approval-tp3173539p317996... Sent from the XWiki- Users mailing list archive at Nabble.com.
_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
On Tue, Jun 30, 2009 at 09:49, Reapepr<[email protected]> wrote:
The server does hash the passwords so that could be the issue, though I had thought the server would hash the incoming password request and then compare it.
Yes it's supposed to be LDAP server job to hash it before testing except if you have a very specific server configuration, I always had hashed paswords in openldap, apachds or activedirectory and never had an issue. The clenat can't know which knd of hash the LDAP server is using internally.
What does HTH mean? -- View this message in context: http://n2.nabble.com/LDAP-Authentication-and-Admin-Approval-tp3173539p317996... Sent from the XWiki- Users mailing list archive at Nabble.com.
_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
Le 30 juin 09 à 11:13, Thomas Mortagne a écrit :
On Tue, Jun 30, 2009 at 09:49, Reapepr<[email protected]> wrote:
The server does hash the passwords so that could be the issue, though I had thought the server would hash the incoming password request and then compare it.
Yes it's supposed to be LDAP server job to hash it before testing except if you have a very specific server configuration, I always had hashed paswords in openldap, apachds or activedirectory and never had an issue. The clenat can't know which knd of hash the LDAP server is using internally.
Yes I understand the architecture choice to lead to plain text pwd in secured channels, and that's fine (clenat can't provide all past and future hash mechanisms, neither the one to use with the connected directory). Nevertheless, I am using OpenLdap (slapd 2.4.11) with no specific configuration, and nevertheless the ldap directiry does not hash the plain text password sent :/ Would you have an idea on which specific option may prevent this behavior, I can make some tests !
What does HTH mean? -- View this message in context: http://n2.nabble.com/LDAP-Authentication-and-Admin-Approval-tp3173539p317996... Sent from the XWiki- Users mailing list archive at Nabble.com.
_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
On Tue, Jun 30, 2009 at 11:34, Christophe GRAVIER<[email protected]> wrote:
Le 30 juin 09 à 11:13, Thomas Mortagne a écrit :
On Tue, Jun 30, 2009 at 09:49, Reapepr<[email protected]> wrote:
The server does hash the passwords so that could be the issue, though I had thought the server would hash the incoming password request and then compare it.
Yes it's supposed to be LDAP server job to hash it before testing except if you have a very specific server configuration, I always had hashed paswords in openldap, apachds or activedirectory and never had an issue. The clenat can't know which knd of hash the LDAP server is using internally.
Yes I understand the architecture choice to lead to plain text pwd in secured channels, and that's fine (clenat can't provide all past and future hash mechanisms, neither the one to use with the connected directory).
Nevertheless, I am using OpenLdap (slapd 2.4.11) with no specific configuration, and nevertheless the ldap directiry does not hash the plain text password sent :/ Would you have an idea on which specific option may prevent this behavior, I can make some tests !
No sorry i always used it with the default conf and never had to configure it.
What does HTH mean? -- View this message in context: http://n2.nabble.com/LDAP-Authentication-and-Admin-Approval-tp3173539p317996... Sent from the XWiki- Users mailing list archive at Nabble.com.
_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
participants (3)
-
Christophe GRAVIER -
Reapepr -
Thomas Mortagne