struggling with LDAP

classic Classic list List threaded Threaded
8 messages Options
Reply | Threaded
Open this post in threaded view
|

struggling with LDAP

Knapp, Michael

Hi,

 

I have been struggling for weeks to get LDAP to work in Zeppelin now.  Unfortunately for me, I cannot use websockets unless also using LDAP for authentication.  So if I use the anonymous user, I just get a blank home page.  Zeppelin leaves no configuration option to disable web sockets.  My company has their own cert authority, which I have added to my trust store.

 

When I try logging in to Zeppelin using my LDAP, I get “SunCertPathBuilderException: unable to find valid certification path to requested target”.  I have attached the full stack trace.  Note that I am using ldaps over 636.  Basically it’s like saying that my trust store does not identify my LDAP server as a trusted web server.  I am certain that my JKS file is configured right, I have had a co-worker double check it for me. 

 

To troubleshoot, we did:

Export JAVA_OPTS=’-Djavax.net.debug=all’

 

Now we are seeing all of the SSL verbose logs in the zeppelin--…..out file. 

 

I was surprised to see this:

keyStore is : 

keyStore type is : jks

keyStore provider is : 

init keystore

init keymanager of type SunX509

trustStore is: /application/jdk1.8.0_101/jre/lib/security/cacerts

trustStore type is : jks

trustStore provider is : 

init truststore

 

So it looks like the application is not truly using the trust store I have configured. I have this in my zeppelin-site.xml:

 

    <property>

        <name>zeppelin.ssl.truststore.path</name>

        <value>/application/zeppelin/conf/zeppelin-truststore.jks</value>

        <description>Path to truststore relative to Zeppelin configuration directory. Defaults to the keystore path</description>

    </property>

 

It seems to me like the key and trust store are not getting used to connect to the LDAP server.

 

Other factors:

·         I am using a corporate proxy

·         I have dockerized Zeppelin

 

Unrelated comments:

·         Every time I want to test a change in Zeppelin, the NPMInstaller wastes a minute of my life trying to download some files.  It fails every time, and it prints a stack trace in my logs every time.  I would like to disable it, but I looked through your code, there is no way to do it.  Your code also does not provide any opportunity to configure a proxy, so there is no chance this would work for me.  I am even thinking of making a pull request to fix this, it’s quite annoying.  I don’t know why the authors assume that other people are ok with this pattern.

·         I am also getting an exception in the logs stating: No operation matching request path "/api/login;JSESSIONID=92e79cbe-9113-473d-b76a-165666c3f221" is found.  Is this a bug in Zeppelin?

 

 

Does anybody know why this is not working?  Or how I can fix it? 

 

Michael Knapp



The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.


zeppelin-failure.log (14K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

struggling with LDAP

Paul Brenner
Wow, we just setup ldaps today, good timing.

First we got everything worked with just ldap (not secure). Then all we had to do was generate keys for the latest version of java we had installed:

openssl s_client -connect piq-corp-100.corp.placeiq.net:636 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > public.crt

/usr/java/latest/bin/keytool -import -alias piq-corp-100.corp.placeiq.net -keystore /usr/java/latest/jre/lib/security/cacerts -file ./public.crt

And then everything worked fine. I definitely didn’t touch zeppelin-site.xml.

Here is our shiro.ini in case that helps. It is possible that we set up some additional conf elsewhere that would be relevant but I’m having trouble thinking of anything.

[users]
[main]
[users]


[main]

#activeDirectoryRealm = org.apache.zeppelin.server.ActiveDirectoryGroupRealm
activeDirectoryRealm = org.apache.zeppelin.realm.ActiveDirectoryGroupRealm
activeDirectoryRealm.systemUsername = our username
activeDirectoryRealm.systemPassword = our password
activeDirectoryRealm.searchBase = OU=Departments,OU=PlaceIQ,DC=corp,DC=placeiq,DC=net
activeDirectoryRealm.url = ldaps://corp.placeiq.net:636
activeDirectoryRealm.groupRolesMap = "CN=Security Data Science Department,OU=Department Security Groups,OU=Security Groups,OU=PlaceIQ,DC=corp,DC=placeiq,DC=net":"data_science", "CN=Security Development Department,OU=Department Security Groups,OU=Security Groups,OU=PlaceIQ,DC=corp,DC=placeiq,DC=net":"engineering", "CN=Security Infrastructure Department,OU=Department Security Groups,OU=Security Groups,OU=PlaceIQ,DC=corp,DC=placeiq,DC=net":"infra", "CN=Security Research & Development Department,OU=Department Security Groups,OU=Security Groups,OU=PlaceIQ,DC=corp,DC=placeiq,DC=net":"tech_heads", "CN=Security Reporting & Analytics Department,OU=Department Security Groups,OU=Security Groups,OU=PlaceIQ,DC=corp,DC=placeiq,DC=net":"reporting", "CN=Security Product Department,OU=Department Security Groups,OU=Security Groups,OU=PlaceIQ,DC=corp,DC=placeiq,DC=net":"product", "CN=Security Data Operations Department,OU=Department Security Groups,OU=Security Groups,OU=PlaceIQ,DC=corp,DC=placeiq,DC=net":"data_ops"
activeDirectoryRealm.authorizationCachingEnabled = true
activeDirectoryRealm.principalSuffix = @corp.placeiq.net

sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager


securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 86400000
shiro.loginUrl = /api/login

securityManager.realm = $activeDirectoryRealm

[roles]
data_science = data_science
engineering = engineering
infra = infra
tech_heads = tech_heads
reporting = reporting

[urls]
/api/version = anon
/api/interpreter/** = roles[engineering],roles[infra],roles[tech_heads],roles[data_science]
#/** = anon
/** = authc


Paul Brenner
DATA SCIENTIST
(217) 390-3033  

PlaceIQ:Location Data Accuracy

On Tue, Apr 18, 2017 at 3:13 PM Knapp Michael <">Knapp Michael > wrote:

Hi,

 

I have been struggling for weeks to get LDAP to work in Zeppelin now.  Unfortunately for me, I cannot use websockets unless also using LDAP for authentication.  So if I use the anonymous user, I just get a blank home page.  Zeppelin leaves no configuration option to disable web sockets.  My company has their own cert authority, which I have added to my trust store.

 

When I try logging in to Zeppelin using my LDAP, I get “SunCertPathBuilderException: unable to find valid certification path to requested target”.  I have attached the full stack trace.  Note that I am using ldaps over 636.  Basically it’s like saying that my trust store does not identify my LDAP server as a trusted web server.  I am certain that my JKS file is configured right, I have had a co-worker double check it for me. 

 

To troubleshoot, we did:

Export JAVA_OPTS=’-Djavax.net.debug=all’

 

Now we are seeing all of the SSL verbose logs in the zeppelin--…..out file. 

 

I was surprised to see this:

keyStore is : 

keyStore type is : jks

keyStore provider is : 

init keystore

init keymanager of type SunX509

trustStore is: /application/jdk1.8.0_101/jre/lib/security/cacerts

trustStore type is : jks

trustStore provider is : 

init truststore

 

So it looks like the application is not truly using the trust store I have configured. I have this in my zeppelin-site.xml:

 

    <property>

        <name>zeppelin.ssl.truststore.path</name>

        <value>/application/zeppelin/conf/zeppelin-truststore.jks</value>

        <description>Path to truststore relative to Zeppelin configuration directory. Defaults to the keystore path</description>

    </property>

 

It seems to me like the key and trust store are not getting used to connect to the LDAP server.

 

Other factors:

·         I am using a corporate proxy

·         I have dockerized Zeppelin

 

Unrelated comments:

·         Every time I want to test a change in Zeppelin, the NPMInstaller wastes a minute of my life trying to download some files.  It fails every time, and it prints a stack trace in my logs every time.  I would like to disable it, but I looked through your code, there is no way to do it.  Your code also does not provide any opportunity to configure a proxy, so there is no chance this would work for me.  I am even thinking of making a pull request to fix this, it’s quite annoying.  I don’t know why the authors assume that other people are ok with this pattern.

·         I am also getting an exception in the logs stating: No operation matching request path "/api/login;JSESSIONID=92e79cbe-9113-473d-b76a-165666c3f221" is found.  Is this a bug in Zeppelin?

 

 

Does anybody know why this is not working?  Or how I can fix it? 

 

Michael Knapp



The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.


Reply | Threaded
Open this post in threaded view
|

Re: struggling with LDAP

Knapp, Michael

I think this got me one step closer.  I was getting an exception stating there was no trusted path to the ldap server.  Now I am getting the same exception as when I use non-secure LDAP, that I am “forbidden”.  I am getting ldap error code 49, data 52e.

 

From: Paul Brenner <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Tuesday, April 18, 2017 at 4:24 PM
To: "Knapp, Michael" <[hidden email]>, "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: struggling with LDAP

 

BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > public.crt



The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.

Reply | Threaded
Open this post in threaded view
|

Re: struggling with LDAP

Paul Brenner
Have you tried downloading jxplorer (http://jxplorer.org/) and confirming that you can connect to the ldaps server with your credentials? 

Also, when is this error coming up, at start up or when you try to login through zeppelin? When I switched to ldap instead of logging in as pbrenner for my user I had to use [hidden email]. Had to add “activeDirectoryRealm.principalSuffix“ to shiro.ini to get around that. 
Paul Brenner
DATA SCIENTIST
(217) 390-3033  

PlaceIQ:Location Data Accuracy

On Wed, Apr 19, 2017 at 11:07 AM Knapp Michael <[hidden email]> wrote:

I think this got me one step closer.  I was getting an exception stating there was no trusted path to the ldap server.  Now I am getting the same exception as when I use non-secure LDAP, that I am “forbidden”.  I am getting ldap error code 49, data 52e.

 

From: Paul Brenner <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Tuesday, April 18, 2017 at 4:24 PM
To: "Knapp, Michael" <[hidden email]>, "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: struggling with LDAP

 

BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > public.crt



The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.

Reply | Threaded
Open this post in threaded view
|

Re: struggling with LDAP

Knapp, Michael

My mac is configured to forbid installing software by unidentified developers.  I cannot install jxplorer.  Is there an alternative?

 

The error is coming up when I try to login.  I tried using the principalSuffix, it did not change things.

 

I discovered a co-worker had LDAP working for a different LDAP server under different conditions.  He told me that he is logging in as the system account from the UI, which I had never tried or thought of before.  I was always using my personal username and password, and figured that the system account should just be used on the backend to interact with LDAP.

 

Is that the expected way for things to work?  Like the user should enter the system username and password on the front end instead of their own?  Because I don’t think that will be an acceptable long term solution in my case. 

 

I also noticed that if I add “admin = *” to my roles section, that alone breaks the application, and I have no idea why.  I’m having trouble finding documentation on what is expected in the roles section of the shiro file.

 

When I did get it to work:

·         I was logging in as the system user on the front end.  Any other user fails.

·         I did NOT have the principalSuffix defined, adding it seems to break things

·         I was able to use ldap or ldaps.

 

 

 

 

 

From: Paul Brenner <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Wednesday, April 19, 2017 at 11:21 AM
To: "Knapp, Michael" <[hidden email]>, "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: Re: struggling with LDAP

 

https://share.polymail.io/v2/z/a/NThmNzdlMmY1M2Q4/4ULIk0PWssT9m_JkSH0DABBQXnzuCgzhdMyhnPBuhOSlesqCbWa29gOfWIHfzMl_KmkEjTygnnHE5ULbT4hkfGCo3ldYc1D21y4Or8tQkiH0VV8v4hCOt8a1pJ5LlTVrS5NQBnKWt7rJN2m_oQDh20giVWw=.png

Have you tried downloading jxplorer (http://jxplorer.org/) and confirming that you can connect to the ldaps server with your credentials? 

 

Also, when is this error coming up, at start up or when you try to login through zeppelin? When I switched to ldap instead of logging in as pbrenner for my user I had to use [hidden email]. Had to add “activeDirectoryRealm.principalSuffix“ to shiro.ini to get around that. 

https://ci3.googleusercontent.com/proxy/tFn1I-GEOnccUtv8DHHEc49-6g3x3CbuQKzbfl2Z1BObEy0Qz6QebJimpP96TK3Za5MXwXTuwBZaobKp22nYAG3NdxAC0Q=s0-d-e1-ft#https://marketing.placeiq.net/images/placeiq.png

Paul Brenner

https://ci4.googleusercontent.com/proxy/490PXYv9O6OiIp_DL4vuabJqVn53fMon5xNYZdftCVea9ySR2LcFDHe6Cdntb2G68uDAuA6FgLny8wKWLFWpsrPAt_FtLaE=s0-d-e1-ft#https://marketing.placeiq.net/images/twitter1.png

https://ci3.googleusercontent.com/proxy/fztHf1lRKLQYcAxebqfp2PYXCwVap3GobHVIbyp0j3NcuJOY16bUAZBibVOFf-fd1GsiuhrOfYy6dSwhlCwWU8ZUlw9OX5I=s0-d-e1-ft#https://marketing.placeiq.net/images/facebook.png

https://ci5.googleusercontent.com/proxy/H26ThD7R6DOqxoLTgzi6k5SMrHoF2Tj44xI_7XlD9KfOIiGwe1WIMc5iQBxUBA9EuIyJMdaRXrhZTOrnkrn8O9Rf1FP9UQU=s0-d-e1-ft#https://marketing.placeiq.net/images/linkedin.png

DATA SCIENTIST

(217) 390-3033  


aceIQ:Location Data Accuracy

 

On Wed, Apr 19, 2017 at 11:07 AM Knapp Michael <[hidden email]> wrote:

I think this got me one step closer.  I was getting an exception stating there was no trusted path to the ldap server.  Now I am getting the same exception as when I use non-secure LDAP, that I am “forbidden”.  I am getting ldap error code 49, data 52e.

 

From: Paul Brenner <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Tuesday, April 18, 2017 at 4:24 PM
To: "Knapp, Michael" <[hidden email]>, "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: struggling with LDAP

 

BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > public.crt

 


The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.



The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.

Reply | Threaded
Open this post in threaded view
|

Re: struggling with LDAP

Paul Brenner
I haven’t used any alternative tools for logging into ldap to test your settings but you could look into:





The fact that your system user is found about not your personal account makes me suspicious of searchBase and groupRolesMap. 

Do you have “activeDirectoryRealm.searchBase” and “activeDirectoryRealm.groupRolesMap” appropriately enabled to match what your ldap server expects? 

For our ldap setup we use:
activeDirectoryRealm.searchBase = OU=Departments,OU=PlaceIQ,DC=corp,DC=placeiq,DC=net

I also included:
activeDirectoryRealm.groupRolesMap = "CN=Security Data Science Department,OU=Department Security Groups,OU=Security Groups,OU=PlaceIQ,DC=corp,DC=placeiq,DC=net":”data_science"

[roles]
data_science = data_science

[urls]
/api/interpreter/** = roles[data_science]
/** = authc 

Paul Brenner
DATA SCIENTIST
(217) 390-3033  

PlaceIQ:Location Data Accuracy

On Wed, Apr 19, 2017 at 1:20 PM Knapp Michael <[hidden email]> wrote:

My mac is configured to forbid installing software by unidentified developers.  I cannot install jxplorer.  Is there an alternative?

 

The error is coming up when I try to login.  I tried using the principalSuffix, it did not change things.

 

I discovered a co-worker had LDAP working for a different LDAP server under different conditions.  He told me that he is logging in as the system account from the UI, which I had never tried or thought of before.  I was always using my personal username and password, and figured that the system account should just be used on the backend to interact with LDAP.

 

Is that the expected way for things to work?  Like the user should enter the system username and password on the front end instead of their own?  Because I don’t think that will be an acceptable long term solution in my case. 

 

I also noticed that if I add “admin = *” to my roles section, that alone breaks the application, and I have no idea why.  I’m having trouble finding documentation on what is expected in the roles section of the shiro file.

 

When I did get it to work:

·         I was logging in as the system user on the front end.  Any other user fails.

·         I did NOT have the principalSuffix defined, adding it seems to break things

·         I was able to use ldap or ldaps.

 

 

 

 

 

From: Paul Brenner <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Wednesday, April 19, 2017 at 11:21 AM
To: "Knapp, Michael" <[hidden email]>, "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: Re: struggling with LDAP

 

https://share.polymail.io/v2/z/a/NThmNzdlMmY1M2Q4/4ULIk0PWssT9m_JkSH0DABBQXnzuCgzhdMyhnPBuhOSlesqCbWa29gOfWIHfzMl_KmkEjTygnnHE5ULbT4hkfGCo3ldYc1D21y4Or8tQkiH0VV8v4hCOt8a1pJ5LlTVrS5NQBnKWt7rJN2m_oQDh20giVWw=.png

Have you tried downloading jxplorer (http://jxplorer.org/) and confirming that you can connect to the ldaps server with your credentials? 

 

Also, when is this error coming up, at start up or when you try to login through zeppelin? When I switched to ldap instead of logging in as pbrenner for my user I had to use [hidden email]. Had to add “activeDirectoryRealm.principalSuffix“ to shiro.ini to get around that. 

https://ci3.googleusercontent.com/proxy/tFn1I-GEOnccUtv8DHHEc49-6g3x3CbuQKzbfl2Z1BObEy0Qz6QebJimpP96TK3Za5MXwXTuwBZaobKp22nYAG3NdxAC0Q=s0-d-e1-ft#https://marketing.placeiq.net/images/placeiq.png

Paul Brenner

https://ci4.googleusercontent.com/proxy/490PXYv9O6OiIp_DL4vuabJqVn53fMon5xNYZdftCVea9ySR2LcFDHe6Cdntb2G68uDAuA6FgLny8wKWLFWpsrPAt_FtLaE=s0-d-e1-ft#https://marketing.placeiq.net/images/twitter1.png

https://ci3.googleusercontent.com/proxy/fztHf1lRKLQYcAxebqfp2PYXCwVap3GobHVIbyp0j3NcuJOY16bUAZBibVOFf-fd1GsiuhrOfYy6dSwhlCwWU8ZUlw9OX5I=s0-d-e1-ft#https://marketing.placeiq.net/images/facebook.png

https://ci5.googleusercontent.com/proxy/H26ThD7R6DOqxoLTgzi6k5SMrHoF2Tj44xI_7XlD9KfOIiGwe1WIMc5iQBxUBA9EuIyJMdaRXrhZTOrnkrn8O9Rf1FP9UQU=s0-d-e1-ft#https://marketing.placeiq.net/images/linkedin.png

DATA SCIENTIST

(217) 390-3033  


aceIQ:Location Data Accuracy

 

On Wed, Apr 19, 2017 at 11:07 AM Knapp Michael <[hidden email]> wrote:

I think this got me one step closer.  I was getting an exception stating there was no trusted path to the ldap server.  Now I am getting the same exception as when I use non-secure LDAP, that I am “forbidden”.  I am getting ldap error code 49, data 52e.

 

From: Paul Brenner <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Tuesday, April 18, 2017 at 4:24 PM
To: "Knapp, Michael" <[hidden email]>, "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: struggling with LDAP

 

BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > public.crt

 


The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.



The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.

Reply | Threaded
Open this post in threaded view
|

Re: struggling with LDAP

Knapp, Michael
In reply to this post by Knapp, Michael

I finally got LDAP to work.  This was one of the most difficult tasks I have ever had.  I spent about three weeks trying to make this work!

 

One very hard lesson learned:  LDAP/JNDI code will not use the truststore that people pass into zeppelin-site.xml.  It will only use the JRE’s cacerts file.  This cost me so much time, it should definitely be mentioned in the Zeppelin documentation.

 

I also think the documentation should offer more help on how to determine what values you need in the shiro.ini file.  I eventually figured out there was a principalSuffix I needed to use, but the value was not my first guess at all.  Some guidance on how to use ldapsearch would save people weeks of work here.

 

Also the shiro logging is TERRIBLE!  It offers almost no help when it comes time to troubleshoot things and discover where it went wrong.  This is true even when it is set to trace.

 

 

From: "Knapp, Michael" <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Wednesday, April 19, 2017 at 1:20 PM
To: "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: Re: struggling with LDAP

 

My mac is configured to forbid installing software by unidentified developers.  I cannot install jxplorer.  Is there an alternative?

 

The error is coming up when I try to login.  I tried using the principalSuffix, it did not change things.

 

I discovered a co-worker had LDAP working for a different LDAP server under different conditions.  He told me that he is logging in as the system account from the UI, which I had never tried or thought of before.  I was always using my personal username and password, and figured that the system account should just be used on the backend to interact with LDAP.

 

Is that the expected way for things to work?  Like the user should enter the system username and password on the front end instead of their own?  Because I don’t think that will be an acceptable long term solution in my case. 

 

I also noticed that if I add “admin = *” to my roles section, that alone breaks the application, and I have no idea why.  I’m having trouble finding documentation on what is expected in the roles section of the shiro file.

 

When I did get it to work:

·         I was logging in as the system user on the front end.  Any other user fails.

·         I did NOT have the principalSuffix defined, adding it seems to break things

·         I was able to use ldap or ldaps.

 

 

 

 

 

From: Paul Brenner <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Wednesday, April 19, 2017 at 11:21 AM
To: "Knapp, Michael" <[hidden email]>, "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: Re: struggling with LDAP

 

ttps://share.polymail.io/v2/z/a/NThmNzdlMmY1M2Q4/4ULIk0PWssT9m_JkSH0DABBQXnzuCgzhdMyhnPBuhOSlesqCbWa29gO

Have you tried downloading jxplorer (http://jxplorer.org/) and confirming that you can connect to the ldaps server with your credentials? 

 

Also, when is this error coming up, at start up or when you try to login through zeppelin? When I switched to ldap instead of logging in as pbrenner for my user I had to use [hidden email]. Had to add “activeDirectoryRealm.principalSuffix“ to shiro.ini to get around that. 

ttps://ci3.googleusercontent.com/proxy/tFn1I-GEOnccUtv8DHHEc49-6g3x3CbuQKzbfl2Z1BObEy0Qz6QebJimpP96TK3Za

Paul Brenner

ttps://ci4.googleusercontent.com/proxy/490PXYv9O6OiIp_DL4vuabJqVn53fMon5xNYZdftCVea9ySR2LcFDHe6Cdntb2G68

ttps://ci3.googleusercontent.com/proxy/fztHf1lRKLQYcAxebqfp2PYXCwVap3GobHVIbyp0j3NcuJOY16bUAZBibVOFf-fd1

ttps://ci5.googleusercontent.com/proxy/H26ThD7R6DOqxoLTgzi6k5SMrHoF2Tj44xI_7XlD9KfOIiGwe1WIMc5iQBxUBA9Eu

DATA SCIENTIST

(217) 390-3033  


ceIQ:Location Data Accuracy

 

On Wed, Apr 19, 2017 at 11:07 AM Knapp Michael <[hidden email]> wrote:


I think this got me one step closer.  I was getting an exception stating there was no trusted path to the ldap server.  Now I am getting the same exception as when I use non-secure LDAP, that I am “forbidden”.  I am getting ldap error code 49, data 52e.

 

From: Paul Brenner <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Tuesday, April 18, 2017 at 4:24 PM
To: "Knapp, Michael" <[hidden email]>, "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: struggling with LDAP

 

BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > public.crt

 


The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.

 


The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.



The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.

Reply | Threaded
Open this post in threaded view
|

Re: struggling with LDAP

moon
Administrator
Hi Paul, Knapp,

Please don't mind update LDAP documentation if you would like to.
That would save many people!

Documentation (published in zeppelin website) is also part of opensource and you can update them by making pull request. I think related file is https://github.com/apache/zeppelin/blob/master/docs/security/shiroauthentication.md#ldap.
Let me know if you need help on making pull request.

Thanks,
moon

On Thu, Apr 20, 2017 at 3:18 PM Knapp, Michael <[hidden email]> wrote:

I finally got LDAP to work.  This was one of the most difficult tasks I have ever had.  I spent about three weeks trying to make this work!

 

One very hard lesson learned:  LDAP/JNDI code will not use the truststore that people pass into zeppelin-site.xml.  It will only use the JRE’s cacerts file.  This cost me so much time, it should definitely be mentioned in the Zeppelin documentation.

 

I also think the documentation should offer more help on how to determine what values you need in the shiro.ini file.  I eventually figured out there was a principalSuffix I needed to use, but the value was not my first guess at all.  Some guidance on how to use ldapsearch would save people weeks of work here.

 

Also the shiro logging is TERRIBLE!  It offers almost no help when it comes time to troubleshoot things and discover where it went wrong.  This is true even when it is set to trace.

 

 

From: "Knapp, Michael" <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Wednesday, April 19, 2017 at 1:20 PM
To: "[hidden email]" <[hidden email]>


Cc: "Krishna, Krish" <[hidden email]>
Subject: Re: struggling with LDAP

 

My mac is configured to forbid installing software by unidentified developers.  I cannot install jxplorer.  Is there an alternative?

 

The error is coming up when I try to login.  I tried using the principalSuffix, it did not change things.

 

I discovered a co-worker had LDAP working for a different LDAP server under different conditions.  He told me that he is logging in as the system account from the UI, which I had never tried or thought of before.  I was always using my personal username and password, and figured that the system account should just be used on the backend to interact with LDAP.

 

Is that the expected way for things to work?  Like the user should enter the system username and password on the front end instead of their own?  Because I don’t think that will be an acceptable long term solution in my case. 

 

I also noticed that if I add “admin = *” to my roles section, that alone breaks the application, and I have no idea why.  I’m having trouble finding documentation on what is expected in the roles section of the shiro file.

 

When I did get it to work:

·         I was logging in as the system user on the front end.  Any other user fails.

·         I did NOT have the principalSuffix defined, adding it seems to break things

·         I was able to use ldap or ldaps.

 

 

 

 

 

From: Paul Brenner <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Wednesday, April 19, 2017 at 11:21 AM
To: "Knapp, Michael" <[hidden email]>, "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: Re: struggling with LDAP

 

ttps://share.polymail.io/v2/z/a/NThmNzdlMmY1M2Q4/4ULIk0PWssT9m_JkSH0DABBQXnzuCgzhdMyhnPBuhOSlesqCbWa29gO

Have you tried downloading jxplorer (http://jxplorer.org/) and confirming that you can connect to the ldaps server with your credentials? 

 

Also, when is this error coming up, at start up or when you try to login through zeppelin? When I switched to ldap instead of logging in as pbrenner for my user I had to use [hidden email]. Had to add “activeDirectoryRealm.principalSuffix“ to shiro.ini to get around that. 

ttps://ci3.googleusercontent.com/proxy/tFn1I-GEOnccUtv8DHHEc49-6g3x3CbuQKzbfl2Z1BObEy0Qz6QebJimpP96TK3Za

Paul Brenner

ttps://ci4.googleusercontent.com/proxy/490PXYv9O6OiIp_DL4vuabJqVn53fMon5xNYZdftCVea9ySR2LcFDHe6Cdntb2G68

ttps://ci3.googleusercontent.com/proxy/fztHf1lRKLQYcAxebqfp2PYXCwVap3GobHVIbyp0j3NcuJOY16bUAZBibVOFf-fd1

ttps://ci5.googleusercontent.com/proxy/H26ThD7R6DOqxoLTgzi6k5SMrHoF2Tj44xI_7XlD9KfOIiGwe1WIMc5iQBxUBA9Eu

DATA SCIENTIST

<a href="tel:(217)%20390-3033" value="+12173903033" target="_blank">(217) 390-3033  


ceIQ:Location Data Accuracy

 

On Wed, Apr 19, 2017 at 11:07 AM Knapp Michael <[hidden email]> wrote:


I think this got me one step closer.  I was getting an exception stating there was no trusted path to the ldap server.  Now I am getting the same exception as when I use non-secure LDAP, that I am “forbidden”.  I am getting ldap error code 49, data 52e.

 

From: Paul Brenner <[hidden email]>
Reply-To: "[hidden email]" <[hidden email]>
Date: Tuesday, April 18, 2017 at 4:24 PM
To: "Knapp, Michael" <[hidden email]>, "[hidden email]" <[hidden email]>
Cc: "Krishna, Krish" <[hidden email]>
Subject: struggling with LDAP

 

BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > public.crt

 


The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.

 


The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.



The information contained in this e-mail is confidential and/or proprietary to Capital One and/or its affiliates and may only be used solely in performance of work or services for Capital One. The information transmitted herewith is intended only for use by the individual or entity to which it is addressed. If the reader of this message is not the intended recipient, you are hereby notified that any review, retransmission, dissemination, distribution, copying or other use of, or taking of any action in reliance upon this information is strictly prohibited. If you have received this communication in error, please contact the sender and delete the material from your computer.