MQSeries.net :: View topic - WMB works fine with ApacheDS, with AD doesn't

MQSeries.net

Tech Exchange

Education

Certifications

Library

Info Center

SupportPacs

FAQÂ Â

Usergroups

RSS Feed - WebSphere MQ Support

RSS Feed - Message Broker Support

MQSeries.net Forum Index » WebSphere Message Broker (ACE) Support » WMB works fine with ApacheDS, with AD doesn't

WMB works fine with ApacheDS, with AD doesn't

« View previous topic :: View next topic »

Author

Message

marcin.kasinski

Posted: Mon Dec 15, 2014 2:02 am Post subject: WMB works fine with ApacheDS, with AD doesn't

Sentinel

Joined: 21 Dec 2004
Posts: 850
Location: Poland / Warsaw

Environment:
WMB 8.0.0.3

Hello.

I have simple scenario with HTTP Input node and Basic Auth authentication .

I've created configurable service and I can do LDAP authentication with my local ApacheDS. Everything works fine.

Problem is when I want to change configuration and connect to remote Active Directory.

LDAP authenticaion fails.

In my trace I have:

Code:

( ['MQROOT' : 0xc741c30]
(0x01000000:Name):SecurityException = (
(0x03000000:NameValue):File = 'F:\build\slot1\S800_P\src\SecurityProviders\Ldap\ImbLdapSecurityProvider.cpp' (CHARACTER)
(0x03000000:NameValue):Line = 122 (INTEGER)
(0x03000000:NameValue):Function = 'ImbLdapSecurityProvider::authenticate' (CHARACTER)
(0x03000000:NameValue):Type = 'MessageFlow' (CHARACTER)
(0x03000000:NameValue):Name = '8255f939-4a01-0000-0080-f250e073d7b3' (CHARACTER)
(0x03000000:NameValue):Label = 'ServiceGateway' (CHARACTER)
(0x03000000:NameValue):Catalog = 'BIPmsgs' (CHARACTER)
(0x03000000:NameValue):Severity = 2 (INTEGER)
(0x03000000:NameValue):Number = 2702 (INTEGER)
(0x03000000:NameValue):Text = 'Error Making Security JNI Call: MbLDAPSecurityProvider_authenticate' (CHARACTER)
(0x01000000:Name ):Insert = (
(0x03000000:NameValue):Type = 5 (INTEGER)
(0x03000000:NameValue):Text = 'usernameAndPassword' (CHARACTER)
)
(0x01000000:Name ):Insert = (
(0x03000000:NameValue):Type = 5 (INTEGER)
(0x03000000:NameValue):Text = 'testuser' (CHARACTER)
)
(0x01000000:Name ):Insert = (
(0x03000000:NameValue):Type = 5 (INTEGER)
(0x03000000:NameValue):Text = 'Java/1.8.0_25' (CHARACTER)
)
(0x01000000:Name ):Insert = (
(0x03000000:NameValue):Type = 5 (INTEGER)
(0x03000000:NameValue):Text = 'LDAP' (CHARACTER)
)
)
)

In broker eg console.txt I have:

Code:

WyjĄtek w wĄtku "Thread-34"2014-12-15 09:51:08.583 146 <com.ibm.broker.plugin.MbConfigurationException class:MbLDAPSecurityProvider method:getUserDNFromBrokerBind source:BIPmsgs key:2728 >
2014-12-15 09:51:08.584 146 at com.ibm.broker.securityProviders.MbLDAPSecurityProvider.getUserDNFromBrokerBind(MbLDAPSecurityProvider.java:808)
2014-12-15 09:51:08.584 146 at com.ibm.broker.securityProviders.MbLDAPSecurityProvider.authenticate(MbLDAPSecurityProvider.java:465)

After research I found that :

Bip 2728 means "Exception searching ldap for full DN of user"
Bip 2702 means "Unable to connect to LDAP server using user credentials"

I know that user and password is correct because I've tested communication with Remote AD using my simple java code and I could authenticate user with the same credential.

I assume "Exception searching ldap for full DN of user" is problem.

Can you tell me what this message means and how to fix it ?
_________________
Marcin

martinb

Posted: Fri Dec 19, 2014 9:37 am Post subject:

Master

Joined: 09 Nov 2006
Posts: 210
Location: UK

For message flow security issues you should gather a user trace following a mqsi EG or security reload command.

The Broker deliberately does minimal logging of security issues, (as doing so could aid an attack and could lead to denial of service).

However by enabling user trace the underlying LDAP error codes can be seen.

It is likely that your configuration is setup such that the Broker has to first run a LDAP search to fully resolve the DN of the user ID from the incoming message.

With your local ApacheDS Broker can probably connect anonymously to achieve this.

It is also likely that ActiveDirectory will not be allowing anonymous binds, so you must supply the Broker with credentials to enable it to bind and run this search to resolve the DN. These typically are provided by mqsisetdbparms for the resource "ldap::LDAP"

See Authenticating incoming requests with LDAP

marcin.kasinski

Posted: Fri Dec 19, 2014 12:37 pm Post subject:

Sentinel

Joined: 21 Dec 2004
Posts: 850
Location: Poland / Warsaw

Hello martinb.

You were right. This was anonymous acces problem.

Now everything works fine
_________________
Marcin

Display posts from previous:

Page 1 of 1

MQSeries.net Forum Index » WebSphere Message Broker (ACE) Support » WMB works fine with ApacheDS, with AD doesn't

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Protected by Anti-Spam ACP