<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hello list,<div><br></div><div>I’m having some issues with ldap authentication, hope someone can shed some light</div><div><br></div><div>After updating from 4.4.3 to 4.4.6, I could not login to our test midpoint anymore using our LDAP server.</div><div>I had to use the /auth/emergency to log in using local administrator.</div><div><br></div><div>This is the log I was getting:</div><div><span style="color: rgb(204, 204, 220); font-family: "Roboto Mono", monospace; font-variant-ligatures: normal; letter-spacing: 0.15px; orphans: 2; widows: 2; white-space: pre-wrap; background-color: rgb(39, 42, 48); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">2023-10-16T17:50:50.669 ERROR [com.evolveum.midpoint.web.security.provider.MidPointAbstractAuthenticationProvider] (http-nio-8080-exec-10) Authentication (runtime) error: web.security.provider.invalid
org.springframework.security.authentication.AuthenticationServiceException: web.security.provider.invalid</span></div><div><br></div><div>We haven’t configured authentication using security policy yet, we were using the old spring security ldap configuration.</div><div><br></div><div>So I tried configuring our ldap using security policy, since the spring security configuration is not supported anymore.</div><div>It didn’t work either, here’s the log</div><div><span style="color: rgb(204, 204, 220); font-family: "Roboto Mono", monospace; font-variant-ligatures: normal; letter-spacing: 0.15px; orphans: 2; widows: 2; white-space: pre-wrap; background-color: rgb(39, 42, 48); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">2023-10-16T20:41:38.107 ERROR [com.evolveum.midpoint.web.security.provider.MidPointAbstractAuthenticationProvider] (http-nio-8080-exec-2) Authentication (runtime) error: Invalid username and/or password.
org.springframework.security.authentication.BadCredentialsException: Invalid username and/or password.</span></div><div><span style="color: rgb(204, 204, 220); font-family: "Roboto Mono", monospace; font-variant-ligatures: normal; letter-spacing: 0.15px; orphans: 2; widows: 2; white-space: pre-wrap; background-color: rgb(39, 42, 48); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">…</span></div><div><span style="color: rgb(204, 204, 220); font-family: "Roboto Mono", monospace; font-variant-ligatures: normal; letter-spacing: 0.15px; orphans: 2; widows: 2; white-space: pre-wrap; background-color: rgb(39, 42, 48); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"><span style="font-variant-ligatures: normal; letter-spacing: 0.15px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Caused by: org.springframework.security.authentication.InternalAuthenticationServiceException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09044E, comment: AcceptSecurityContext error, data 52e, v2580]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09044E, comment: AcceptSecurityContext error, data 52e, v2580]</span></span></div><div><br></div><div>I’m very sure the users and passwords for both bind user and the login form are correct. If I rollback everything it works again.</div><div>Emergency login using internal database still works.</div><div>Below is my authentication configuration, pretty simple. </div><div><br></div><div>Thanks in advance for any help on this.</div><div><div style="background-color: rgb(43, 43, 43); color: rgb(169, 183, 198);"><pre style="font-family: "Fira Code", monospace;"><span style="color: rgb(84, 168, 87);"><authentication><br></span><span style="color: rgb(84, 168, 87);"> </span><span style="color: rgb(53, 159, 244);"><modules><br></span><span style="color: rgb(53, 159, 244);"> </span><span style="color: rgb(110, 126, 217);"><loginForm><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(23, 147, 135);"><name></span>internalLoginForm<span style="color: rgb(23, 147, 135);"></name><br></span><span style="color: rgb(23, 147, 135);"> <description></span>Internal username/password authentication, default user password, login form<span style="color: rgb(23, 147, 135);"></description><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(110, 126, 217);"></loginForm><br></span><span style="color: rgb(110, 126, 217);"> <httpBasic><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(23, 147, 135);"><name></span>internalHttpBasic<span style="color: rgb(23, 147, 135);"></name><br></span><span style="color: rgb(23, 147, 135);"> <description></span>Http basic username/password authentication, default user password<span style="color: rgb(23, 147, 135);"></description><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(110, 126, 217);"></httpBasic><br></span><span style="color: rgb(110, 126, 217);"> <ldap><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(23, 147, 135);"><name></span>ldapAuth<span style="color: rgb(23, 147, 135);"></name><br></span><span style="color: rgb(23, 147, 135);"> <host></span>ldap://serverip:389/DC=midpointhml,DC=local<span style="color: rgb(23, 147, 135);"></host><br></span><span style="color: rgb(23, 147, 135);"> <userDn></span>CN=bind,OU=BIND,DC=midpointhml,DC=local<span style="color: rgb(23, 147, 135);"></userDn><br></span><span style="color: rgb(23, 147, 135);"> <userPassword><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(232, 186, 54);"><</span><span style="color: rgb(152, 118, 170);">t</span><span style="color: rgb(232, 191, 106);">:clearValue</span><span style="color: rgb(232, 186, 54);">></span>testpassword<span style="color: rgb(232, 186, 54);"></</span><span style="color: rgb(152, 118, 170);">t</span><span style="color: rgb(232, 191, 106);">:clearValue</span><span style="color: rgb(232, 186, 54);">><br></span><span style="color: rgb(232, 186, 54);"> </span><span style="color: rgb(23, 147, 135);"></userPassword><br></span><span style="color: rgb(23, 147, 135);"> <search><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(232, 186, 54);"><pattern></span>(sAMAccountName={0})<span style="color: rgb(232, 186, 54);"></pattern><br></span><span style="color: rgb(232, 186, 54);"> <subtree></span>true<span style="color: rgb(232, 186, 54);"></subtree><br></span><span style="color: rgb(232, 186, 54);"> </span><span style="color: rgb(23, 147, 135);"></search><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(110, 126, 217);"></ldap><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(53, 159, 244);"></modules><br></span><span style="color: rgb(53, 159, 244);"> <sequence><br></span><span style="color: rgb(53, 159, 244);"> </span><span style="color: rgb(110, 126, 217);"><name></span>gui-ldap<span style="color: rgb(110, 126, 217);"></name><br></span><span style="color: rgb(110, 126, 217);"> <channel><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(23, 147, 135);"><channelId></span>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user<span style="color: rgb(23, 147, 135);"></channelId><br></span><span style="color: rgb(23, 147, 135);"> <default></span>true<span style="color: rgb(23, 147, 135);"></default><br></span><span style="color: rgb(23, 147, 135);"> <urlSuffix></span>default<span style="color: rgb(23, 147, 135);"></urlSuffix><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(110, 126, 217);"></channel><br></span><span style="color: rgb(110, 126, 217);"> <module><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(23, 147, 135);"><name></span>ldapAuth<span style="color: rgb(23, 147, 135);"></name><br></span><span style="color: rgb(23, 147, 135);"> <order></span>30<span style="color: rgb(23, 147, 135);"></order><br></span><span style="color: rgb(23, 147, 135);"> <necessity></span>sufficient<span style="color: rgb(23, 147, 135);"></necessity><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(110, 126, 217);"></module><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(53, 159, 244);"></sequence><br></span><span style="color: rgb(53, 159, 244);"> <sequence><br></span><span style="color: rgb(53, 159, 244);"> </span><span style="color: rgb(110, 126, 217);"><name></span>admin-gui-emergency<span style="color: rgb(110, 126, 217);"></name><br></span><span style="color: rgb(110, 126, 217);"> <description><br></span><span style="color: rgb(110, 126, 217);"> </span>Special GUI authentication sequence that is using just the internal user password.<br> It is used only in emergency.<br> <span style="color: rgb(110, 126, 217);"></description><br></span><span style="color: rgb(110, 126, 217);"> <channel><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(23, 147, 135);"><channelId></span>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user<span style="color: rgb(23, 147, 135);"></channelId><br></span><span style="color: rgb(23, 147, 135);"> <default></span>false<span style="color: rgb(23, 147, 135);"></default><br></span><span style="color: rgb(23, 147, 135);"> <urlSuffix></span>admin<span style="color: rgb(23, 147, 135);"></urlSuffix><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(110, 126, 217);"></channel><br></span><span style="color: rgb(110, 126, 217);"> <requireAssignmentTarget </span><span style="color: rgb(186, 186, 186);">oid</span><span style="color: rgb(106, 135, 89);">="00000000-0000-0000-0000-000000000004" </span><span style="color: rgb(186, 186, 186);">relation</span><span style="color: rgb(106, 135, 89);">="org:default" </span><span style="color: rgb(186, 186, 186);">type</span><span style="color: rgb(106, 135, 89);">="c:RoleType"</span><span style="color: rgb(110, 126, 217);">><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(128, 128, 128);"><!-- Superuser --><br></span><span style="color: rgb(128, 128, 128);"> </span><span style="color: rgb(110, 126, 217);"></requireAssignmentTarget><br></span><span style="color: rgb(110, 126, 217);"> <module><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(23, 147, 135);"><name></span>internalLoginForm<span style="color: rgb(23, 147, 135);"></name><br></span><span style="color: rgb(23, 147, 135);"> <order></span>1<span style="color: rgb(23, 147, 135);"></order><br></span><span style="color: rgb(23, 147, 135);"> <necessity></span>sufficient<span style="color: rgb(23, 147, 135);"></necessity><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(110, 126, 217);"></module><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(53, 159, 244);"></sequence><br></span><span style="color: rgb(53, 159, 244);"> <sequence><br></span><span style="color: rgb(53, 159, 244);"> </span><span style="color: rgb(110, 126, 217);"><name></span>rest-basic<span style="color: rgb(110, 126, 217);"></name><br></span><span style="color: rgb(110, 126, 217);"> <channel><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(23, 147, 135);"><channelId></span>http://midpoint.evolveum.com/xml/ns/public/common/channels-3#rest<span style="color: rgb(23, 147, 135);"></channelId><br></span><span style="color: rgb(23, 147, 135);"> <default></span>true<span style="color: rgb(23, 147, 135);"></default><br></span><span style="color: rgb(23, 147, 135);"> <urlSuffix></span>default<span style="color: rgb(23, 147, 135);"></urlSuffix><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(110, 126, 217);"></channel><br></span><span style="color: rgb(110, 126, 217);"> <module><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(23, 147, 135);"><name></span>internalHttpBasic<span style="color: rgb(23, 147, 135);"></name><br></span><span style="color: rgb(23, 147, 135);"> <order></span>1<span style="color: rgb(23, 147, 135);"></order><br></span><span style="color: rgb(23, 147, 135);"> <necessity></span>sufficient<span style="color: rgb(23, 147, 135);"></necessity><br></span><span style="color: rgb(23, 147, 135);"> </span><span style="color: rgb(110, 126, 217);"></module><br></span><span style="color: rgb(110, 126, 217);"> </span><span style="color: rgb(53, 159, 244);"></sequence><br></span><span style="color: rgb(53, 159, 244);"> <ignoredLocalPath></span>/actuator<span style="color: rgb(53, 159, 244);"></ignoredLocalPath><br></span><span style="color: rgb(53, 159, 244);"> <ignoredLocalPath></span>/actuator/health<span style="color: rgb(53, 159, 244);"></ignoredLocalPath><br></span><span style="color: rgb(84, 168, 87);"></authentication></span></pre></div></div><div><br></div></body></html>