search

gocd / gocd-ldap-authentication-plugin

LDAP authentication plugin for GoCD
https://www.gocd.org
Apache License 2.0
7 stars 13 forks source link

[Verify Connection] Verify connection failed with errors #40

Open sudhagarc opened 6 years ago

sudhagarc commented 6 years ago

I'm running into the following error when I do "Check connection" for my corporate LDAP authentication. Proper CA certs are installed. For e.g., ldapsearch on the same host with similar parameters works fine. I'm not sure whether I'm overlooking something. Stack trace is attached too. I would appreciate any support in resolving the issue. Please feel free to let me know if additional information is required.

2018-06-27 16:43:45,090 ERROR [qtp662822946-27] LdapPlugin:128 - [Verify Connection] Verify connection failed with errors.
javax.naming.CommunicationException: ldap.thefacebook.com:636
        at com.sun.jndi.ldap.Connection.<init>(Connection.java:216)
        at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:137)
        at com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1615)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2749)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:153)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:83)
        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:313)
        at javax.naming.InitialContext.init(InitialContext.java:244)
        at javax.naming.InitialContext.<init>(InitialContext.java:216)
        at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:101)
        at cd.go.framework.ldap.Ldap.getDirContext(Ldap.java:103)
        at cd.go.framework.ldap.Ldap.authenticate(Ldap.java:158)
        at cd.go.framework.ldap.Ldap.validate(Ldap.java:162)
        at cd.go.authentication.ldap.executor.VerifyConnectionRequestExecutor.verifyConnection(VerifyConnectionRequestExecutor.java:75)
        at cd.go.authentication.ldap.executor.VerifyConnectionRequestExecutor.execute(VerifyConnectionRequestExecutor.java:62)
        at cd.go.authentication.ldap.LdapPlugin.handle(LdapPlugin.java:67)
        at com.thoughtworks.go.plugin.infra.DefaultPluginManager.lambda$submitTo$0(DefaultPluginManager.java:143)
        at com.thoughtworks.go.plugin.infra.FelixGoPluginOSGiFramework.executeActionOnTheService(FelixGoPluginOSGiFramework.java:219)
        at com.thoughtworks.go.plugin.infra.FelixGoPluginOSGiFramework.doOn(FelixGoPluginOSGiFramework.java:202)
        at com.thoughtworks.go.plugin.infra.DefaultPluginManager.submitTo(DefaultPluginManager.java:140)
        at com.thoughtworks.go.plugin.access.PluginRequestHelper.submitRequest(PluginRequestHelper.java:48)
        at com.thoughtworks.go.plugin.access.authorization.AuthorizationExtension.verifyConnection(AuthorizationExtension.java:105)
        at com.thoughtworks.go.server.service.SecurityAuthConfigService.verifyConnection(SecurityAuthConfigService.java:85)
<..snip..>
bdpiprava commented 6 years ago

@sudhagarc -- Please can you provide you LDAP AuthConfig(Make sure to mask sensitive information in it). Just wanted to check if there is any syntactical error which is causing the issue.

Can you also verify that on your GoCD server ldap.thefacebook.com is resolved to the right host IP address?

sudhagarc commented 6 years ago

@bdpiparva Thanks for prompt response. Please find the details below. Btw, I have set log level to DEBUG for ldap plugin, but didn't get additional information in logs to provide here.

    <authConfig id="auth-id-fb-ldap" pluginId="cd.go.authentication.ldap">
      <property>
        <key>Url</key>
        <value>ldaps://ldap.thefacebook.com:636</value>
      </property>
      <property>
        <key>SearchBases</key>
        <value>OU=FacebookAdmins,DC=TheFacebook,DC=com</value>
      </property>
      <property>
        <key>ManagerDN</key>
        <value>CN=#MASKED#,OU=#MASKED#,DC=TheFacebook,DC=com</value>
      </property>
      <property>
        <key>Password</key>
        <encryptedValue> #MASKED# </encryptedValue>
      </property>
      <property>
        <key>UserSearchFilter</key>
        <value>(sAMAccountName={0})</value>
      </property>
      <property>
        <key>UserLoginFilter</key>
        <value>(sAMAccountName={0})</value>
      </property>
      <property>
        <key>DisplayNameAttribute</key>
        <value>displayname</value>
      </property>
      <property>
        <key>EmailAttribute</key>
        <value>mail</value>
      </property>
    </authConfig>

Confirmed that hostname resolves to right host IP address. FWIW, ldapsearch tool using the same hostname and similar parameters on GoCD server works fine.

sudhagarc commented 6 years ago

@bdpiparva Just checking whether there is any update on the above issue. I appreciate it.