[ome-users] LDAP Config for PosixGroups
Andreas Mueller
Andreas.Mueller at Biologie.Uni-Osnabrueck.DE
Thu Jan 31 15:10:15 GMT 2019
> Also could you first try minimum config please
> https://docs.openmicroscopy.org/omero/5.4.10/sysadmins/server-ldap.html#minimum-configuration
> It should help to narrow down where the problem is
>
>
Hi Ola,
[omero at omero3 OMERO.server]$ bin/omero config get | grep ldap
omero.ldap.base=ou=people,dc=uni-osnabrueck,dc=de
omero.ldap.config=true
omero.ldap.urls=ldaps://ldap.uni-osnabrueck.de
after:
$ bin/omero ldap create andrmuel
I got a lot of error's ... see error_ldap.txt (attached)
_____________
[omero at omero3 OMERO.server]$ bin/omero config get | grep ldap
omero.ldap.base=ou=people,dc=uni-osnabrueck,dc=de
omero.ldap.config=true
omero.ldap.urls=ldaps://ldap.uni-osnabrueck.de
omero.ldap.user_mapping=omeName=uid
after:
$ bin/omero ldap create andrmuel
I got only a few lines, ..you see all here:
> not-null property references a null or transient value:
> ome.model.meta.Experimenter.firstName; nested exception is
> org.hibernate.PropertyValueException: not-null property references a
> null or transient value: ome.model.meta.Experimenter.firstName
It seem's that the login process can not read the hidden attributes
givenName and sn
I've tried this:
bin/omero config set omero.ldap.user_mapping omeName=uid,firstName=gecos,lastName=gidNumber
ok, that makes no sense .. but - only for a test (gecos und gidNumber
are not hidden)
And - HURRAR - I can log in !!!
But: with the wrong firstName, the wrong lastName and everyone can
login to the system .. I've no restrictions.
____
I think omero has to login to the ldap-system with the dn of the user
and read *then* the private (hidden) attributes, because only the user
can read the own attributes.
> Can you fix that ????
___
Next step: how can I restrict the access ?
--- Thanks A Lot For Your Help !!! ---
Andreas
-------------- next part --------------
tmero3 OMERO.server]$ bin/omero ldap create andrmuel
Using session for root at localhost:4064. Idle timeout: 10 min. Current group: system
Traceback (most recent call last):
File "bin/omero", line 130, in <module>
rv = omero.cli.argv()
File "/home/omero/OMERO.server-5.4.9-ice36-b101/lib/python/omero/cli.py", line 1620, in argv
cli.invoke(args[1:])
File "/home/omero/OMERO.server-5.4.9-ice36-b101/lib/python/omero/cli.py", line 1095, in invoke
stop = self.onecmd(line, previous_args)
File "/home/omero/OMERO.server-5.4.9-ice36-b101/lib/python/omero/cli.py", line 1172, in onecmd
self.execute(line, previous_args)
File "/home/omero/OMERO.server-5.4.9-ice36-b101/lib/python/omero/cli.py", line 1254, in execute
args.func(args)
File "/home/omero/OMERO.server-5.4.9-ice36-b101/lib/python/omero/cli.py", line 644, in _check_admin
return func(*args, **kwargs)
File "/home/omero/OMERO.server-5.4.9-ice36-b101/lib/python/omero/plugins/ldap.py", line 249, in create
exp = ildap.createUser(args.username)
File "/home/omero/OMERO.server-5.4.9-ice36-b101/lib/python/omero_api_ILdap_ice.py", line 741, in createUser
return _M_omero.api.ILdap._op_createUser.invoke(self, ((username, ), _ctx))
omero.ApiUsageException: exception ::omero::ApiUsageException
{
serverStackTrace = ome.conditions.ApiUsageException: Cannot find unique user DistinguishedName: found=0
at ome.logic.LdapImpl.mapUserName(LdapImpl.java:213)
at ome.logic.LdapImpl.findExperimenter(LdapImpl.java:174)
at ome.logic.LdapImpl.createUser(LdapImpl.java:477)
at ome.logic.LdapImpl.createUser(LdapImpl.java:439)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
at ome.security.basic.EventHandler.invoke(EventHandler.java:154)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at org.springframework.orm.hibernate3.HibernateInterceptor.invoke(HibernateInterceptor.java:111)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:108)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at ome.tools.hibernate.ProxyCleanupFilter$Interceptor.invoke(ProxyCleanupFilter.java:249)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at ome.services.util.ServiceHandler.invoke(ServiceHandler.java:121)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
at com.sun.proxy.$Proxy93.createUser(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
at ome.security.basic.BasicSecurityWiring.invoke(BasicSecurityWiring.java:93)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at ome.services.blitz.fire.AopContextInitializer.invoke(AopContextInitializer.java:43)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
at com.sun.proxy.$Proxy93.createUser(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at ome.services.blitz.util.IceMethodInvoker.invoke(IceMethodInvoker.java:172)
at ome.services.throttling.Callback.run(Callback.java:56)
at ome.services.throttling.InThreadThrottlingStrategy.callInvokerOnRawArgs(InThreadThrottlingStrategy.java:56)
at ome.services.blitz.impl.AbstractAmdServant.callInvokerOnRawArgs(AbstractAmdServant.java:140)
at ome.services.blitz.impl.LdapI.createUser_async(LdapI.java:116)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
at omero.cmd.CallContext.invoke(CallContext.java:85)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
at com.sun.proxy.$Proxy94.createUser_async(Unknown Source)
at omero.api._ILdapTie.createUser_async(_ILdapTie.java:66)
at omero.api._ILdapDisp.___createUser(_ILdapDisp.java:587)
at omero.api._ILdapDisp.__dispatch(_ILdapDisp.java:635)
at IceInternal.Incoming.invoke(Incoming.java:221)
at Ice.ConnectionI.invokeAll(ConnectionI.java:2536)
at Ice.ConnectionI.dispatch(ConnectionI.java:1145)
at Ice.ConnectionI.message(ConnectionI.java:1056)
at IceInternal.ThreadPool.run(ThreadPool.java:395)
at IceInternal.ThreadPool.access$300(ThreadPool.java:12)
at IceInternal.ThreadPool$EventHandlerThread.run(ThreadPool.java:832)
at java.lang.Thread.run(Thread.java:748)
serverExceptionClass = ome.conditions.ApiUsageException
message = Cannot find unique user DistinguishedName: found=0
}
More information about the ome-users
mailing list