Highlighted

ActiveDirectory Group Sync Issue using AEM LDAP

Avatar

Avatar

ganeshboggavara

Avatar

ganeshboggavara

ganeshboggavara

02-04-2019

Hi Guys,

I'm trying to Sync  groups and Users from Active Directory to AEM Environment using AEM LDAP (Identity Provider , Sync Handler , External Login Module)

The Connection and Bind seems successful but the groups don't Sync, I see from logs that the messages that transfer between AD and AEM are empty messages as below even though there are several groups in the AD

02.04.2019 14:05:44.773 *DEBUG* [NioProcessor-8] org.apache.directory.api.ldap.codec.actions.controls.StoreControlValue Control value : 0x30 0x84 0x00 0x00 0x00 0x05 0x02 0x01 0x00 0x04 0x00

02.04.2019 14:05:44.773 *DEBUG* [NioProcessor-8] org.apache.directory.api.asn1.ber.Asn1Decoder <<<------------------------------------------

02.04.2019 14:05:44.773 *DEBUG* [NioProcessor-8] org.apache.directory.api.asn1.ber.Asn1Decoder <-- Stop decoding : TLV[ 0x04, 11, DATA[0x30 0x84 0x00 0x00 0x00 0x05 0x02 0x01 0x00 0x04 0x00 ]]

02.04.2019 14:05:44.773 *DEBUG* [NioProcessor-8] org.apache.directory.api.asn1.ber.Asn1Decoder <<<==========================================

02.04.2019 14:05:44.773 *DEBUG* [NioProcessor-8] org.apache.directory.api.CODEC_LOG Decoded LdapMessage : MessageType : SEARCH_RESULT_DONE

Message ID : 3

    Search Result Done

        Ldap Result

            Result code : (SUCCESS) success

            Matched Dn : ''

            Diagnostic message : ''

    Paged Search Control

        oid : 1.2.840.113556.1.4.319

        critical : false

        size   : '0'

        cookie   : ''

    Paged Search Control

        oid : 1.2.840.113556.1.4.319

        critical : false

        size   : '0'

        cookie   : ''

02.04.2019 14:05:44.773 *DEBUG* [NioProcessor-8] org.apache.directory.ldap.client.api.LdapNetworkConnection -------> MessageType : SEARCH_RESULT_DONE

Message ID : 3

    Search Result Done

        Ldap Result

            Result code : (SUCCESS) success

            Matched Dn : ''

            Diagnostic message : ''

    Paged Search Control

        oid : 1.2.840.113556.1.4.319

        critical : false

        size   : '0'

        cookie   : ''

    Paged Search Control

        oid : 1.2.840.113556.1.4.319

        critical : false

        size   : '0'

        cookie   : ''

Message received <-------

02.04.2019 14:05:44.773 *DEBUG* [NioProcessor-8] org.apache.directory.ldap.client.api.LdapNetworkConnection Getting <3, org.apache.directory.ldap.client.api.future.SearchFuture>

02.04.2019 14:05:44.773 *DEBUG* [NioProcessor-8] org.apache.directory.ldap.client.api.LdapNetworkConnection Search successful : MessageType : SEARCH_RESULT_DONE

Message ID : 3

    Search Result Done

        Ldap Result

            Result code : (SUCCESS) success

            Matched Dn : ''

            Diagnostic message : ''

    Paged Search Control

        oid : 1.2.840.113556.1.4.319

        critical : false

        size   : '0'

        cookie   : ''

    Paged Search Control

        oid : 1.2.840.113556.1.4.319

        critical : false

        size   : '0'

        cookie   : ''

02.04.2019 14:05:44.773 *DEBUG* [NioProcessor-8] org.apache.directory.ldap.client.api.LdapNetworkConnection Removing <3, org.apache.directory.ldap.client.api.future.SearchFuture>

Here is the LDAP Identity Provider Config I gave

User base DN                CN=AgCoVPNExt,OU=MA2-SOX,OU=Groups,DC=phibred,DC=com   (also tried with OU=MA2-SOX,OU=Groups,DC=phibred,DC=com)

User object classes      user

User id attribute            CN

Group base DN                OU=MA2-SOX,OU=Groups,DC=phibred,DC=com

Group object classes      group

Group name attribute      CN

Can someone help with these questions

1. Why don't I see the Groups Sync from AD to AEM?

2. Can we Invoke Groups from JMX just like we Invoke syncAllExternalUsers() in JMX

3.Does AEM LDAP Sync groups at all?

Thanks,

Ganesh Bogga

Replies

Highlighted

Avatar

Avatar

jbrar

Employee

Avatar

jbrar

Employee

jbrar
Employee

02-04-2019

You are probably missing one of the sync config. Check [1] for more details and answers to your questions.

[1] Configuring LDAP with AEM 6

Avatar

Avatar

Vish_dhaliwal

Employee

Avatar

Vish_dhaliwal

Employee

Vish_dhaliwal
Employee

03-04-2019

Hello,

Check the "User membership nesting depth" in the "Apache Jackrabbit Oak Default Sync Handler" config. Change it to 1 (or greater integer).

Answers:

1. Make sure your group Base DN is correct.

2. No

3. No, When ldap user will try to login to AEM, it will automatically sync ldap groups which user is a part of.

For example,

You have 3 users,

UI

U2

U3

5 groups:

G1 - U1, U2

G2 - U3

G3 - U1

G4

G5

Now, when U1 will login to AEM, groups G1 and G3 will be synced automatically.

Highlighted

Avatar

Avatar

ganeshboggavara

Avatar

ganeshboggavara

ganeshboggavara

03-04-2019

Hi Vish,

Thanks a lot for the reply, I tried logging in with one of the user synced to AEM, I can see the user in useradmin but I could not login with that username and password (that i already know of that user from AD)

Does LDAP Authenticate user credentials(username and password) from AD dynamically? or Do we need to create a password after the user is synced to AEM?

Appreciate your response

Highlighted

Avatar

Avatar

Vish_dhaliwal

Employee

Avatar

Vish_dhaliwal

Employee

Vish_dhaliwal
Employee

03-04-2019

Hello Ganesh,

If this user is indeed an LDAP user (check the pre:principalName and externalId property), then the password defined in AD should work.

Do you see any error in browser or aem logs? Can you try to update the password in aem and see if that works?

Regards,

Vishu

Highlighted

Avatar

Avatar

ganeshboggavara

Avatar

ganeshboggavara

ganeshboggavara

03-04-2019

Yes It says bad password entry, This is what I see in logs when I login with zf3693, Am I missing a certificate or some LDAP config to validate password with AD?

Message ID : 4

    Search Result Done

        Ldap Result

            Result code : (SUCCESS) success

            Matched Dn : ''

            Diagnostic message : ''

03.04.2019 14:15:57.226 *DEBUG* [NioProcessor-5] org.apache.directory.ldap.client.api.LdapNetworkConnection -------> MessageType : SEARCH_RESULT_ENTRY

Message ID : 4

    Search Result Entry

Entry

    dn: CN=zf3693,OU=US,OU=xxxxx,OU=Clients,DC=xxxx,DC=com

    objectClass: top

    objectClass: person

    objectClass: organizationalPerson

    objectClass: user

    proxyAddresses: smtp:zf3693@xxx.mail.xxxx.com

    proxyAddresses: smtp:zf3693@xxxx.com

    proxyAddresses: SMTP:xxx.xxx@xxxx.com

    PHICA-S20: <root created="2018.11.19 19:44:23:375" updated="2018.11.19 19:44:23:375">

  <QPM storageVersion="6" productVersion="5.8.2.1831" encrypted="true" encryptAlgorithm="TripleDES" keylen="192" hashAlgorithm="sha256" created="2018.11.19 19:44:23:375" updated="2019.02.11 15:16:29:549" realmId="3250D9B9AE3FD0AC7DBD9D7DD66B430CCE787B8CA050F82CFBDF5A7BD684573B">

    <data created="2018.11.19 19:44:23:359" updated="2019.02.11 15:16:29:549">

      <public>

        <settings group="questionAnswerProfiles">

          <profiles>

            <profile language="en-US" updated="2018.11.19 19:48:52:559" answersHashed="true" hashAlgorithm="sha256" configurationSetId="5a7587e5-3195-4e0a-8bde-837a097f9a47" minAnswerLength="10" profileLockExpires="0001.01.01 06:00:00:000" />

          </profiles>

        </settings>

        <settings group="emailProfiles" />

        <settings group="mobileProfiles" />

        <settings group="general" />

......

.

.

.

.

.

.

.

/root>

    badPwdCount: 1

    countryCode: 0

    houseIdentifier: JH36

    ont-validobject: Y

    givenName: xxxxx

    objectSid: 0x01 0x05 0x00 0x00 0x00 0x00 0x00 0x05 0x15 0x00 0x00 0x00 0x40 0x4E 0x96 0x87 ...

    userAccountControl: 512

    accountNameHistory: DDNET1\zf3693

    mailNickname: zf3693

    ont-badlogincount: 0

    extensionAttribute13: MA Create

         badPasswordTime: 131987896731664770

Thanks

Highlighted

Avatar

Avatar

ganeshboggavara

Avatar

ganeshboggavara

ganeshboggavara

03-04-2019

Yes, If I change password, it works, but the groups are not getting synced

Highlighted

Avatar

Avatar

Prince_Shivhare

Avatar

Prince_Shivhare

Prince_Shivhare

03-04-2019

could you please go with this article and let us know if any issues you face.

AEM Developer Blog: INTEGRATE AEM WITH LDAP

~ Prince

Highlighted

Avatar

Avatar

ganeshboggavara

Avatar

ganeshboggavara

ganeshboggavara

04-04-2019

I'm getting a Sync Handler Error , It says rep:lastSynced is not set, Can you let me know what do I map it to?

04.04.2019 10:52:23.893 *DEBUG* [qtp1038288387-349] org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider authenticate(vw9684) (connect=4.94ms, bind=228.57ms)

04.04.2019 10:52:23.893 *DEBUG* [qtp1038288387-349] org.apache.jackrabbit.oak.security.authentication.ldap.impl.PoolableUnboundConnectionFactory passivate connection: org.apache.jackrabbit.oak.security.authentication.ldap.impl.PoolableUnboundConnectionFactory$TlsGuardingConnection@5f2ca64d

04.04.2019 10:52:23.894 *DEBUG* [qtp1038288387-349] org.apache.jackrabbit.oak.spi.security.authentication.external.basic.DefaultSyncContext Properties of user 'vw9684' need sync. rep:lastSynced not set.

04.04.2019 10:52:23.894 *DEBUG* [qtp1038288387-349] org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModule SyncHandler phibredsync throws sync exception for 'vw9684'

org.apache.jackrabbit.oak.spi.security.authentication.external.SyncException: javax.jcr.nodetype.ConstraintViolationException: Attempt to set an protected property rep:principalName

  at org.apache.jackrabbit.oak.spi.security.authentication.external.basic.DefaultSyncContext.sync(DefaultSyncContext.java:266)

  at org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModule.syncUser(ExternalLoginModule.java:355)

  at org.apache.jackrabbit.oak.spi.security.authentication.external.impl.ExternalLoginModule.login(ExternalLoginModule.java:234)

Thanks,

Ganesh

Highlighted

Avatar

Avatar

smacdonald2008

Total Posts

12.7K

Likes

1.4K

Correct Answer

2.3K

Avatar

smacdonald2008

Total Posts

12.7K

Likes

1.4K

Correct Answer

2.3K
smacdonald2008

04-04-2019

See the AEM LDAP article we have. It shows all steps  - using Apache DS as an example -- Adobe Experience Manager Help | Configuring Adobe Experience Manager 6.4 to use Apache Directory Ser...