0

I am trying to configure LDAP authentication against an Active Directory. While I can successfully authenticate with Active Directory accounts on Geoserver, I need to input the usernames in the [[email protected]] format.

It doesn't seem like a real issue, but I can foresee the general confusion for users trying to connect to Geoserver because all internal services in our organization are using LDAP authentication using credentials like [user]/password and Geoserver would be the exception using [[email protected]]/password.

[[email protected]] corresponds to the userPrincipalName while [user] corresponds to sAMAccountName.

I tried a few things in the "Format used for user login name" but I can't get any setting to make it work. It either just doesn't work or I still have to use [[email protected]]

Below are the settings used in Geoserver:

enter image description here

2
  • Just set the filter to be sAMSAccountName={0} then currently you are saying the first entered value must equal userPrincipalName OR the second value must equal the sAMMAccountName
    – Ian Turton
    Jul 20, 2023 at 14:47
  • I tried [Filter used to lookup user] = (sAMAccountName={0}) and [Format used for user login name]= {0} or just leave it to {0}@domain.local but now I can't authenticate any ldap user and get an internal server error trying to login. What should be the correct Filter and Format values? Jul 24, 2023 at 3:18

2 Answers 2

1

I have the following set:

User lookup pattern: uid={0},ou=users
Group Search base: ou=groups
Group search filter: (memberOf={0})

And the rest are empty.

0

I successfully used the Active Directory credentials in the [user]/password format with these configs:

enter image description here

Then I moved up the LDAP authentication provider first in the "Provider Chain" in the "Settings -> Authentication" menu.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.