0

I am failing to get GeoServer to use groups from LDAP as roles as described on https://docs.geoserver.org/stable/en/user/security/tutorials/ldap/index.html#map-ldap-groups-to-geoserver-roles

Running GeoServer 2.24.2 on openjdk 11.0.19 2023-04-18 LTS using Tomcat 9.0.62-5.el8. A LDAP server is available elsewhere.

If I query the LDAP server via Python, I get a list of 5 groups:

import ldap  # python-ldap, https://www.python-ldap.org

connection = ldap.initialize('ldaps://example.com:7636/')

# ignore cert
connection.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
connection.set_option(ldap.OPT_X_TLS_NEWCTX, 0)

connection.simple_bind_s(
    'uid=alice,cn=admins,cn=users,dc=foo,dc=bar,dc=baz,dc=com',
    'password',
)

result = connection.search_s(
    "cn=groups,dc=foo,dc=bar,dc=baz,dc=com",
    ldap.SCOPE_SUBTREE, 
    "(&(objectClass=univentionGroup)(memberUid=alice))",
)
print([r[0] for r in result])

returns

[
  'cn=Foo Bar,cn=groups,dc=foo,dc=bar,dc=baz,dc=com',
  'cn=group1,cn=login,cn=groups,dc=foo,dc=bar,dc=baz,dc=com',
  'cn=something_else,cn=sudo,cn=groups,dc=foo,dc=bar,dc=baz,dc=com',
  'cn=yaddayadda,cn=services,cn=groups,dc=foo,dc=bar,dc=baz,dc=com',
  'cn=geoserver_global_admins,cn=services,cn=groups,dc=foo,dc=bar,dc=baz,dc=com'
]

The GeoServer configuration is:

  • Server URL: ldaps://example.com:7636/dc=foo,dc=bar,dc=baz,dc=com
  • User lookup pattern: uid={0},cn=admins,cn=users
  • Use LDAP groups for authorization: Checked
  • Bind user before searching for groups: Checked
  • Group search base: cn=groups,dc=foo,dc=bar,dc=baz,dc=com
  • Group search filter: (&(objectClass=univentionGroup)(memberUid={0}))

Other options are unchecked or empty.

The GeoServer verbose logs show:

26 Feb 14:48:51 DEBUG  [security.ldap] - Getting authorities for user uid=alice,cn=admins,cn=users,dc=foo,dc=bar,dc=baz,dc=com
26 Feb 14:48:51 DEBUG  [security.ldap] - Searching for roles for user 'foo', DN = 'uid=alice,cn=admins,cn=users,dc=foo,dc=bar,dc=baz,dc=com', with filter (&(objectClass=univentionGroup)(memberUid={0})) in search base 'cn=groups,dc=foo,dc=bar,dc=baz,dc=com'
26 Feb 14:48:51 DEBUG  [security.ldap] - Roles from search: []
26 Feb 14:48:51 DEBUG  [ldap.LDAPSecurityProvider$1] - Authenticated user
26 Feb 14:48:51 DEBUG  [filter.GeoServerUserNamePasswordAuthenticationFilter$1] - Set SecurityContextHolder to UsernamePasswordAuthenticationToken [Principal=LdapUserDetailsImpl [Dn=uid=alice,cn=admins,cn=users,dc=foo,dc=bar,dc=baz,dc=com; Username=alice; Password=[PROTECTED]; Enabled=true; AccountNonExpired=true; CredentialsNonExpired=true; AccountNonLocked=true; Granted Authorities=[]], Credentials=[PROTECTED], Authenticated=true, Details=GeoServerWebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=...], Granted Authorities=[ROLE_AUTHENTICATED]]

The LDAP query in "Searching for roles for user 'foo'" seems to match my script exactly.

As I understand GeoServer's role model in combination with LDAP the user should be assigned a ROLE_{GROUPNAME} role for each of the groups. So e.g. the user should get the role ROLE_GEOSERVER_GLOBAL_ADMINS.

But GeoServer assigns no roles.

How can I get GeoServer to assign the roles from the LDAP groups?


I have found several hints that this might be a GeoServer bug:

A suggested workaround is using old jar files (gs-sec-ldap-2.15.2.jar and gs-web-sec-ldap-2.15.2.jar), this did not work for me.


I cross-posted this to https://sourceforge.net/p/geoserver/mailman/geoserver-users/thread/20240228133315.0EEA6A78BBBB%40dd44930.kasserver.com/ (FYI the threading is broken on that site, so you will need to hunt for further answers via the main interface, sorry)

5
  • did you create a role service as well as a user/group service?
    – Ian Turton
    Feb 26 at 15:24
  • Nope, docs.geoserver.org/stable/en/user/security/auth/… suggested that I would not need that: "After authentication, bob will be assigned the role ROLE_WORKERS. The role name is generated by concatenating ROLE_ with the name of the group in upper case." Feb 26 at 15:45
  • I have now set up a role service, I can see the desired roles (e.g. ROLE_GEOSERVER_GLOBAL_ADMINS at various places in the GeoServer admin panel, but upon user login, still no roles are found/assigned. From my understanding those things are separate? Role service finds groups and provides them as roles for configuration. Authentication logs in and places authenticated user into its roles (via the ldap group names) Feb 26 at 15:47
  • Possibly, I always get confused at about this point though I did try to rewrite the docs to make it clearer last time I attempted this
    – Ian Turton
    Feb 26 at 16:10
  • Dang... Well, to rule out issues due to missing services I now also added a LDAP User Group Service that successfully shows all users and groups. But the user logging in still gets no role found or assigned. Feb 27 at 10:58

1 Answer 1

0

Thanks to parts of a working configuration shared by Ian Turton at https://sourceforge.net/p/geoserver/mailman/geoserver-users/thread/CA%2B%3DcGJ%3Df0Du_0k_-fjWYd7urehZhyP_Jm5NMRF-TGiPoEkb7sQ%40mail.gmail.com/#msg58743163 I managed to solve this:

I did need a Role Service. And that Role Service had to be enabled otherwise it would not do anything...

The working configuration:

Existing LDAP setup

  • We have different user "classes" under cn=users, e.g. cn=admins, cn=service and others, where the users are stored with uid=foo
  • We have different, nested groups under cn=groups, e.g. cn=group1,cn=sudo, cn=group2,cn=sudo, cn=some_service,cn=services, cn=geoserver_global_admins,cn=services and users are connected using a memberUid=foo attribute on those entries.

GeoServer setup

LDAP Authentication Provider

LDAP Settings

  • Server URL: ldaps://example.com:7636/dc=foo,dc=bar,dc=baz,dc=com
  • User lookup pattern: uid={0},cn=admins,cn=users

Authorization

  • Use LDAP groups for authorization: Checked
  • Bind user before searching for groups: Checked
  • Group search base: cn=groups

Everything else is empty and unchecked.

If you have multiple sub/sibling-"directories" of users that you want to log in (e.g. cn=external_users,cn=users), you need to create one Authentication Provider each. At least I had to. Using just uid={0} or uid={0},cn=users did not work for me. Your setup and experience might differ.

LDAP Role Service

  • Administrator role: ROLE_GEOSERVER_GLOBAL_ADMINS (might not be available at first configuration but only if the service is active?)

LDAP Settings

  • Server URL: ldaps://example.com:7636/dc=foo,dc=bar,dc=baz,dc=com
  • Group search base: cn=groups
  • Group user membership search filter: memberUid={0}
  • Role prefix: ROLE_
  • Convert Role To Upper Case: Checked

Authentication

  • Authenticate to extract roles: Checked
  • Username: uid=technical_user_for_role_extraction,cn=services,cn=users,dc=foo,dc=bar,dc=baz,dc=com
  • Password: ...

Everything else is empty and unchecked

User Group Service

I did not configure a User Group Service.

Activation of the Role Service

Under Security -> Settings:

  • Active role service: The LDAP Role Service you set up

With this setup I still get log entries saying DEBUG [security.ldap] - Roles from search: []
But the users get assigned their roles from the LDAP groups anyways so that seems unrelated to the actual group/role discovery...

DEBUG  [filter.GeoServerUserNamePasswordAuthenticationFilter$1] - Set SecurityContextHolder to UsernamePasswordAuthenticationToken [Principal=LdapUserDetailsImpl [Dn=uid=alice,cn=admins,cn=users,dc=foo,dc=bar,dc=baz,dc=com; Username=alice; Password=[PROTECTED]; Enabled=true; AccountNonExpired=true; CredentialsNonExpired=true; AccountNonLocked=true; Granted Authorities=[]], Credentials=[PROTECTED], Authenticated=true, Details=GeoServerWebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=123123123], Granted Authorities=[ROLE_AUTHENTICATED, ROLE_GEOSERVER_GLOBAL_ADMINS, ROLE_ANOTHER_GROUP]]

Some footgun prevention tips

  • Changes to an authentication provider are not saved after editing and clicking Save. You also have to click Save on the main Authentication page! Otherwise you will think you are testing a change but really aren't.
  • If you are testing what ACL and permissions your users have, you have to log in to see changes. The roles seem to be only assigned upon login. A change of your LDAP configuration will only be reflected in your GeoServer user on re-login.
  • Save your XML configuration often. You might end up with GeoServer errors that prevent you from re-editing certain configuration pages in the web interface. The errors will be something like org.apache.wicket.WicketRuntimeException: Exception in rendering component: [RoleChoice [Component id = adminRoleName]].
  • Once you switch the Role Service to the LDAP one, your GeoServer user "admin" will not become a GeoServer admin anymore! Make sure you have access to the "root" user's master password or that your LDAP setup includes a user that will become GeoServer admin!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.