GeoServer does not find LDAP groups of user

Question

I am failing to get GeoServer to use groups from LDAP as roles as described on https://docs.geoserver.org/stable/en/user/security/tutorials/ldap/index.html#map-ldap-groups-to-geoserver-roles

Running GeoServer 2.24.2 on openjdk 11.0.19 2023-04-18 LTS using Tomcat 9.0.62-5.el8. A LDAP server is available elsewhere.

If I query the LDAP server via Python, I get a list of 5 groups:

import ldap  # python-ldap, https://www.python-ldap.org

connection = ldap.initialize('ldaps://example.com:7636/')

# ignore cert
connection.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
connection.set_option(ldap.OPT_X_TLS_NEWCTX, 0)

connection.simple_bind_s(
    'uid=alice,cn=admins,cn=users,dc=foo,dc=bar,dc=baz,dc=com',
    'password',
)

result = connection.search_s(
    "cn=groups,dc=foo,dc=bar,dc=baz,dc=com",
    ldap.SCOPE_SUBTREE, 
    "(&(objectClass=univentionGroup)(memberUid=alice))",
)
print([r[0] for r in result])

returns

[
  'cn=Foo Bar,cn=groups,dc=foo,dc=bar,dc=baz,dc=com',
  'cn=group1,cn=login,cn=groups,dc=foo,dc=bar,dc=baz,dc=com',
  'cn=something_else,cn=sudo,cn=groups,dc=foo,dc=bar,dc=baz,dc=com',
  'cn=yaddayadda,cn=services,cn=groups,dc=foo,dc=bar,dc=baz,dc=com',
  'cn=geoserver_global_admins,cn=services,cn=groups,dc=foo,dc=bar,dc=baz,dc=com'
]

The GeoServer configuration is:

• Server URL: ldaps://example.com:7636/dc=foo,dc=bar,dc=baz,dc=com
• User lookup pattern: uid={0},cn=admins,cn=users
• Use LDAP groups for authorization: Checked
• Bind user before searching for groups: Checked
• Group search base: cn=groups,dc=foo,dc=bar,dc=baz,dc=com
• Group search filter: (&(objectClass=univentionGroup)(memberUid={0}))

Other options are unchecked or empty.

The GeoServer verbose logs show:

26 Feb 14:48:51 DEBUG  [security.ldap] - Getting authorities for user uid=alice,cn=admins,cn=users,dc=foo,dc=bar,dc=baz,dc=com
26 Feb 14:48:51 DEBUG  [security.ldap] - Searching for roles for user 'foo', DN = 'uid=alice,cn=admins,cn=users,dc=foo,dc=bar,dc=baz,dc=com', with filter (&(objectClass=univentionGroup)(memberUid={0})) in search base 'cn=groups,dc=foo,dc=bar,dc=baz,dc=com'
26 Feb 14:48:51 DEBUG  [security.ldap] - Roles from search: []
26 Feb 14:48:51 DEBUG  [ldap.LDAPSecurityProvider$1] - Authenticated user
26 Feb 14:48:51 DEBUG  [filter.GeoServerUserNamePasswordAuthenticationFilter$1] - Set SecurityContextHolder to UsernamePasswordAuthenticationToken [Principal=LdapUserDetailsImpl [Dn=uid=alice,cn=admins,cn=users,dc=foo,dc=bar,dc=baz,dc=com; Username=alice; Password=[PROTECTED]; Enabled=true; AccountNonExpired=true; CredentialsNonExpired=true; AccountNonLocked=true; Granted Authorities=[]], Credentials=[PROTECTED], Authenticated=true, Details=GeoServerWebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=...], Granted Authorities=[ROLE_AUTHENTICATED]]

The LDAP query in "Searching for roles for user 'foo'" seems to match my script exactly.

As I understand GeoServer's role model in combination with LDAP the user should be assigned a ROLE_{GROUPNAME} role for each of the groups. So e.g. the user should get the role ROLE_GEOSERVER_GLOBAL_ADMINS.

But GeoServer assigns no roles.

How can I get GeoServer to assign the roles from the LDAP groups?

---

I have found several hints that this might be a GeoServer bug:

• https://sourceforge.net/p/geoserver/mailman/geoserver-users/thread/[email protected]/
• https://sourceforge.net/p/geoserver/mailman/geoserver-users/thread/SJ0PR08MB6800C0E997D3CBD049D22B8ED71F9%40SJ0PR08MB6800.namprd08.prod.outlook.com
• https://sourceforge.net/p/geoserver/mailman/geoserver-users/thread/[email protected]/

A suggested workaround is using old jar files (gs-sec-ldap-2.15.2.jar and gs-web-sec-ldap-2.15.2.jar), this did not work for me.

---

I cross-posted this to https://sourceforge.net/p/geoserver/mailman/geoserver-users/thread/20240228133315.0EEA6A78BBBB%40dd44930.kasserver.com/ (FYI the threading is broken on that site, so you will need to hunt for further answers via the main interface, sorry)

Answer 1

Thanks to parts of a working configuration shared by Ian Turton at https://sourceforge.net/p/geoserver/mailman/geoserver-users/thread/CA%2B%3DcGJ%3Df0Du_0k_-fjWYd7urehZhyP_Jm5NMRF-TGiPoEkb7sQ%40mail.gmail.com/#msg58743163 I managed to solve this:

I did need a Role Service. And that Role Service had to be enabled otherwise it would not do anything...

The working configuration:

Existing LDAP setup

• We have different user "classes" under cn=users, e.g. cn=admins, cn=service and others, where the users are stored with uid=foo
• We have different, nested groups under cn=groups, e.g. cn=group1,cn=sudo, cn=group2,cn=sudo, cn=some_service,cn=services, cn=geoserver_global_admins,cn=services and users are connected using a memberUid=foo attribute on those entries.

GeoServer setup

LDAP Authentication Provider

LDAP Settings

• Server URL: ldaps://example.com:7636/dc=foo,dc=bar,dc=baz,dc=com
• User lookup pattern: uid={0},cn=admins,cn=users

Authorization

• Use LDAP groups for authorization: Checked
• Bind user before searching for groups: Checked
• Group search base: cn=groups

Everything else is empty and unchecked.

If you have multiple sub/sibling-"directories" of users that you want to log in (e.g. cn=external_users,cn=users), you need to create one Authentication Provider each. At least I had to. Using just uid={0} or uid={0},cn=users did not work for me. Your setup and experience might differ.

LDAP Role Service

• Administrator role: ROLE_GEOSERVER_GLOBAL_ADMINS (might not be available at first configuration but only if the service is active?)

LDAP Settings

• Server URL: ldaps://example.com:7636/dc=foo,dc=bar,dc=baz,dc=com
• Group search base: cn=groups
• Group user membership search filter: memberUid={0}
• Role prefix: ROLE_
• Convert Role To Upper Case: Checked

Authentication

• Authenticate to extract roles: Checked
• Username: uid=technical_user_for_role_extraction,cn=services,cn=users,dc=foo,dc=bar,dc=baz,dc=com
• Password: ...

Everything else is empty and unchecked

User Group Service

I did not configure a User Group Service.

Activation of the Role Service

Under Security -> Settings:

• Active role service: The LDAP Role Service you set up

---

With this setup I still get log entries saying DEBUG [security.ldap] - Roles from search: []
But the users get assigned their roles from the LDAP groups anyways so that seems unrelated to the actual group/role discovery...

DEBUG  [filter.GeoServerUserNamePasswordAuthenticationFilter$1] - Set SecurityContextHolder to UsernamePasswordAuthenticationToken [Principal=LdapUserDetailsImpl [Dn=uid=alice,cn=admins,cn=users,dc=foo,dc=bar,dc=baz,dc=com; Username=alice; Password=[PROTECTED]; Enabled=true; AccountNonExpired=true; CredentialsNonExpired=true; AccountNonLocked=true; Granted Authorities=[]], Credentials=[PROTECTED], Authenticated=true, Details=GeoServerWebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=123123123], Granted Authorities=[ROLE_AUTHENTICATED, ROLE_GEOSERVER_GLOBAL_ADMINS, ROLE_ANOTHER_GROUP]]

Some footgun prevention tips

• Changes to an authentication provider are not saved after editing and clicking Save. You also have to click Save on the main Authentication page! Otherwise you will think you are testing a change but really aren't.
• If you are testing what ACL and permissions your users have, you have to log in to see changes. The roles seem to be only assigned upon login. A change of your LDAP configuration will only be reflected in your GeoServer user on re-login.
• Save your XML configuration often. You might end up with GeoServer errors that prevent you from re-editing certain configuration pages in the web interface. The errors will be something like org.apache.wicket.WicketRuntimeException: Exception in rendering component: [RoleChoice [Component id = adminRoleName]].
• Once you switch the Role Service to the LDAP one, your GeoServer user "admin" will not become a GeoServer admin anymore! Make sure you have access to the "root" user's master password or that your LDAP setup includes a user that will become GeoServer admin!