GeoServer LDAP Authentication 'Test Connection' succeeds, but login fails

Question

I am attempting to use Active Directory for GeoServer authentication. When I click the 'Test Connection' button on the Admin > Authentication > Providers > LDAP settings page, it says "Connection Successful." However, when I log out of Geoserver, and try to log in with the same credentials, I get an "invalid username/password combination" error.

My LDAP settings are as follows, where ADserver=my Active Directory server, and domain=my company domain:

Server URL: ldap://ADserver/dc=domain,dc=com
TLS: [Not checked]
User lookup pattern: [empty]
Filter used to lookup user: (userPrincipalName={0})
Format used for user login name: {0}@domain.com
Use LDAP groups for authorization: [Not checked]
User Group Service: default

And I have selected this Authentication Provider in my Provider Chain.

Why does the Test Connection succeed, but actually logging in fails?

Answer 1

I got a solution working on GeoServer 2.7.2 that was very similar to @xcer however I didnt need to add an extra Group, as adding the users to the default User Group Service seemed to be enough for me.

In short:

1. I added an LDAP authentication provider (much the same as in the question above) with User Group Server pointing to `default'. Connection tested OK.
2. Under menu section 'Users, Groups, Roles' I opened tab 'Users/Groups' and proceeded to add each user manually with a random password and ADMIN role.
3. In the Provider Chain, I also had default listed first, and my ad-ldap authentication provider listed second.

I found that this:

1. Enabled me to log in using either password (ie the one via Active Directory / LDAP, as well as the manual password I provided for each user).
2. Once I logged in (using either password), the permissions that got applied were the ones in the default User Group Provider that can be added and modified manually via the interface.

Not sure if this was the intended way to get it working - it would have been a better solution overall if I could just apply permissions via LDAP groups. But after battling with Geoserver for 3 hours solid that was the best that I could manage.

Answer 2

Here is how I eventually got the LDAP login to work:

1. Added a Group (LDAPGroup) to my default User Group Service and selected appropriate roles for the group
2. Added each LDAP user to my default User Group Service as a member of LDAPGroup. When you do this, you have to create a password for each user, but GeoServer will ignore it and authenticate against LDAP. Use something my like "fake" for the password.
3. In my Provider chain, I had both default and myLdapProvider selected. Curiously, it only worked when default was listed first in the Selected text box. When I had myLdapProvider first, login failed. Not sure why, but that was the biggest stubling block for me.

I hope this helps someone else avoid the same frustrations I had.

Answer 3

I was also struggling with this problem for 2 hours now! The answer of xcer helped me:

In my Provider chain, I had both default and myLdapProvider selected. Curiously, it only worked when default was listed first in the Selected text box. When I had myLdapProvider first, login failed. Not sure why, but that was the biggest stubling block for me.

For me, it only worked when I had myLdapProvider first! If default was listed first, the login failed. Pretty strange!

Answer 4

Using version 2.16.0 I found that by Creating a basic AD connection, I showed as green for testing a user account. As soon as I logged out and attempted to login it failed with the logs stating "Bad Credentials".

I had to navigate to Security --> Authentication and migrate my Authentication Provider I created from the "Selected" panel of the "Provider Chain" to the "Available" side (pretty much disabling it). I then saved, moved it back to the Selected panel and saved again. AD authentications began working again.