1

I am attempting to use Active Directory for GeoServer authentication. When I click the 'Test Connection' button on the Admin > Authentication > Providers > LDAP settings page, it says "Connection Successful." However, when I log out of Geoserver, and try to log in with the same credentials, I get an "invalid username/password combination" error.

My LDAP settings are as follows, where ADserver=my Active Directory server, and domain=my company domain:

Server URL: ldap://ADserver/dc=domain,dc=com
TLS: [Not checked]
User lookup pattern: [empty]
Filter used to lookup user: (userPrincipalName={0})
Format used for user login name: {0}@domain.com
Use LDAP groups for authorization: [Not checked]
User Group Service: default

And I have selected this Authentication Provider in my Provider Chain.

Why does the Test Connection succeed, but actually logging in fails?

  • Have checked your AD server configuration? In particular, does it match the TLS configuration here? [I know that this isn't what you asked, but clearly there is a difference somewhere, and you'd probably be happy if it just worked] – BradHards Dec 18 '13 at 3:28
1

Here is how I eventually got the LDAP login to work:

  1. Added a Group (LDAPGroup) to my default User Group Service and selected appropriate roles for the group
  2. Added each LDAP user to my default User Group Service as a member of LDAPGroup. When you do this, you have to create a password for each user, but GeoServer will ignore it and authenticate against LDAP. Use something my like "fake" for the password.
  3. In my Provider chain, I had both default and myLdapProvider selected. Curiously, it only worked when default was listed first in the Selected text box. When I had myLdapProvider first, login failed. Not sure why, but that was the biggest stubling block for me.

I hope this helps someone else avoid the same frustrations I had.

1

I got a solution working on GeoServer 2.7.2 that was very similar to @xcer however I didnt need to add an extra Group, as adding the users to the default User Group Service seemed to be enough for me.

In short:

  1. I added an LDAP authentication provider (much the same as in the question above) with User Group Server pointing to `default'. Connection tested OK.
  2. Under menu section 'Users, Groups, Roles' I opened tab 'Users/Groups' and proceeded to add each user manually with a random password and ADMIN role.
  3. In the Provider Chain, I also had default listed first, and my ad-ldap authentication provider listed second.

I found that this:

  1. Enabled me to log in using either password (ie the one via Active Directory / LDAP, as well as the manual password I provided for each user).
  2. Once I logged in (using either password), the permissions that got applied were the ones in the default User Group Provider that can be added and modified manually via the interface.

Not sure if this was the intended way to get it working - it would have been a better solution overall if I could just apply permissions via LDAP groups. But after battling with Geoserver for 3 hours solid that was the best that I could manage.

  • I just tested this, and you are right, the Group inside the default User Group Service is not necessary. I still needed those Groups for other reasons, but not to get the authentication working. – xcer Mar 25 '16 at 1:02
0

I was also struggling with this problem for 2 hours now! The answer of xcer helped me:

In my Provider chain, I had both default and myLdapProvider selected. Curiously, it only worked when default was listed first in the Selected text box. When I had myLdapProvider first, login failed. Not sure why, but that was the biggest stubling block for me.

For me, it only worked when I had myLdapProvider first! If default was listed first, the login failed. Pretty strange!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.