0

As per my requirement i need to login into liferay using the users that imported from ldap server.I will explain the scenario step by step

1)I have some java code to create a user into Ldap server(name,firstname,password etc)
2)User has been created successfully in ldap server 
3)I gave some properties in portal-ext.properties files to import these users from ldap server to liferay and to login using the screen name
4)From the control panel i could see that the user has been imported to liferay 
5)Now if i try to login with the screenname and the password (password i passed in step1)it shows authentication failed
6)I Logged into liferay as administrator and changed the password of the user
7)Now the login is successfull

Questions 

1) How can i properly import the password from ldap server to liferay.
2)Any idea why the password i gave shows authentication failure

Portal-ext.properties

#jdbc.default.jndi.name=jdbc/LiferayPool
jdbc.default.driverClassName=com.mysql.jdbc.Driver
jdbc.default.url=jdbc:mysql://localhost/lportal?useUnicode=true&characterEncoding=UTF-8&useFastDateParsing=false
jdbc.default.username=root
jdbc.default.password=root


json.service.auth.token.hosts.allowed=127.0.0.1
json.service.auth.token.enabled=false
jsonws.web.service.public.methods=*
jsonws.servlet.hosts.allowed=127.0.0.1

users.screen.name.validator=com.liferay.portal.security.auth.LiberalScreenNameValidator
#users.screen.name.allow.numeric=true
#users.screen.name.validator=com.liferay.portal.security.auth.DefaultScreenNameValidator

ldap.base.provider.url= ldap://localhost:389
ldap.base.dn= dc=soas,dc=schoolx
ldap.security.principal= cn=admin
ldap.security.credentials= blahblah
auth.pipeline.pre=com.liferay.portal.security.auth.LDAPAuth

ldap.auth.enabled=true
ldap.auth.required=false
ldap.password.policy.enabled=true
ldap.users.dn= dc=soas,dc=schoolx
ldap.groups.dn= dc=soas,dc=schoolx

ldap.import.enabled=true
ldap.import.interval=1
ldap.import.on.startup=true

ldap.import.method=group
ldap.import.group.search.filter.enabled=true

#ldap.import.group.cache.enabled=false


users.screen.name.allow.numeric=true
#ldap.auth.method=bind
#ldap.auth.password.encryption.algorithm=
#passwords.encrypted=


ldap.user.mappings=screenName=uid\npassword=userPassword\nemailAddress=mail\nfirstName=givenName\nlastName=sn

#ldap.user.mappings=screenName=displayName\npassword=userPassword\nemailAddress=mail\nfirstName=givenName\nlastName=sn

#ldap.user.impl=com.liferay.portal.security.ldap.LDAPUser

ldap.group.mappings=groupName=cn\ndescription=description\nuser=member

ldap.import.user.search.filter=(objectClass=inetOrgPerson)

ldap.import.group.search.filter=(objectClass=groupOfEntries)

#ldap.auth.search.filter=(mail=@email_address@)
ldap.auth.search.filter=(cn=@screen_name@)

ldap.import.user.password.enabled=true

#ldap.import.create.role.per.group=true


axis.servlet.hosts.allowed=
axis.servlet.https.required=false
#company.security.auth.type=emailAddress
company.security.auth.type=screenName
search.container.show.pagination.top=false
setup.wizard.enabled=false
passwords.default.policy.change.required=false

I use Liferay 6.2 GA2 bundble with Tomcat 7 and OpenDJ-2.5.0-Xpress. Can some one help me to fix this issue

playmaker420
  • 1,527
  • 4
  • 27
  • 52

3 Answers3

1

There might be certain possibilities:

  1. Does the password follow the same password policy and encryption technique which you have implied in Portal?
  2. Is the correct organization / site / role assigned to the users?
Parkash Kumar
  • 4,710
  • 3
  • 23
  • 39
  • 1)i have already enabled the user ldap password policy (ldap.password.policy.enabled=true) 2)I have given the role as power user – playmaker420 Apr 16 '15 at 07:58
  • Is the ldap.password.policy and portal password.policy same? – Parkash Kumar Apr 16 '15 at 08:03
  • Where do i specify the portal passowrd policy? From the configuration>passwordpolicy tab i could see "You are using LDAP's password policy. Please change your LDAP password policy settings if you wish to use a local password policy" .Is that you asked? – playmaker420 Apr 16 '15 at 08:06
  • Ok, so it means your password are imported using LDAP password policy. Shouldn't be any issue here. Then, there might be issue with encryption technique. Decrypt your password stored in lportal and verify that does it match with ldap password. – Parkash Kumar Apr 16 '15 at 08:24
  • decrypting password from lportal Hmm I dont think its possible. Im not sure which encryption technique they use – playmaker420 Apr 16 '15 at 08:56
1

Try following LDAP properties in your portal-ext.properties

# LDAP id 1 is for open LDAP instance
ldap.server.ids=1

ldap.referral.1=follow
ldap.factory.initial.1=com.sun.jndi.ldap.LdapCtxFactory
ldap.server.name.1=ldaptest-internal
ldap.base.provider.url.1=ldap://<host>:<port>
ldap.base.dn.1=dc=example,dc=com

ldap.security.principal.1=cn=Manager,dc=example,dc=com
ldap.security.credentials.1=seacret

ldap.auth.search.filter.1=(mail=@email_address@)

# EXPORT RELATED PROPERTY
ldap.user.default.object.classes.1=top,person,organizationalPerson,inetOrgPerson

#User mappings
#
ldap.user.mappings.1=screenName=uid\npassword=userPassword\nemailAddress=mail\nfirstName=givenName\nlastName=sn\ngroup=groupMembership\nfullName=cn


# EXPORT RELATED PROPERTY
ldap.group.default.object.classes.1=top,groupOfUniqueNames

# Group mappings
#
ldap.group.mappings.1=groupName=cn\ndescription=description\nuser=uniqueMember

# Import and export search filter
#
ldap.import.user.search.filter.1=(objectClass=inetOrgPerson)
ldap.import.group.search.filter.1=(objectClass=groupOfUniqueNames)


# EXPORT RELATED PROPERTY
ldap.users.dn.1=dc=example,dc=com

# EXPORT RELATED PROPERTY
ldap.groups.dn.1=dc=example,dc=com

auth.pipeline.pre.1=com.liferay.portal.security.auth.LDAPAuth
ldap.import.method.1=user


ldap.import.enabled=true
ldap.import.on.startup=true
ldap.auth.enabled=true
ldap.auth.required=true
ldap.password.policy.enabled=true

I'm guessing there might be some missing property.

aston
  • 632
  • 5
  • 17
0

As i said in my question i was creating user in ldap using some java codes and i was binding password to ldap's userPassword field.So these are the changes i have made to fix the issues

ldap.user.mappings=screenName=uid\npassword=userPassword\nemailAddress=mail\nfirstName=givenName\nlastName=sn

ldap.auth.search.filter=(uid=@screen_name@)
ldap.import.user.password.enabled=false
ldap.import.user.password.autogenerated=false
ldap.import.user.password.default=userPassword
playmaker420
  • 1,527
  • 4
  • 27
  • 52