0

I have added the Quarkus quarkus-elytron-security-ldap dependency to my project to enable basic auth on my REST services. I have configured it in my properties file as below. I know that it is connecting successfully to the LDAP repository, but it never finds the UID when doing a search:

quarkus.security.ldap.dir-context.principal=uid=serviceLdapAccount,ou=Systems,ou=Users,DC=COMPANY
quarkus.security.ldap.dir-context.url=ldap://some.server.com
quarkus.security.ldap.dir-context.password=*****

quarkus.security.ldap.identity-mapping.rdn-identifier=uid
quarkus.security.ldap.identity-mapping.search-base-dn=DC=COMPANY

I have confirmed that the user definitely exists in the repository and is included in the search base. But I always get this response:

[io.qua.ver.htt.run.sec.BasicAuthenticationMechanism] Found basic auth header requestAccountName:***** (decoded using charset UTF-8)
[org.wil.security] Obtaining lock for identity [requestAccountName]...
[org.wil.security] Obtained lock for identity [requestAccountName].
[org.wil.security] Trying to create identity for principal [requestAccountName].
[org.wil.security] Executing search [(uid={0})] in context [DC=COMPANY] with arguments [requestAccountName]. Returning attributes are []. Binary attributes are [].
[org.wil.security] Identity for principal [requestAccountName] not found.

Why can't it find the identity?

Sean
  • 1,416
  • 19
  • 51
  • I don't know Quarkus, but there is no search _scope_ defined in the config (an equivalent of `ldapsearch -s` option, for telling whether or not to search the entire subtree below the base search). Looking at the doc, the [`search-recursive`](https://quarkus.io/guides/security-ldap#quarkus-elytron-security-ldap_quarkus.security.ldap.identity-mapping.search-recursive) property, which defaults to false, could be the "missing" parameter, try to set it to `true`. – EricLavault Sep 01 '22 at 11:59

1 Answers1

0

The seach-base-dn needed to be more specific:

quarkus.security.ldap.identity-mapping.search-base-dn=ou=Systems,ou=Users,DC=COMPANY

What I had before should work though, imo.

Sean
  • 1,416
  • 19
  • 51