[ https://issues.apache.org/jira/browse/KNOX-2881?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17688521#comment-17688521 ]
ASF subversion and git services commented on KNOX-2881: ------------------------------------------------------- Commit c06874cc819cddd422cc30f227cf0282c402c970 in knox's branch refs/heads/master from Sandor Molnar [ https://gitbox.apache.org/repos/asf?p=knox.git;h=c06874cc8 ] KNOX-2881 - KnoxCLI handles aliases when testing LDAP (system) authentication (#732) > KnoxCLI doesn’t hande ALIAS in (system)-user-auth-test > ------------------------------------------------------ > > Key: KNOX-2881 > URL: https://issues.apache.org/jira/browse/KNOX-2881 > Project: Apache Knox > Issue Type: Improvement > Components: KnoxCLI > Affects Versions: 1.2.0, 1.3.0, 1.4.0, 1.5.0, 2.0.0, 1.6.0, 1.6.1 > Reporter: Sandor Molnar > Assignee: Sandor Molnar > Priority: Major > Fix For: 2.1.0 > > Time Spent: 20m > Remaining Estimate: 0h > > When topology has > {noformat} > <param> > <name>main.ldapRealm.contextFactory.systemPassword</name> > <value>${ALIAS=knoxldapsystempassword}</value> > </param> > {noformat} > The validations fail as: > {noformat} > # /bin/knoxcli.sh system-user-auth-test --cluster ldapUsecase1Topo2 > org.apache.shiro.authc.AuthenticationException: LDAP authentication failed. > [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042A, comment: > AcceptSecurityContext error, data 52e, v3839] > For more information use --d for debug output. > Unable to successfully bind to LDAP server with topology credentials. Are > your parameters correct? > # bin/knoxcli.sh user-auth-test --cluster ldapUsecase1Topo2 --u user1 --p > Test123 > org.apache.shiro.config.ConfigurationException: Unable to set property > 'contextFactory.systemPassword' with value [S{ALIAS=knoxldapsystempassword}] > on object of type org.apache.knox.gateway.shirorealm.KnoxLdapRealm. If > 'S{ALIAS=knoxldapsystempassword}' is a reference to another (previously > defined) object, prefix it with '$' to indicate that the referenced object > should be used as the actual value. For example, > $S{ALIAS=knoxldapsystempassword} > org.apache.knox.gateway.util.KnoxCLI$LDAPCommand$BadSubjectException: Subject > could not be created with Shiro Config at sections=main,urls > For more information use --d for debug output. > ERR: Unable to authenticate user: user1 > {noformat} > Note: we checked that the keystore has the right password value set: > {noformat} > # ${JAVA} GetValueFromJCEKS ${JCEKSFILE} ${JCEKSPASS} ${PW_ALIAS} > Test123 > {noformat} > > When the topology is configured with a plain password like: > {noformat} > <param> > <name>main.ldapRealm.contextFactory.systemPassword</name> > <value>Test123</value> > </param> > {noformat} > The validations run with no errors: > {noformat} > # bin/knoxcli.sh system-user-auth-test --cluster ldapUsecase1Topo3 > System LDAP Bind successful. > # bin/knoxcli.sh user-auth-test --cluster ldapUsecase1Topo3 --u user1 --p > Test123 > LDAP authentication successful!{noformat} -- This message was sent by Atlassian Jira (v8.20.10#820010)