Question

我在WSO2 Identity Manager（独立版本）上关注Active Directory的WSO2指南。我正在尝试将我的WSO2服务器与公司LDAP连接。我将管理员用户名/密码设置为现有用户，设置连接属性（从apache目录工作室我可以访问活动目录），我设置查询以获取用户但我收到此错误：

13.6.2017 13:24:12[2017-06-13 11:24:12,318] ERROR - DataEndpointConnectionWorker Error while trying to connect to the endpoint. Cannot borrow client for ssl://10.42.210.146:9711
13.6.2017 13:24:12org.wso2.carbon.databridge.agent.exception.DataEndpointAuthenticationException: Cannot borrow client for ssl://10.42.210.146:9711
13.6.2017 13:24:12  at org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker.connect(DataEndpointConnectionWorker.java:99)
13.6.2017 13:24:12  at org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker.run(DataEndpointConnectionWorker.java:42)
13.6.2017 13:24:12  at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
13.6.2017 13:24:12  at java.util.concurrent.FutureTask.run(FutureTask.java:266)
13.6.2017 13:24:12  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
13.6.2017 13:24:12  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
13.6.2017 13:24:12  at java.lang.Thread.run(Thread.java:745)
13.6.2017 13:24:12Caused by: org.wso2.carbon.databridge.agent.exception.DataEndpointAuthenticationException: Error while trying to login to data receiver :/10.42.210.146:9711
13.6.2017 13:24:12  at org.wso2.carbon.databridge.agent.endpoint.binary.BinaryDataEndpoint.login(BinaryDataEndpoint.java:47)
13.6.2017 13:24:12  at org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker.connect(DataEndpointConnectionWorker.java:93)
13.6.2017 13:24:12  ... 6 more
13.6.2017 13:24:12Caused by: org.wso2.carbon.databridge.commons.exception.AuthenticationException: wrong userName or password
13.6.2017 13:24:12  at sun.reflect.GeneratedConstructorAccessor207.newInstance(Unknown Source)
13.6.2017 13:24:12  at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
13.6.2017 13:24:12  at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
13.6.2017 13:24:12  at org.wso2.carbon.databridge.agent.endpoint.binary.BinaryEventSender.processResponse(BinaryEventSender.java:162)
13.6.2017 13:24:12  at org.wso2.carbon.databridge.agent.endpoint.binary.BinaryDataEndpoint.login(BinaryDataEndpoint.java:42)
13.6.2017 13:24:12  ... 7 more

我已设置此配置：

<UserManager>
    <Realm>
        <Configuration>
            <AddAdmin>false</AddAdmin>
            <AdminRole>admin</AdminRole>
            <AdminUser>
                <UserName>it\wso2system</UserName>
                <Password>mypassword</Password>
            </AdminUser>
            <EveryOneRoleName>everyone</EveryOneRoleName>
            <!-- By default users in this role sees the registry root -->
            <Property name="isCascadeDeleteEnabled">true</Property>
            <Property name="initializeNewClaimManager">true</Property>
            <Property name="dataSource">jdbc/WSO2CarbonDB</Property>
        </Configuration>

和AD-Connection：

    <UserStoreManager class="org.wso2.carbon.user.core.ldap.ActiveDirectoryUserStoreManager">
        <Property name="TenantManager">org.wso2.carbon.user.core.tenant.CommonHybridLDAPTenantManager</Property>
        <Property name="ConnectionURL">ldap://activedirectory.local:389</Property>
        <Property name="ConnectionName">it\wso2system</Property>
        <Property name="ConnectionPassword">mypassword</Property>
        <Property name="AnonymousBind">false</Property>
        <Property name="UserSearchBase">...my working search query from directory studio ...</Property>
        <Property name="UserEntryObjectClass">user</Property>
        <Property name="UserNameAttribute">cn</Property>
        <Property name="UserNameSearchFilter">(&amp;(objectCategory=Person)(sAMAccountName=*))</Property>
        <Property name="UserNameListFilter">(objectClass=user)</Property>
        <Property name="DisplayNameAttribute"/>
        <Property name="ReadGroups">false</Property>
        <Property name="WriteGroups">false</Property>
        <Property name="GroupSearchBase">ou=system</Property>
        <Property name="GroupEntryObjectClass">group</Property>
        <Property name="GroupNameAttribute">cn</Property>
        <Property name="GroupNameSearchFilter">(&amp;(objectClass=group)(cn=?))</Property>
        <Property name="GroupNameListFilter">(objectcategory=group)</Property>
        <Property name="MembershipAttribute">member</Property>
        <Property name="MemberOfAttribute">memberOf</Property>
        <Property name="BackLinksEnabled">true</Property>
        <Property name="Referral">follow</Property>
        <Property name="UsernameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
        <Property name="UsernameJavaScriptRegEx">^[\S]{3,30}$</Property>
        <Property name="UsernameJavaRegExViolationErrorMsg">Username pattern policy violated</Property>
        <Property name="PasswordJavaRegEx">^[\S]{5,30}$</Property>
        <Property name="PasswordJavaRegExViolationErrorMsg">Password length should be within 5 to 30 characters</Property>
        <Property name="RolenameJavaRegEx">[a-zA-Z0-9._-|//]{3,30}$</Property>
        <Property name="RolenameJavaScriptRegEx">^[\S]{3,30}$</Property>
        <Property name="SCIMEnabled">false</Property>
        <Property name="IsBulkImportSupported">true</Property>
        <Property name="EmptyRolesAllowed">true</Property>
        <Property name="PasswordHashMethod">PLAIN_TEXT</Property>
        <Property name="MultiAttributeSeparator">,</Property>
        <Property name="isADLDSRole">false</Property>
        <Property name="userAccountControl">512</Property>
        <Property name="MaxUserNameListLength">100</Property>
        <Property name="MaxRoleNameListLength">100</Property>
        <Property name="kdcEnabled">false</Property>
        <Property name="defaultRealmName">WSO2.ORG</Property>
        <Property name="UserRolesCacheEnabled">true</Property>
        <Property name="ConnectionPoolingEnabled">false</Property>
        <Property name="LDAPConnectionTimeout">5000</Property>
        <Property name="ReadTimeout"/>
        <Property name="RetryAttempts"/>
    </UserStoreManager>

我错过了一些配置文件吗？使用之前工作的标准数据库配置，切换后我得到上面提到的错误PLUS我无法登录wso2（既不存储，也不存在apim oder碳）。

我们没有在AD中定义角色，我们只想验证WSO2用户。

任何帮助表示赞赏：）

Answer 1

我的第一条建议是通过碳添加您的LDAP，添加一个辅助用户存储。对于ID 5.3.0，其中有一些documentation。如果您想沿着这条路走下去，首先应该将原来的管理员日志放回去。（所以你至少可以登录碳。）并放回JDBC商店。

<AddAdmin>true</AddAdmin>
<AdminRole>admin</AdminRole>
   <AdminUser>
     <UserName>admin</UserName>
     <Password>admin</Password>
    </AdminUser>

如果您确实进入辅助用户存储区，它将自动在/ repository / deployment / server / userstores下创建用户存储的XML文件。

以下是用户商店文件的示例。

<?xml version="1.0" encoding="UTF-8"?>
<UserStoreManager class="org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager">
   <Property name="ConnectionURL">ldap://domain.com:389</Property>
   <Property name="ConnectionName">CN=user,OU=work,DC=domain,DC=com</Property>
   <Property encrypted="true" name="ConnectionPassword">cantseethat</Property>
   <Property name="UserSearchBase">OU=Unit,DC=domain,DC=com</Property>
   <Property name="UserNameAttribute">cn</Property>
   <Property name="UserNameSearchFilter">(&amp;(objectClass=person)(cn=?))</Property>
   <Property name="UserNameListFilter">(objectClass=person)</Property>
   <Property name="UserDNPattern"/>
   <Property name="DisplayNameAttribute">name</Property>
   <Property name="Disabled">false</Property>
   <Property name="ReadGroups">true</Property>
   <Property name="GroupSearchBase">OU=R,DC=domain,DC=com</Property>
   <Property name="GroupNameAttribute">cn</Property>
   <Property name="GroupNameSearchFilter">(&amp;(objectClass=group)(cn=?))</Property>
   <Property name="GroupNameListFilter">(objectClass=group)</Property>
   <Property name="RoleDNPattern"/>
   <Property name="MembershipAttribute">member</Property>
   <Property name="MemberOfAttribute">memberOf</Property>
   <Property name="BackLinksEnabled">false</Property>
   <Property name="ReplaceEscapeCharactersAtUserLogin">true</Property>
   <Property name="SCIMEnabled">false</Property>
   <Property name="PasswordHashMethod">PLAIN_TEXT</Property>
   <Property name="MultiAttributeSeparator">,</Property>
   <Property name="MaxUserNameListLength">100</Property>
   <Property name="MaxRoleNameListLength">100</Property>
   <Property name="UserRolesCacheEnabled">true</Property>
   <Property name="ConnectionPoolingEnabled">false</Property>
   <Property name="LDAPConnectionTimeout">5000</Property>
   <Property name="ReadTimeout">5000</Property>
   <Property name="RetryAttempts">0</Property>
   <Property name="CountRetrieverClass"/>
   <Property name="java.naming.ldap.attributes.binary"> </Property>
   <Property name="DomainName">Domain</Property>
   <Property name="Description">LDAP User Store</Property>
</UserStoreManager>

其他东西

在/repository/conf/identity/embedded-ldap.xml

下禁用嵌入式LDAP

<EmbeddedLDAP>
    <Property name="enable">false</Property>

“如果您使用LDAPS（安全）连接到Active Directory，则需要将其公共证书导入到正在配置的WSO2产品的client-truststore.jks中。” Oracle: Import Cert 也可以在keystore下使用carbon导入。

抱歉，我的帮助不大。

Answer 2

这个问题的解决方案有点棘手，但我们走了：

经过几次尝试，我决定使用LDAP Readonly Connector将AD连接设置为辅助用户存储。我陷入了NullPointerException。

我得到了wso2am的源代码并开始调试。服务器尝试打开证书链以获取加密密码的公钥。这条链没有正确回退

TID: [-1234] [] [2017-06-20 12:18:21,318] ERROR {org.apache.axis2.rpc.receivers.RPCMessageReceiver} -  Exception occurred while trying
to invoke service method addUserStore {org.apache.axis2.rpc.receivers.RPCMessageReceiver}
java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.apache.axis2.rpc.receivers.RPCUtil.invokeServiceClass(RPCUtil.java:212)
        at org.apache.axis2.rpc.receivers.RPCMessageReceiver.invokeBusinessLogic(RPCMessageReceiver.java:117)
        at org.apache.axis2.receivers.AbstractInOutMessageReceiver.invokeBusinessLogic(AbstractInOutMessageReceiver.java:40)
        at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180)
        at org.apache.axis2.transport.local.LocalTransportReceiver.processMessage(LocalTransportReceiver.java:169)
        at org.apache.axis2.transport.local.LocalTransportReceiver.processMessage(LocalTransportReceiver.java:82)
        at org.wso2.carbon.core.transports.local.CarbonLocalTransportSender.finalizeSendWithToAddress(CarbonLocalTransportSender.java:4
5)
        at org.apache.axis2.transport.local.LocalTransportSender.invoke(LocalTransportSender.java:77)
        at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:442)
        at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:430)
        at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:225)
        at org.apache.axis2.client.OperationClient.execute(OperationClient.java:149)
        at org.wso2.carbon.identity.user.store.configuration.stub.UserStoreConfigAdminServiceStub.addUserStore(UserStoreConfigAdminServ
iceStub.java:889)
        at org.wso2.carbon.identity.user.store.configuration.ui.client.UserStoreConfigAdminServiceClient.addUserStore(UserStoreConfigAd
minServiceClient.java:95)
        at org.apache.jsp.userstore_005fconfig.userstore_002dconfig_002dfinish_002dajaxprocessor_jsp._jspService(userstore_002dconfig_0
02dfinish_002dajaxprocessor_jsp.java:198)
        at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
        at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:439)
        at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:395)
        at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:339)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
        at org.wso2.carbon.ui.JspServlet.service(JspServlet.java:155)
        at org.wso2.carbon.ui.TilesJspServlet.service(TilesJspServlet.java:80)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
        at org.eclipse.equinox.http.helper.ContextPathServletAdaptor.service(ContextPathServletAdaptor.java:37)
        at org.eclipse.equinox.http.servlet.internal.ServletRegistration.service(ServletRegistration.java:61)
        at org.eclipse.equinox.http.servlet.internal.ProxyServlet.processAlias(ProxyServlet.java:128)
        at org.eclipse.equinox.http.servlet.internal.ProxyServlet.service(ProxyServlet.java:68)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
        at org.wso2.carbon.tomcat.ext.servlet.DelegationServlet.service(DelegationServlet.java:68)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.owasp.csrfguard.CsrfGuardFilter.doFilter(CsrfGuardFilter.java:88)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.wso2.carbon.tomcat.ext.filter.CharacterSetFilter.doFilter(CharacterSetFilter.java:61)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:120)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
        at org.wso2.carbon.tomcat.ext.valves.CompositeValve.continueInvocation(CompositeValve.java:99)
        at org.wso2.carbon.tomcat.ext.valves.CarbonTomcatValve$1.invoke(CarbonTomcatValve.java:47)
        at org.wso2.carbon.webapp.mgt.TenantLazyLoaderValve.invoke(TenantLazyLoaderValve.java:57)
        at org.wso2.carbon.event.receiver.core.internal.tenantmgt.TenantLazyLoaderValve.invoke(TenantLazyLoaderValve.java:48)
        at org.wso2.carbon.tomcat.ext.valves.TomcatValveContainer.invokeValves(TomcatValveContainer.java:47)
        at org.wso2.carbon.tomcat.ext.valves.CompositeValve.invoke(CompositeValve.java:62)
        at org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.invoke(CarbonStuckThreadDetectionValve.java:159)
        at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:958)
        at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:57)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:452)
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1087)
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1756)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1715)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.NullPointerException
        at org.wso2.carbon.identity.user.store.configuration.utils.SecondaryUserStoreConfigurationUtil.initializeKeyStore(SecondaryUserStoreConfigurationUtil.java:82)
        at org.wso2.carbon.identity.user.store.configuration.utils.SecondaryUserStoreConfigurationUtil.encryptPlainText(SecondaryUserStoreConfigurationUtil.java:125)
        at org.wso2.carbon.identity.user.store.configuration.UserStoreConfigAdminService.addProperties(UserStoreConfigAdminService.java:569)
        at org.wso2.carbon.identity.user.store.configuration.UserStoreConfigAdminService.writeUserMgtXMLFile(UserStoreConfigAdminService.java:812)
        at org.wso2.carbon.identity.user.store.configuration.UserStoreConfigAdminService.addUserStore(UserStoreConfigAdminService.java:270)
        ... 76 more

为了解决这个问题，我提取了代码并将其放入一个独立的程序which can be found on our github site.

我发现，链条没有充分包装到密钥库中。为了创建一个工作密钥库，我遵循了Non的回答to this stackoverflow。

我得到了

我的服务器证书（PEM）
去爸爸包证书，包括root（PEM）
去爸爸安全服务器证书（PEM）
证书密钥（来自CSR的密钥文件）

要了解这三个证书you may look here

按照上面提到的帖子回答我做了

> cat server.crt bundle-g2-g1.crt gdig2.crt >combined.crt
> openssl pkcs12 -export -chain -in server.crt -inkey server.key -out keystore.p12 -name wso2carbon -CAfile combined.crt
> keytool -importkeystore -destkeystore wso2carbon.jks -srckeystore keystore.p12 -alias wso2carbon

创建的密钥库成功通过了我的测试程序。已安装的wso2实例已成功保存AD连接，并且未创建任何SSL问题。

PS：我还从PKCS12格式的操作中获得了密钥库。一个人无法将其转换为jks密钥库，血腥的keytool DROPS链！

WSO2：连接到ldap失败

2 个答案:

其他东西