Worklight 6.2使用OpenDS對LDAP進行身份驗證

我正在努力使用openDS進行ldap身份驗證。我使用Worklight Studio 6.2和Apache DS 2.0作爲ldap瀏覽器。Worklight 6.2使用OpenDS對LDAP進行身份驗證

該項目應該調用登錄頁面，然後將用於驗證的用戶名和密碼提交給ldap。

我碰到下面的錯誤在Firefox的控制檯：

POST http://x.x.x.x:10080/LDAPTest/apps/services/j_security_check [HTTP/1.1 200 OK 253ms] 
undefined entity j_security_check:134

，並在工作燈控制檯蝕：

[WARNING ] FWLSE0138W: LdapLoginModule authentication failed. Reason 'javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials] 
[WARNING ] FWLSE0239W: Authentication failure in realm 'LDAPRealm': login fail [project LDAPTest]

我認爲問題是，要麼我的連接字符串或我challange處理程序。但我懷疑，因爲我的錯誤是無效的憑據，它必須是我在authenticationconfig.xml中的連接字符串。

我嘗試了好幾種方法，包括一些員額這裏如：

Worklight LDAP authentication using ApacheDS Worklight LDAP authentication using ApacheDS 2.0

還有其他。我遵循IBM LDAP示例進行設置，並且已經檢查確保我具有相同的結構。

任何幫助搞清楚這一點將不勝感激。此外，如果您認爲我應該檢查我的LDAP配置，我也可以發佈，我遵循openDS維基的教程。我能夠使用apache瀏覽器工作室和softera LDAP管理員連接到它。

我的項目如下： -

的index.html：

<!DOCTYPE HTML> 
<html> 
<head> 
<meta charset="UTF-8"> 
<title>LDAPTest</title> 
<meta name="viewport" 
    content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=0"> 
<!-- 
       <link rel="shortcut icon" href="images/favicon.png"> 
       <link rel="apple-touch-icon" href="images/apple-touch-icon.png"> 
      --> 
<link rel="stylesheet" href="css/main.css"> 
<script>window.$ = window.jQuery = WLJQ;</script> 
</head> 
<body style="display: none;"> 

    <div id="header"> 
     <h1>SigmaLDAP Login Module</h1> 
    </div> 

    <div id="wrapper"> 
     <div id="AppDiv"> 
      <input type="button" class="appButton" 
       value="Call protected adapter proc" onclick="getSecretData()" /> <input 
       type="button" class="appButton" value="Logout" 
       onclick="WL.Client.logout('LDAPRealm',{onSuccess: WL.Client.reloadApp})" /> 
      <p id="resultDiv"></p> 
     </div> 

     <div id="AuthDiv" style="display: none"> 
      <div id="loginForm"> 
       <input type="text" id="usernameInputField" 
        placeholder="Enter username" /> <br /> <input type="password" 
        placeholder="Enter password" id="passwordInputField" /> <br /> <input 
        type="button" class="formButton" id="loginButton" value="Login" /> 
       <input type="button" class="formButton" id="cancelButton" 
        value="Cancel" /> 
      </div> 
     </div> 
    </div> 


    <script src="js/initOptions.js"></script> 
    <script src="js/main.js"></script> 
    <script src="js/messages.js"></script> 
    <script src="js/LDAPRealmChallenger.js"></script> 
</body> 
</html>

Main.js

function wlCommonInit(){ 

} 

function getSecretData(){ 
    WL.Logger.info('invoking the adpater'); 
    var invocationData = { 
      adapter: "LDAPter", 
      procedure: "getSecretData", 
      parameters: [] 
    }; 

    WL.Client.invokeProcedure(invocationData, { 
     onSuccess: getSecretData_Callback, 
     onFailure: getSecretData_Callback, 
     timeout: 2000 
    }); 
} 

function getSecretData_Callback(response){ 
    $("#resultDiv").css("padding", "10px"); 
    $("#resultDiv").html(new Date() + "<hr/>"); 
    $("#resultDiv").append("Secret data :: " + response.invocationResult.secretData + "<hr/>"); 
    $("#resultDiv").append("Response :: " + JSON.stringify(response)); 
}

我Challenger.js

var LDAPRealmChallengeHandler = WL.Client.createChallengeHandler("LDAPRealm"); 

LDAPRealmChallengeHandler.isCustomResponse = function(response) { 
    if (!response || !response.responseText) { 
     WL.Logger.info('failed to authenticate'); 
    } 

    var idx = response.responseText.indexOf("j_security_check"); 

    if (idx >= 0){ 
     WL.Logger.info("Authenticated"); 
     return true; 
    } 
    return false; 

}; 

LDAPRealmChallengeHandler.handleChallenge = function(response){ 
     $('#AppDiv').hide(); 
     $('#AuthDiv').show(); 
     $('#passwordInputField').val(''); 
}; 

$('#loginButton').bind('click', function() { 
    var reqURL = '/j_security_check'; 
    var options = {}; 
    options.parameters = { 
      j_username : $('#usernameInputField').val(), 
      j_password : $('#passwordInputField').val() 
    }; 
    options.headers = {}; 
    LDAPRealmChallengeHandler.submitLoginForm(reqURL, options, LDAPRealmChallengeHandler.submitLoginFormCallback); 
}); 

$('#cancelButton').bind('click', function() { 
    $('#AppDiv').show(); 
    $('#AuthDiv').hide(); 
    LDAPRealmChallengeHandler.submitFailure(); 
}); 

LDAPRealmChallengeHandler.submitLoginFormCallback = function(response) { 
    var isLoginFormResponse = LDAPRealmChallengeHandler.isCustomResponse(response); 
    if (isLoginFormResponse){ 
     LDAPRealmChallengeHandler.handleChallenge(response); 
    } else { 
     $('#AppDiv').show(); 
     $('#AuthDiv').hide(); 
     LDAPRealmChallengeHandler.submitSuccess(); 
    } 
};

我adpater： js文件

function getSecretData(){ 
    console.log("getting you secrets mofos"); 
    return {secretData: 1234}; 
    }

的xml文件：

<?xml version="1.0" encoding="UTF-8"?> 
    <!-- 
     Licensed Materials - Property of IBM 
     5725-I43 (C) Copyright IBM Corp. 2011, 2013. All Rights Reserved. 
     US Government Users Restricted Rights - Use, duplication or 
     disclosure restricted by GSA ADP Schedule Contract with IBM Corp. 
    --> 
    <wl:adapter name="LDAPter" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xmlns:wl="http://www.worklight.com/integration" 
     xmlns:http="http://www.worklight.com/integration/http"> 

     <displayName>LDAPter</displayName> 
     <description>LDAPter</description> 
      <connectivity> 
      <connectionPolicy xsi:type="http:HTTPConnectionPolicyType"> 
       <protocol>http</protocol> 
       <domain>none</domain> 
       <port>80</port>   
      </connectionPolicy> 
      <loadConstraints maxConcurrentConnectionsPerNode="2" /> 
     </connectivity> 

     <procedure name="getSecretData" securityTest="LDAPSecurityTest" /> 
    </wl:adapter> 


The authenticationConfig.xml: 

<?xml version="1.0" encoding="UTF-8"?> 
<tns:loginConfiguration xmlns:tns="http://www.worklight.com/auth/config" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> 

    <!-- Licensed Materials - Property of IBM 5725-I43 (C) Copyright IBM Corp. 
     2006, 2013. All Rights Reserved. US Government Users Restricted Rights - 
     Use, duplication or disclosure restricted by GSA ADP Schedule Contract with 
     IBM Corp. --> 

    <staticResources> 
     <!-- <resource id="logUploadServlet" securityTest="LogUploadServlet"> <urlPatterns>/apps/services/loguploader*</urlPatterns> 
      </resource> --> 
     <resource id="subscribeServlet" securityTest="SubscribeServlet"> 
      <urlPatterns>/subscribeSMS*;/receiveSMS*;/ussd*</urlPatterns> 
     </resource> 

    </staticResources> 

    <!-- Sample security tests Even if not used there will be some default webSecurityTest 
     and mobileSecurityTest Attention: If you are adding an app authenticity realm 
     to a security test, you must also update the application-descriptor.xml. 
     Please refer to the user documentation on application authenticity for environment 
     specific guidelines. --> 

    <securityTests> 

     <customSecurityTest name="LDAPSecurityTest"> 
       <test isInternalUserID="true" realm="LDAPRealm" /> 
     </customSecurityTest> 

     <!-- <mobileSecurityTest name="mobileTests"> <testAppAuthenticity/> <testDeviceId 
      provisioningType="none" /> <testUser realm="myMobileLoginForm" /> <testDirectUpdate 
      mode="perSession" /> </mobileSecurityTest> <webSecurityTest name="webTests"> 
      <testUser realm="myWebLoginForm"/> </webSecurityTest> <customSecurityTest 
      name="customTests"> <test realm="wl_antiXSRFRealm" step="1"/> <test realm="wl_authenticityRealm" 
      step="1"/> <test realm="wl_remoteDisableRealm" step="1"/> <test realm="wl_directUpdateRealm" 
      mode="perSession" step="1"/> <test realm="wl_anonymousUserRealm" isInternalUserID="true" 
      step="1"/> <test realm="wl_deviceNoProvisioningRealm" isInternalDeviceID="true" 
      step="2"/> </customSecurityTest> <customSecurityTest name="LogUploadServlet"> 
      <test realm="wl_anonymousUserRealm" step="1"/> <test realm="LogUploadServlet" 
      isInternalUserID="true"/> </customSecurityTest> --> 
     <customSecurityTest name="SubscribeServlet"> 
      <test realm="SubscribeServlet" isInternalUserID="true" /> 
     </customSecurityTest> 

    </securityTests> 

    <realms> 

     <realm loginModule="LDAPLoginModule" name="LDAPRealm"> 
      <className>com.worklight.core.auth.ext.FormBasedAuthenticator</className> 
      <onLoginUrl>/console</onLoginUrl> 
     </realm> 

     <realm name="SubscribeServlet" loginModule="rejectAll"> 
      <className>com.worklight.core.auth.ext.HeaderAuthenticator</className> 
     </realm> 

     <!-- For client logger --> 
     <!-- <realm name="LogUploadServlet" loginModule="StrongDummy"> <className>com.worklight.core.auth.ext.HeaderAuthenticator</className> 
      </realm --> 

     <!-- For websphere --> 
     <!-- realm name="WASLTPARealm" loginModule="WASLTPAModule"> <className>com.worklight.core.auth.ext.WebSphereFormBasedAuthenticator</className> 
      <parameter name="login-page" value="/login.html"/> <parameter name="error-page" 
      value="/loginError.html"/> </realm --> 

     <!-- For User Certificate Authentication --> 
     <!-- realm name="wl_userCertificateAuthRealm" loginModule="WLUserCertificateLoginModule"> 
      <className>com.worklight.core.auth.ext.UserCertificateAuthenticator</className> 
      <parameter name="dependent-user-auth-realm" value="WASLTPARealm" /> <parameter 
      name="pki-bridge-class" value="com.worklight.core.auth.ext.UserCertificateEmbeddedPKI" 
      /> <parameter name="embedded-pki-bridge-ca-p12-file-path" value="/opt/ssl_ca/ca.p12"/> 
      <parameter name="embedded-pki-bridge-ca-p12-password" value="capassword" 
      /> </realm --> 

     <!-- For Trusteer Fraud Detection --> 
     <!-- Requires acquiring Trusteer SDK --> 
     <!-- realm name="wl_basicTrusteerFraudDetectionRealm" loginModule="trusteerFraudDetectionLogin"> 
      <className>com.worklight.core.auth.ext.TrusteerAuthenticator</className> 
      <parameter name="rooted-device" value="block"/> <parameter name="device-with-malware" 
      value="block"/> <parameter name="rooted-hiders" value="block"/> <parameter 
      name="unsecured-wifi" value="alert"/> <parameter name="outdated-configuration" 
      value="alert"/> </realm --> 

    </realms> 

    <loginModules> 

     <loginModule name="LDAPLoginModule"> 
      <className>com.worklight.core.auth.ext.LdapLoginModule</className> 
      <parameter name="ldapProviderUrl" value="ldap://localhost:389/dc=sigma,dc=com" /> 
      <parameter name="ldapTimeoutMs" value="2000"/> 
      <parameter name="ldapSecurityAuthentication" value="simple"/> 
      <parameter name="validationType" value="searchPattern"/> 
      <parameter name="ldapSecurityPrincipalPattern" value="uid={username},ou=users,dc=sigma,dc=com"/> 
      <parameter name="ldapSearchFilterPattern" value="(uid={username})"/> 
      <parameter name="ldapSearchBase" value="ou=users,dc=sigma,dc=com"/> 
     </loginModule> 

     <loginModule name="StrongDummy"> 
      <className>com.worklight.core.auth.ext.NonValidatingLoginModule</className> 
     </loginModule> 

     <loginModule name="requireLogin"> 
      <className>com.worklight.core.auth.ext.SingleIdentityLoginModule</className> 
     </loginModule> 

     <loginModule name="rejectAll"> 
      <className>com.worklight.core.auth.ext.RejectingLoginModule</className> 
     </loginModule> 

     <!-- Required for Trusteer - wl_basicTrusteerFraudDetectionRealm --> 
     <!-- loginModule name="trusteerFraudDetectionLogin"> <className>com.worklight.core.auth.ext.TrusteerLoginModule</className> 
      </loginModule --> 

     <!-- For websphere --> 
     <!-- loginModule name="WASLTPAModule"> <className>com.worklight.core.auth.ext.WebSphereLoginModule</className> 
      </loginModule --> 

     <!-- Login module for User Certificate Authentication --> 
     <!-- <loginModule name="WLUserCertificateLoginModule"> <className>com.worklight.core.auth.ext.UserCertificateLoginModule</className> 
      </loginModule> --> 


     <!-- For enabling SSO with no-provisioning device authentication --> 
     <!-- <loginModule name="MySSO" ssoDeviceLoginModule="WLDeviceNoProvisioningLoginModule"> 
      <className>com.worklight.core.auth.ext.NonValidatingLoginModule</className> 
      </loginModule> --> 


     <!-- For enabling SSO with auto-provisioning device authentication --> 
     <!-- <loginModule name="MySSO" ssoDeviceLoginModule="WLDeviceAutoProvisioningLoginModule"> 
      <className>com.worklight.core.auth.ext.NonValidatingLoginModule</className> 
      </loginModule> --> 
    </loginModules> 

</tns:loginConfiguration>

從j_security_check的響應

Request URL: http://x.x.x.x:10080/LDAPTest/apps/services/j_security_check 
Request Method:  POST 
Status Code: HTTP/1.1 200 OK 


Request Headers 12:47:00.000 
x-wl-app-version: 1.0 
x-wl-analytics-tracking-id: a948e425-1ace-a28b-3d27-11bac5ba3de3 
X-Requested-With: XMLHttpRequest 
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0 
Referer: http://10.2.38.14:10080/LDAPTest/apps/services/preview/LDAPTest/common/0/default/index.html 
Pragma: no-cache 
Host: 10.2.38.14:10080 
Content-Type: application/x-www-form-urlencoded; charset=UTF-8 
Content-Length: 37 
Connection: keep-alive 
Cache-Control: no-cache 
Accept-Language: en-US 
Accept-Encoding: gzip, deflate 
Accept: text/javascript, text/html, application/xml, text/xml, */* 


Sent Cookie 
WL_PERSISTENT_COOKIE: b24de65a-9c5a-4f58-97d7-348e92c78034 
testcookie: oreo 
LtpaToken2: rZBXVP4XKLnpvJpLFrp3UArtZGrcsGAXr4jGDTBurns9Ej5Nrx1s4/yWsDJJN6xfWkxWh1/3bBruHvL9twdae1qVcE2/D/0GfMwd1pVLbpowclNLFtqKBonEXxV6TlFIVaKgKz62SHR2to3Az/vbTjF+ZH8V1QnAdGi6dC8mk+wympju0P/4hLKWHseN9Sty2UM94cL2Cd+vcBGhJ5QVF211RIwQTXuGeQl+WMTg6B8Kfjlvly4sanyVr5va2AW38752VNEWtdnsrTHcayO/lAG1SyebFEKtaTVZhOPBkml5m6AojEGlDbcUjjof6e9H 
JSESSIONID: 0000QTvrT7OBSgjn7OJG9XPMtIE:b45f2ac7-fb59-4da4-b233-f8bc81b81cf0 


Response Headers Δ315ms 
X-Powered-By: Servlet/3.0 
Transfer-Encoding: chunked 
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" 
Expires: -1 
Date: Mon, 10 Nov 2014 11:47:00 GMT 
Content-Language: en-US

而firefox控制檯也會返回未定義的實體j_sescurity_check和行號134，它在下面的代碼片段中是dic之前的最後一行。它指向的代碼如下：

body onload="isPopup(); setFocus();"> 
     <div id="authenticatorLoginFormWrapper"> 
      <h1>IBM</h1> 
      <h2>IBM Worklight</h2> 
      <form method="post" action="j_security_check"> 
       <p id="error">Please check the credentials</p> 
       <label for="j_username">User name:</label> 
       <input type="text" id="j_username" name="j_username" placeholder="User name" /> 
       <br /> 
       <label for="j_password">Password:</label> 
       <input type="password" id="j_password" name="j_password" placeholder="Password" /> 
       <br /> 
       <input type="submit" id="login" name="login" value="Log In" /> 
      </form> 
      <p id="copyright">&copy; 2006, 2012 IBM Corporation. <a href="#" target="_blank">Trademark</a></p> 
     </div>

來源

2014-11-04 Anthony K

我沒有看到任何錯誤立即。您可以發佈POST http：//x.x.x.x響應的內容：10080/LDAPTest/apps/services/j_security_check嗎？可能存在挑戰處理程序無法處理的隱藏錯誤。 – Mike 2014-11-05 15:04:47

抱歉，遲到的迴應Mike，請查找上面添加的j_security_check的內容作爲編輯。我沒有發現任何有用的東西。我一直在玩弄我的連接字符串，試圖找出問題出在哪裏，但沒有確定性 – 2014-11-10 11:58:04

你可以嘗試消除您的設置一些變量，並嘗試作爲第一步，檢查您的LDAP服務器的配置是否正確？

您可以使用此：https://serverfault.com/questions/514870/how-do-i-authenticate-with-ldap-via-the-command-line

使用命令行工具

來源

2015-11-02 14:27:11

我有一個類似的問題，做您的LDAP服務器的簡單連接，並在我的情況下工作的配置是從simple移到exists檢查authenticationConfig.xml文件。但特別是大躍進在ldapSecurityPrincipalPattern中不再使用uid，而是爲用戶使用cn。

我粘貼下面希望你（請在我的特定情況下，我的設置注意測試服務器corp.workgroup.com域）是非常有用的配置：

<loginModules> 
    <loginModule expirationInSeconds="-1" name="LDAPLoginModule"> 
    <className>com.worklight.core.auth.ext.LdapLoginModule</className> 
    <parameter name="ldapProviderUrl" value="ldap://yourserver" /> 
    <parameter name="ldapTimeoutMs" value="2000" /> 
    <parameter name="ldapSecurityAuthentication" value="simple" /> 
    <parameter name="validationType" value="exists" /> 
    <parameter name="ldapSecurityPrincipalPattern" value="cn={username},cn=Users,dc=corp,dc=workgroup,dc=com" /> 
    <parameter name="ldapReferral" value="ignore" /> 
</loginModule>

來源

2015-11-09 21:00:31 maggix

Worklight 6.2使用OpenDS對LDAP進行身份驗證

回答

相關問題