agora inbox for pgsql-admin@postgresql.org
help / color / mirror / Atom feedLDAP authentication problem.
3+ messages / 3 participants
[nested] [flat]
* LDAP authentication problem.
@ 2015-01-26 16:38 Luc DALLEMANE <ldallemane@alaloop.com>
0 siblings, 0 replies; 3+ messages in thread
From: Luc DALLEMANE @ 2015-01-26 16:38 UTC (permalink / raw)
To: pgsql-admin
Hello,
I'm facing a problem with my web application.
For this project, I'm using :
Java 1.8, Postgres 9.4, Tomcat 7.0.56 and a cisco asa firewall.
The firewall is configured with an IP and port restriction.
The Web part is located in a DMZ and the database part in the LAN.
I'm using a combined REALM (LDAP and Database).
The problem is the following, we can connect to the application and use it, but after a while (don't know really when), you cannot connect again.
In the log, I can see that the LDAP authentication never ends. (I have put logs before and after calling the authenticate method but the last log is never displayed)
In tomcat log, the problem begins with :
org.apache.catalina.core.StandardService stopInternal
INFO: Stopping service Catalina
When we check the firewall, we get the following message :
Deny TCP (no connection) from WEB/50790 to DB/5432 FIN ACK on interface DMZ_clients
You have to restart tomcat to fix this bug and it works again (for a while...)
I can't find the cause of this problem.
Any answers are welcome.
Luc.
^ permalink raw reply [nested|flat] 3+ messages in thread
* LDAP authentication problem
@ 2024-10-18 11:29 =?iso-8859-2?Q?Domen_=A9etar?= <domen.setar@izum.si>
2024-10-19 04:49 ` Re: LDAP authentication problem Achilleas Mantzios <a.mantzios@cloud.gatewaynet.com>
0 siblings, 1 reply; 3+ messages in thread
From: Domen Šetar @ 2024-10-18 11:29 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Hi Admins,
I have faced very strange problem in one of my postgresql servers. We use LDAP authentication.
Several colegues can't login with their AD accounts into the server. I found error messages in postgresql log:
2024-10-18 07:23:46 CEST [3203974]: [2-1] ... could not search LDAP for filter "(samaccountname=johndoe)" on server "adc1 adc2": Operations error
2024-10-18 07:23:46 CEST [3203974]: [3-1] ... DETAIL: LDAP diagnostics: 000004DC: LdapErr: DSID-0C090C78, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c
2024-10-18 07:23:46 CEST [3203974]: [4-1] ... FATAL: LDAP authentication failed for user "johndoe"
I can login with my AD account.
Ldapsearch works from the host.
My colegues can login with the same LDAP account to postgresql on antoher hosts.
I'm out of ideas what could be wrong.
Best regards!
[izum]
Domen Šetar
Computer Systems Support
IZUM - Institute of Information Science | Prešernova ulica 17 | 2000 Maribor | Slovenia
T: +386 2 25 20 339 | M: +386 41 676 342 | www.izum.si<http://www.izum.si/; | domen.setar@izum.si<mailto:domen.setar@izum.si>
Attachments:
[image/jpeg] image002.jpg (1.3K, ../../c3560ede2a4c4892abf29448e7e07755@izum.si/3-image002.jpg)
download | view image
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: LDAP authentication problem
2024-10-18 11:29 LDAP authentication problem =?iso-8859-2?Q?Domen_=A9etar?= <domen.setar@izum.si>
@ 2024-10-19 04:49 ` Achilleas Mantzios <a.mantzios@cloud.gatewaynet.com>
0 siblings, 0 replies; 3+ messages in thread
From: Achilleas Mantzios @ 2024-10-19 04:49 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org
Στις 18/10/24 14:29, ο/η Domen Šetar έγραψε:
> Hi Admins,
>
> I have faced very strange problem in one of my postgresql servers. We
> use LDAP authentication.
>
> Several colegues can't login with their AD accounts into the server. I
> found error messages in postgresql log:
>
> 2024-10-18 07:23:46 CEST [3203974]: [2-1] … could not search LDAP for
> filter "(samaccountname=johndoe)" on server "adc1 adc2": Operations error
>
> 2024-10-18 07:23:46 CEST [3203974]: [3-1] … DETAIL: LDAP diagnostics:
> 000004DC: LdapErr: DSID-0C090C78, comment: In order to perform this
> operation a successful bind must be completed on the connection., data
> 0, v4f7c
>
> 2024-10-18 07:23:46 CEST [3203974]: [4-1] … FATAL: LDAP
> authentication failed for user "johndoe”
>
> I can login with my AD account.
>
> Ldapsearch works from the host.
>
> My colegues can login with the same LDAP account to postgresql on
> antoher hosts.
>
Can you post the effective pg_hba.conf lines? What does the AD logs say ?
BTW, Had you looked for AD alternatives before deploying it? Such as
FreeIPA ? OpenLDAP ?
> I'm out of ideas what could be wrong.
>
> Best regards!
>
> izum
>
>
>
> Domen Šetar
> /Computer Systems Support/
> IZUM – Institute of Information Science| Prešernova ulica 17 | 2000
> Maribor |Slovenia/
> /T: +386 2 25 20 339| M: +386 41 676 342| www.izum.si
> <http://www.izum.si/;|domen.setar@izum.si <mailto:domen.setar@izum.si>
>
Attachments:
[image/jpeg] image002.jpg (1.3K, ../../cf3917de-2136-4237-924a-0f0b66e3587b@cloud.gatewaynet.com/3-image002.jpg)
download | view image
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2024-10-19 04:49 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2015-01-26 16:38 LDAP authentication problem. Luc DALLEMANE <ldallemane@alaloop.com>
2024-10-18 11:29 LDAP authentication problem =?iso-8859-2?Q?Domen_=A9etar?= <domen.setar@izum.si>
2024-10-19 04:49 ` Re: LDAP authentication problem Achilleas Mantzios <a.mantzios@cloud.gatewaynet.com>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox