EAS and Win2k3 Active Directory

I see that some people have successfully implemented an EAS on their system, and wondering if someone might be able to help.

I created a jaas.conf in $JAVA_HOME/jre/lib/security with the following content:

jaasEas {
com.pipeline.security.authen.JaasLdapLoginModule required
prefix=security.ias.eas.jaas.ldap;
};

I have also edited the java.security file to included this line:
login.config.url.1=file:${java.home}/lib/security/jaas.conf

And I created the file below and imported using configman -i command:

security.ias.eas.jaas.ldap.host.name ad.machine.oxy.edu
security.ias.eas.jaas.ldap.host.port 389
security.ias.eas.jaas.ldap.userid_format uid
security.ias.eas.max_bad_password_sync_attempt 4
security.ias.eas.jaas.ldap.protocol ldap
security.ias.eas.jaas.ldap.mapping.is_enabled false
security.ias.eas.jaas.ldap.searching.is_enabled true
security.ias.eas.jaas.ldap.searching.user.is_enabled true
security.ias.eas.jaas.ldap.searching.user.userid cn=adauthusr
security.ias.eas.jaas.ldap.searching.user.password *******
security.ias.eas.jaas.ldap.searching.dn dc\=oxynet,dc\=oxy,dc\=edu
security.ias.eas.jaas.ldap.searching.type uid

i have tried many different variations of values in security.ias.eas.jaas.ldap.searching.user.userid, but i always get the following error found in the cp.log:

[2008-04-19 21:59:51,520] [ERROR](JaasLdapLoginModule.java:543) {http-443-Processor25} [com.pipeline.security.authen.JaasLdapLoginModule]: com.pipeline.ds.DsException: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece^@

I have looked up LdapErr: DSID-0C090334 and I gather that the error is an indication that the userid provided in the config is not binding to the Active Directory.

Could someone give me a clue what I am doing wrong? or is there a step I missed somewhere? Any help you could give will be greatly appreciated. Thanks.

Sincerely,
Benjie Castro
Occidental College
Los Angeles

0
No votes yet

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Have you tried

Have you tried this?
security.ias.eas.jaas.ldap.searching.type sAMAccountName

Everything else looks good as far as I can tell. Not sure about security.ias.eas.max_bad_password_sync_attempt 4 though since we are not using that.

Jeff Brewster

tried almost every possible value i know

still haven't got it to work, though.

does anybody know if setting up EAS requires a valid SSL cert? the server i'm trying to configure for EAS is our test server, which obviously has a self-signed SSL.

are there other requirements that you know of?

Process to enable EAS

Where did you find the process to enable EAS to AD... on the Installation guide?

I am in the process of enabling this type of authentication too, but don't know where to start.

Thanks!

EAS Implementation Guide

You can download it from sungard customer support center: lp40000eaxim.pdf. I can email to you if you have problem getting it there.

I got the guide

Thank you very much... looked for it in the sungard website and found it!...

let's see how it goes!... :-) thanks

Isaura

Jaas EAS legacy login module

basically, i found that legacy module is more appropriate for our particular setup.

so i edited the jaas.conf file, which now looks like this:

jaasEas {
com.pipeline.security.authen.JaasEasLegacyLoginModule
required prefix=security.ias.eas;
};

and change the following configuration values:

security.ias.eas.host.name=ad.machine.oxy.edu
security.ias.eas.host.port=389
security.ias.eas.implementation=com.pipeline.security.authen.EasLDAPModule
security.ias.eas.implementation.userid_format=uid
security.ias.eas.is_enabled=true
security.ias.eas.jaas.context_name=jaasEas
security.ias.eas.mapping.is_enabled=false
security.ias.eas.max_bad_password_sync_attempt=4
security.ias.eas.protocol=ldap
security.ias.eas.protocol.version=3
security.ias.eas.searching.dn=dc\=oxynet,dc=\oxy,dc\=edu
security.ias.eas.searching.is_enabled=true
security.ias.eas.searching.type=sAMAccountName
security.ias.eas.searching.user.is_enabled=true
security.ias.eas.searching.user.password=********
security.ias.eas.searching.user.userid=adauthusr
security.ias.eas.userid_format=uid

so this actually worked for us.