I see that some people have successfully implemented an EAS on their system, and wondering if someone might be able to help.
I created a jaas.conf in $JAVA_HOME/jre/lib/security with the following content:
jaasEas {
com.pipeline.security.authen.JaasLdapLoginModule required
prefix=security.ias.eas.jaas.ldap;
};
I have also edited the java.security file to included this line:
login.config.url.1=file:${java.home}/lib/security/jaas.conf
And I created the file below and imported using configman -i command:
security.ias.eas.jaas.ldap.host.name ad.machine.oxy.edu
security.ias.eas.jaas.ldap.host.port 389
security.ias.eas.jaas.ldap.userid_format uid
security.ias.eas.max_bad_password_sync_attempt 4
security.ias.eas.jaas.ldap.protocol ldap
security.ias.eas.jaas.ldap.mapping.is_enabled false
security.ias.eas.jaas.ldap.searching.is_enabled true
security.ias.eas.jaas.ldap.searching.user.is_enabled true
security.ias.eas.jaas.ldap.searching.user.userid cn=adauthusr
security.ias.eas.jaas.ldap.searching.user.password *******
security.ias.eas.jaas.ldap.searching.dn dc\=oxynet,dc\=oxy,dc\=edu
security.ias.eas.jaas.ldap.searching.type uid
i have tried many different variations of values in security.ias.eas.jaas.ldap.searching.user.userid, but i always get the following error found in the cp.log:
[2008-04-19 21:59:51,520] [ERROR](JaasLdapLoginModule.java:543) {http-443-Processor25} [com.pipeline.security.authen.JaasLdapLoginModule]: com.pipeline.ds.DsException: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece^@
I have looked up LdapErr: DSID-0C090334 and I gather that the error is an indication that the userid provided in the config is not binding to the Active Directory.
Could someone give me a clue what I am doing wrong? or is there a step I missed somewhere? Any help you could give will be greatly appreciated. Thanks.
Sincerely,
Benjie Castro
Occidental College
Los Angeles
Have you tried
Have you tried this?
security.ias.eas.jaas.ldap.searching.type sAMAccountName
Everything else looks good as far as I can tell. Not sure about security.ias.eas.max_bad_password_sync_attempt 4 though since we are not using that.
Jeff Brewster
tried almost every possible value i know
still haven't got it to work, though.
does anybody know if setting up EAS requires a valid SSL cert? the server i'm trying to configure for EAS is our test server, which obviously has a self-signed SSL.
are there other requirements that you know of?
Process to enable EAS
Where did you find the process to enable EAS to AD... on the Installation guide?
I am in the process of enabling this type of authentication too, but don't know where to start.
Thanks!
EAS Implementation Guide
You can download it from sungard customer support center: lp40000eaxim.pdf. I can email to you if you have problem getting it there.
I got the guide
Thank you very much... looked for it in the sungard website and found it!...
let's see how it goes!... :-) thanks
Isaura
Jaas EAS legacy login module
basically, i found that legacy module is more appropriate for our particular setup.
so i edited the jaas.conf file, which now looks like this:
jaasEas {
com.pipeline.security.authen.JaasEasLegacyLoginModule
required prefix=security.ias.eas;
};
and change the following configuration values:
security.ias.eas.host.name=ad.machine.oxy.edu
security.ias.eas.host.port=389
security.ias.eas.implementation=com.pipeline.security.authen.EasLDAPModule
security.ias.eas.implementation.userid_format=uid
security.ias.eas.is_enabled=true
security.ias.eas.jaas.context_name=jaasEas
security.ias.eas.mapping.is_enabled=false
security.ias.eas.max_bad_password_sync_attempt=4
security.ias.eas.protocol=ldap
security.ias.eas.protocol.version=3
security.ias.eas.searching.dn=dc\=oxynet,dc=\oxy,dc\=edu
security.ias.eas.searching.is_enabled=true
security.ias.eas.searching.type=sAMAccountName
security.ias.eas.searching.user.is_enabled=true
security.ias.eas.searching.user.password=********
security.ias.eas.searching.user.userid=adauthusr
security.ias.eas.userid_format=uid
so this actually worked for us.