2

I'm trying to integrate an old Development Tridion 2009 with an OpenLdap I installed in the same machine. I achieved to configure the Directory Service, ISAPI Filter and impersonation User in the Tridion. Also configured this impersonation user in the app pool of Content manager, in IIS.

I have added correctly some dummy users from the test openLDAP in the content manager. The problem is that when I try to log in Tridion with those users added, there appears an authentication problem, like the Ldap user does not exist.

Here are the Log of the Tridion CM application and the log of Windows Security: enter image description here enter image description here

The user is added correctly to Tridion as PRUEBA1:pepe1 with system admin checked, and the search chain provided in the ISAPI Filter should works enter image description here

If I make a search using the provided search user DN, the OpenLdapUser with I'm trying to log in Tridion is found: enter image description here

What could be the problem with the log of those Ldap users? Why is there the error: "unable to bind with admin user" in the Log?

NOTE: The group sync in directory service is disabled, I'm adding manually the users in Tridion.

Following Dominic tips I tried to connect using Ms LDP.exe to test the filter credentials. Making a simple bind seems to work. What kind of bind makes the tridion ISAPI filter?

enter image description here

| improve this question | | | | |
3

The error message "unable to bind with admin user" means there is a problem with the Search account credentials as defined in the LDAP ISAPI filter configuration.

| improve this answer | | | | |
  • 1
    The commonest cause of problems when configuring the LDAP integration is failing to pick up the latest configuration settings. If you really want to be sure, save your configuration settings, and then stop all the processes that will have had the configuration loaded. In the case of the ISAPI filter, IISRESET should do it, but really - to save your sanity, shut it all down. That means IIS, the COM+ application and the services. – Dominic Cronin♦ Dec 16 '15 at 19:59
  • I'm restarting COM+, services and IIS. The really strange is that with the credentials I show in my ISAPI Filter configuration, I can connect to LDAP using an LDAP client or make a search like shown in the capture. Should the search target prefix go followed with "=" or there is some requisite that the Search account DN must accomplish?? Thanks! – Julián Hernández Dec 16 '15 at 21:23
  • Could be, the password encryption in OpenLdap? Should be SSHA, Plain text, MD5??? – Julián Hernández Dec 17 '15 at 9:55
  • 1
    IIRC in the ISAPI filter settings you need the '='. – Dominic Cronin♦ Dec 17 '15 at 12:06
  • 1
    And if you are using LDAPS, make sure that the test client you are using uses the Windows certificate store. Most of the LDAP test clients you can download are Java based, and use the Java certificate store, so you'll get misleading results. I always used to use LDP.exe (technet.microsoft.com/en-us/library/cc772839(v=ws.10).aspx) from the support tools – Dominic Cronin♦ Dec 17 '15 at 12:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.