LDAP: error code 50

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

bparis

Hi,

if you need to authenticate against an ldap server in the situation where the uid is not in the DN, alfresco will search the DN making a query filterde with (&(objectclass=inetOrgPerson)(uid=entered_username))

To make this query succeeding, your ldap server has to permit the "principal" user in alfresco to query ALL attributes.  In a welldown ldap environment, only the attributes you really need should be available, so you get

javax.naming.NoPermissionException: [LDAP: error code 50 - Search not permitted for any attribute]; remaining name 'o=organization, c=be'

i think the code in LDAPUserRegistry.java should be modify to avoid this:

line 874 in method resolveDistinguishedName(String userId)

        userSearchCtls.setReturningAttributes(new String[] {});

should replaced with

        userSearchCtls.setReturningAttributes(new String[] {"uid"});

Bernard

dward

userSearchCtls.setReturningAttributes(new String[] {});

states that we don't want any attributes in our search result. We don't need the uid - we already have it.