[Resolved] - Active Directory Authentification

Jean-Christoph1

Hello,

I'm having trouble getting LDAP ActiveDirectory authentication to work on my Nuxeo Server instance (I configured the options using the nuxeo.conf file) on Linux The error message in the web interface is "Failed to connect to authentication database". The connection with the "Emergency Administrator" account works After modifying the Log4j configuration as described in the documentation, there is only one line corresponding to the LDAP request:

2021-09-03T11:43:21,029 DEBUG [http-nio-0.0.0.0-8080-exec-8] [org.nuxeo.ecm.directory.ldap.LDAPSession] LDAPSession.getLdapEntry(Nuxeo, false): LDAP search base='DC=myDomain,DC=local' filter='(&(sAMAccountName={0})(&(objectClass=person)(sAMAccountName=*))' args='user' scope='2' [LDAPSession for directory ldapUserDirectory]

This request is also visible in the Active Directory server logs This request running on the Nuxeo Linux server from Apache Directory Studio correctly returns the account information. I think the configuration is correct because this same instance was installed on a Windows server and it works (there are other lines on the response to the LDAP request unlike the Linux instance)

Additional details:

• Wireshark analysis shows successful LDAP request on Nuxeo server
• The goal is to not use a Windows system for the Nuxeo instance 😉

The environment used is :

• a Linux distribution Debian 10 (also tested with Ubuntu 20)
• Java JDK version is 11.0.2
• Nuxeo versions tested with the same result (11.4 and LTS2021)
• No studio packages installed
• Web-UI 3.0.1

Thanks for your help Jean-Christophe LE CAM

Jean-Christoph1

Hello,

After modifying the nuxeo.conf file, the integration with the Active Directory works on the Linux server.

The solution was to change the value of the "nuxeo.ldap.user.searchBaseDn" parameter

• Original value: dc=mydomain,dc=local
• New value: ou=MyCorp,dc=mydomain,dc=local

It seems that this parameter is not interpreted in the same way under Linux and Windows.

Perhaps it would be necessary to have a validity check on this parameter at the start of the server

Have a nice day,

Jean-Christophe LE CAM