Provisioner - LDAP Referral not working for an AD source.

XMLWordPrintable

    • Type: Bug
    • Resolution: Fixed
    • Priority: Blocker
    • 5.11.3
    • Affects Version/s: None
    • Component/s: provisioning
    • None
    • Environment:
      Grouper 5.10.1

      Unable to test external LDAP system or Provisioner when a referral is executed on an LDAP query to an AD based LDAP environment.

      Specific error:

      Caused by: org.ldaptive.LdapException: resultCode=REFERRAL, diagnosticMessage=0000202B: RefErr: DSID-0310079D, data 0, 1 access points ref 1: 'nau.froot-virt.nau.edu'

      Complete exception:

      Error: Selecting specific entity (elapsed: 0:00:00.586)
      java.lang.RuntimeException: Problem with ldap connection: nauADTest,
      Error querying ldap server id: nauADTest, searchDn: DC=nau,DC=froot-virt,DC=nau,DC=edu, filter: '(&(cn=rdw4)(objectclass=person)(objectclass=user))', returning attributes: cn, ldap_dn, objectClass
      	at edu.internet2.middleware.grouper.ldap.ldaptive.LdaptiveSessionImpl.callbackLdapSession(LdaptiveSessionImpl.java:181)
      	at edu.internet2.middleware.grouper.ldap.ldaptive.LdaptiveSessionImpl.list(LdaptiveSessionImpl.java:301)
      	at edu.internet2.middleware.grouper.app.ldapProvisioning.ldapSyncDao.LdapSyncDaoForLdap.search(LdapSyncDaoForLdap.java:16)
      	at edu.internet2.middleware.grouper.app.ldapProvisioning.LdapProvisioningTargetDao.retrieveEntities(LdapProvisioningTargetDao.java:1045)
      	at edu.internet2.middleware.grouper.app.provisioning.targetDao.GrouperProvisionerTargetDaoAdapter.retrieveEntitiesHelper(GrouperProvisionerTargetDaoAdapter.java:2494)
      	at edu.internet2.middleware.grouper.app.provisioning.targetDao.GrouperProvisionerTargetDaoAdapter$19.callLogic(GrouperProvisionerTargetDaoAdapter.java:2649)
      	at edu.internet2.middleware.grouper.app.provisioning.targetDao.GrouperProvisionerTargetDaoAdapter$19.callLogic(GrouperProvisionerTargetDaoAdapter.java:2641)
      	at edu.internet2.middleware.grouper.util.GrouperUtil.executorServiceSubmit(GrouperUtil.java:14433)
      	at edu.internet2.middleware.grouper.app.provisioning.targetDao.GrouperProvisionerTargetDaoAdapter.retrieveEntities(GrouperProvisionerTargetDaoAdapter.java:2706)
      	at edu.internet2.middleware.grouper.app.provisioning.GrouperProvisioningDiagnosticsContainer.appendSelectEntityFromTarget(GrouperProvisioningDiagnosticsContainer.java:1675)
      	at edu.internet2.middleware.grouper.app.provisioning.GrouperProvisioningDiagnosticsContainer.runDiagnostics(GrouperProvisioningDiagnosticsContainer.java:205)
      	at edu.internet2.middleware.grouper.app.provisioning.GrouperProvisioningType$2.provision(GrouperProvisioningType.java:72)
      	at edu.internet2.middleware.grouper.app.provisioning.GrouperProvisioningLogic.provision(GrouperProvisioningLogic.java:78)
      	at edu.internet2.middleware.grouper.app.provisioning.GrouperProvisioner.provision(GrouperProvisioner.java:855)
      	at edu.internet2.middleware.grouper.grouperUi.serviceLogic.UiV2ProvisionerConfiguration$1.callLogic(UiV2ProvisionerConfiguration.java:234)
      	at edu.internet2.middleware.grouper.grouperUi.serviceLogic.UiV2ProvisionerConfiguration$1.callLogic(UiV2ProvisionerConfiguration.java:229)
      	at edu.internet2.middleware.grouper.util.GrouperCallable$1.callback(GrouperCallable.java:205)
      	at edu.internet2.middleware.grouper.GrouperSession.callbackGrouperSession(GrouperSession.java:1063)
      	at edu.internet2.middleware.grouper.util.GrouperCallable.callLogicWithSessionIfExists(GrouperCallable.java:202)
      	at edu.internet2.middleware.grouper.util.GrouperCallable.call(GrouperCallable.java:167)
      	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
      	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
      	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
      	at java.base/java.lang.Thread.run(Thread.java:840)
      Caused by: org.ldaptive.LdapException: resultCode=REFERRAL, diagnosticMessage=0000202B: RefErr: DSID-0310079D, data 0, 1 access points
      	ref 1: 'nau.froot-virt.nau.edu'
       
      	at org.ldaptive.handler.ResultPredicate.testAndThrow(ResultPredicate.java:36)
      	at org.ldaptive.transport.DefaultOperationHandle.await(DefaultOperationHandle.java:217)
      	at org.ldaptive.transport.DefaultSearchOperationHandle.await(DefaultSearchOperationHandle.java:104)
      	at org.ldaptive.transport.DefaultSearchOperationHandle.execute(DefaultSearchOperationHandle.java:126)
      	at org.ldaptive.SearchOperation.execute(SearchOperation.java:716)
      	at org.ldaptive.control.util.PagedResultsClient.executeToCompletion(PagedResultsClient.java:223)
      	at org.ldaptive.control.util.PagedResultsClient.executeToCompletion(PagedResultsClient.java:173)
      	at edu.internet2.middleware.grouper.ldap.ldaptive.LdaptiveSessionImpl.processSearchRequest(LdaptiveSessionImpl.java:511)
      	at edu.internet2.middleware.grouper.ldap.ldaptive.LdaptiveSessionImpl.lambda$list$2(LdaptiveSessionImpl.java:305)
      	at edu.internet2.middleware.grouper.ldap.ldaptive.LdaptiveSessionImpl.callbackLdapSession(LdaptiveSessionImpl.java:176)
      	... 23 more 

      This is with or without : REFERRAL set on searchIgnoreResultCodes 

      ...and with referrals being chased, and the endpoint being set as AD in configuration.

      With ldaptive logging set to DEBUG we see no errors or work being done after identifying the REFERRAL:

      grouper-ui;ldap.log;2024-06-27T09:56:38,437: [ldaptive-ConnectionFactoryTransport-io-5-3] DEBUG NettyConnection$InboundMessageHandler.channelRead0(1578) - [] - Received message org.ldaptive.SearchResponse@1229689377::messageID=2, controls=[], resultCode=SUCCESS, matchedDN=, diagnosticMessage=, referralURLs=[], entries=[], references=[] for handle org.ldaptive.transport.DefaultSearchOperationHandle@2008005987::messageID=2, request=org.ldaptive.SearchRequest@198144555::controls=null, responseTimeout=null, dn=, scope=OBJECT, aliases=NEVER, sizeLimit=0, timeLimit=PT0S, typesOnly=false, filter=org.ldaptive.filter.PresenceFilter@-1302156138::attributeDesc=objectClass, returnAttributes=[1.1], binaryAttributes=null, connection=org.ldaptive.transport.netty.NettyConnection@1816472270::ldapUrl=[org.ldaptive.LdapURL@-2136466663::scheme=ldap, hostname=froot-virt.nau.edu, port=-1, baseDn=null, attributes=null, scope=null, filter=null, inetAddress=null], isOpen=true, connectTime=2024-06-27T16:56:38.426882762Z, connectionConfig=[org.ldaptive.ConnectionConfig@615437426::ldapUrl=ldap://froot-virt.nau.edu, connectTimeout=PT1M, startTLSTimeout=PT1M, responseTimeout=PT1M, reconnectTimeout=PT2M, autoReconnect=true, autoReconnectCondition=ONE_RECONNECT_ATTEMPT, autoReplay=false, sslConfig=null, useStartTLS=false, connectionInitializers=[org.ldaptive.BindConnectionInitializer@172732813::bindDn=cn=srv_its_ent_groups,cn=users,dc=froot-virt,dc=nau,dc=edu, bindSaslConfig=null, bindControls=null], connectionStrategy=[org.ldaptive.ActivePassiveConnectionStrategy@1557175179::ldapURLSet=[org.ldaptive.LdapURLSet@340358852::active=[[org.ldaptive.LdapURL@-2136466663::scheme=ldap, hostname=froot-virt.nau.edu, port=-1, baseDn=null, attributes=null, scope=null, filter=null, inetAddress=null]], inactive=[]], activateCondition=DEFAULT_ACTIVATE_CONDITION, retryCondition=DEFAULT_RETRY_CONDITION, initialized=true], connectionValidator=null, transportOptions={}], channel=[id: 0xf3708870, L:/10.0.2.100:40498 - R:froot-virt.nau.edu/10.20.176.243:389], responseTimeout=PT1M, creationTime=2024-06-27T16:56:38.432529439Z, sentTime=2024-06-27T16:56:38.433585128Z, receivedTime=null, consumedMessage=true, result=null, exception=null, onEntry=null, onReference=null, onSearchResult=null
      grouper-ui;ldap.log;2024-06-27T09:56:38,437: [https-jsse-nio-0.0.0.0-8443-exec-3] DEBUG LdaptiveSessionImpl.callbackLdapSession(172) - [] - checkout: ldap id: nauADTest, pool active: 0, available: 3
      grouper-ui;ldap.log;2024-06-27T09:56:38,438: [https-jsse-nio-0.0.0.0-8443-exec-3] DEBUG NettyConnection.write(912) - [] - Write handle org.ldaptive.transport.DefaultSearchOperationHandle@466129479::messageID=null, request=org.ldaptive.SearchRequest@1496031054::controls=[[org.ldaptive.control.PagedResultsControl@-68066424::criticality=true, size=1000, cookie=null]], responseTimeout=null, dn=dc=nau,dc=froot-virt,dc=nau,dc=edu, scope=SUBTREE, aliases=NEVER, sizeLimit=0, timeLimit=PT0S, typesOnly=false, filter=org.ldaptive.filter.EqualityFilter@-1265339123::filterType=EQUALITY, attributeDesc=cn, assertionValue=rdw4, returnAttributes=[samaccountname], binaryAttributes=[objectSid, objectGUID], connection=org.ldaptive.transport.netty.NettyConnection@1816472270::ldapUrl=[org.ldaptive.LdapURL@-2136466663::scheme=ldap, hostname=froot-virt.nau.edu, port=-1, baseDn=null, attributes=null, scope=null, filter=null, inetAddress=null], isOpen=true, connectTime=2024-06-27T16:56:38.426882762Z, connectionConfig=[org.ldaptive.ConnectionConfig@615437426::ldapUrl=ldap://froot-virt.nau.edu, connectTimeout=PT1M, startTLSTimeout=PT1M, responseTimeout=PT1M, reconnectTimeout=PT2M, autoReconnect=true, autoReconnectCondition=ONE_RECONNECT_ATTEMPT, autoReplay=false, sslConfig=null, useStartTLS=false, connectionInitializers=[org.ldaptive.BindConnectionInitializer@172732813::bindDn=cn=srv_its_ent_groups,cn=users,dc=froot-virt,dc=nau,dc=edu, bindSaslConfig=null, bindControls=null], connectionStrategy=[org.ldaptive.ActivePassiveConnectionStrategy@1557175179::ldapURLSet=[org.ldaptive.LdapURLSet@340358852::active=[[org.ldaptive.LdapURL@-2136466663::scheme=ldap, hostname=froot-virt.nau.edu, port=-1, baseDn=null, attributes=null, scope=null, filter=null, inetAddress=null]], inactive=[]], activateCondition=DEFAULT_ACTIVATE_CONDITION, retryCondition=DEFAULT_RETRY_CONDITION, initialized=true], connectionValidator=null, transportOptions={}], channel=[id: 0xf3708870, L:/10.0.2.100:40498 - R:froot-virt.nau.edu/10.20.176.243:389], responseTimeout=PT1M, creationTime=2024-06-27T16:56:38.438722761Z, sentTime=null, receivedTime=null, consumedMessage=false, result=null, exception=null, onEntry=[[org.ldaptive.handler.DnAttributeEntryHandler@-1580910376::dnAttributeName=entryDN, addIfExists=false]], onReference=null, onSearchResult=[edu.internet2.middleware.grouper.ldap.ldaptive.GrouperRangeEntryHandler@17257, org.ldaptive.referral.FollowSearchReferralHandler@53974be2, org.ldaptive.referral.FollowSearchResultReferenceHandler@61ea43b2] with 0 pending responses
      grouper-ui;ldap.log;2024-06-27T09:56:38,442: [ldaptive-ConnectionFactoryTransport-io-5-3] DEBUG NettyConnection$InboundMessageHandler.channelRead0(1578) - [] - Received message org.ldaptive.SearchResponse@-1582285541::messageID=3, controls=[[org.ldaptive.control.PagedResultsControl@-68102810::criticality=false, size=0, cookie=null]], resultCode=REFERRAL, matchedDN=, diagnosticMessage=0000202B: RefErr: DSID-0310079D, data 0, 1 access points
      	ref 1: 'nau.froot-virt.nau.edu'
      , referralURLs=[ldap://nau.froot-virt.nau.edu/dc=nau,dc=froot-virt,dc=nau,dc=edu], entries=[], references=[] for handle org.ldaptive.transport.DefaultSearchOperationHandle@466129479::messageID=3, request=org.ldaptive.SearchRequest@1496031054::controls=[[org.ldaptive.control.PagedResultsControl@-68066424::criticality=true, size=1000, cookie=null]], responseTimeout=null, dn=dc=nau,dc=froot-virt,dc=nau,dc=edu, scope=SUBTREE, aliases=NEVER, sizeLimit=0, timeLimit=PT0S, typesOnly=false, filter=org.ldaptive.filter.EqualityFilter@-1265339123::filterType=EQUALITY, attributeDesc=cn, assertionValue=rdw4, returnAttributes=[samaccountname], binaryAttributes=[objectSid, objectGUID], connection=org.ldaptive.transport.netty.NettyConnection@1816472270::ldapUrl=[org.ldaptive.LdapURL@-2136466663::scheme=ldap, hostname=froot-virt.nau.edu, port=-1, baseDn=null, attributes=null, scope=null, filter=null, inetAddress=null], isOpen=true, connectTime=2024-06-27T16:56:38.426882762Z, connectionConfig=[org.ldaptive.ConnectionConfig@615437426::ldapUrl=ldap://froot-virt.nau.edu, connectTimeout=PT1M, startTLSTimeout=PT1M, responseTimeout=PT1M, reconnectTimeout=PT2M, autoReconnect=true, autoReconnectCondition=ONE_RECONNECT_ATTEMPT, autoReplay=false, sslConfig=null, useStartTLS=false, connectionInitializers=[org.ldaptive.BindConnectionInitializer@172732813::bindDn=cn=srv_its_ent_groups,cn=users,dc=froot-virt,dc=nau,dc=edu, bindSaslConfig=null, bindControls=null], connectionStrategy=[org.ldaptive.ActivePassiveConnectionStrategy@1557175179::ldapURLSet=[org.ldaptive.LdapURLSet@340358852::active=[[org.ldaptive.LdapURL@-2136466663::scheme=ldap, hostname=froot-virt.nau.edu, port=-1, baseDn=null, attributes=null, scope=null, filter=null, inetAddress=null]], inactive=[]], activateCondition=DEFAULT_ACTIVATE_CONDITION, retryCondition=DEFAULT_RETRY_CONDITION, initialized=true], connectionValidator=null, transportOptions={}], channel=[id: 0xf3708870, L:/10.0.2.100:40498 - R:froot-virt.nau.edu/10.20.176.243:389], responseTimeout=PT1M, creationTime=2024-06-27T16:56:38.438722761Z, sentTime=2024-06-27T16:56:38.439702644Z, receivedTime=null, consumedMessage=false, result=null, exception=null, onEntry=[[org.ldaptive.handler.DnAttributeEntryHandler@-1580910376::dnAttributeName=entryDN, addIfExists=false]], onReference=null, onSearchResult=[edu.internet2.middleware.grouper.ldap.ldaptive.GrouperRangeEntryHandler@17257, org.ldaptive.referral.FollowSearchReferralHandler@53974be2, org.ldaptive.referral.FollowSearchResultReferenceHandler@61ea43b2] 

      The LDAP server is accessible and LDAP queries which do not return referrals are successful by Grouper. In addition, the same queries are successful with other clients which can chase the referrals. 

            Assignee:
            Chris Hyzer (upenn.edu)
            Reporter:
            Raymond Walker
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: