Acceptsecuritycontext error data 52e v4563

Error 500 in LDAP Authorization #2063 Comments When set the LDAP information , got this error. 500: 0x31 (Invalid credentials; 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563): ou=TNC Users,dc=TNC,dc=com Screenshots EspoCRM version 6.1.7 Additional context The credentials is worked in another software. The text was updated successfully, but these errors were encountered: […]

Содержание

  1. Error 500 in LDAP Authorization #2063
  2. Comments
  3. Footer
  4. Ldaperr dsid 0c090439 comment acceptsecuritycontext error data 52e v4563
  5. Asked by:
  6. Question
  7. OTRS.ru
  8. Ошибки авторизации в AD
  9. Ошибки авторизации в AD
  10. Re: Ошибки авторизации в AD
  11. Re: Ошибки авторизации в AD
  12. Re: Ошибки авторизации в AD
  13. Re: Ошибки авторизации в AD
  14. Re: Ошибки авторизации в AD
  15. Re: Ошибки авторизации в AD
  16. Re: Ошибки авторизации в AD
  17. Re: Ошибки авторизации в AD
  18. Jira Active Directory sync problems 57
  19. Further reading

When set the LDAP information , got this error.

500: 0x31 (Invalid credentials; 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563): ou=TNC Users,dc=TNC,dc=com

Screenshots

EspoCRM version
6.1.7

Additional context
The credentials is worked in another software.

The text was updated successfully, but these errors were encountered:

We tested recently and it worked. Please try to debug. If you find the reason that it’s a problem in Espo please let us know.

I got this error again in LOG:
ERROR: (49) 0x31 (Invalid credentials; 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563): ou=TNC Users,dc=TNC,dc=com; POST /Settings/action/testLdapConnection; line: 990, file: /opt/lampp/htdocs/vendor/laminas/laminas-ldap/src/Ldap.php [] []

Dear yurikuzn
I can’t solve my problem and i could not find where was it. The other softwares in my local network is worked with this setting.
I’ll be thankful if you guide me.

I’m not competent here. Have never configured LDAP.

Please let me know what LDAP server do you use?

Windows Active Directory Service 2019

Thanks. We will check this.

We have the same problem and get the same error message as farhadlavaei.

EspoCRM version 6.1.9
Windows Server 2019 Datacenter Edition (x64).

Using ldapsearch, our administrator was able to successfully connect to the LDAP server and read groups and members. Therefore, our guess is that something is not right with EspoCRM.

This error was deeply tested and found that it’s not the bug. The problem is related with the wrong Account Canonical Form option. For more details, see https://github.com/espocrm/documentation/blob/master/docs/administration/ldap-authorization.md#troubleshooting.
Please check this and let me know if the solution works for you.

The LDAP connection now works for us, but it had to be set up somewhat differently than described under «Troubleshooting».

In the first step we changed «Account Canonical Form» from «Dn» to «Principal» and at the same time «Full User DN» to «espocrm@domain.zz», as recommended. The other settings remained unchanged. We were then able to successfully set up a test connection to the LDAP server.

However, no user could log in (wrong username/password, error 0x0). We then tried different combinations: After we changed «Username Attribute» to Username «sAMAccountName» and at the same time «Account Canonical Form» from «Principal» to sAMAccountName «Username», a successful login succeeded.

Surprisingly, the test connection continues to work even though «Account Canonical Form» is no longer set to «Principal». We therefore assume that the change of the «Full User DN» was sufficient to enable the connection to the LDAP server.

By the way, the user gets an error at the first login (Server side error 500: User must be fetched before ACL check), but is created in EspoCRM. After the second login, the login works as expected and the user can successfully log in to EspoCRM.

In any case, thanks for the support!

It is great that this solution works for you.

Do you mean that the correct settings for you are:

  • Username Attribute is sAMAccountName .
  • Account Canonical Form is Username .
    Correct?

I’m sure when the Username Attribute is sAMAccountName , the Account Canonical Form can be Principal or Username .

We will investigate the second error at the first login.

That’s right, I had it mixed up above. We have the following working settings:

Username Attributes is sAMAccountName
Account Canonical Form is Username

By the way, the user gets an error at the first login (Server side error 500: User must be fetched before ACL check), but is created in EspoCRM. After the second login, the login works as expected and the user can successfully log in to EspoCRM.

I can confirm this issue as well on a fresh install of 6.1.9. The user is created from ldap but not logged in. Instead that error is shown. If they simply login again it works fine.

Thanks for your confirmation.
We are investigating this problem.

By the way, the user gets an error at the first login (Server side error 500: User must be fetched before ACL check), but is created in EspoCRM. After the second login, the login works as expected and the user can successfully log in to EspoCRM.

I can confirm this issue as well on a fresh install of 6.1.9. The user is created from ldap but not logged in. Instead that error is shown. If they simply login again it works fine.

Apologies, I realize I didn’t include the error from the log in case it’s useful.

[2021-09-29 16:15:32] ERROR: (500) User must be fetched before ACL check.; GET /App/user; line: 119, file: /var/www/html/application/Espo/Core/Acl/Table.php [] []

The problem for the first time login is fixed in EspoCRM v7.0.0.
Thanks everyone for helping.

© 2023 GitHub, Inc.

You can’t perform that action at this time.

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.

Источник

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Asked by:

Question

We are developing a LDAP authentication against Active Directory, we met the follow errors, although the username and password are correct.

LDAP: error code 49 — 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece

The user detail is: CN=Peter, Lia ,OU=DEV,OU=HK_U,OU=cita,OU=US,DC=achtest,DC=local

As you may saw, the last name of this user has a backslash, plus a space in CN, we guess it may be the problem, since other users don’t have this problem if the last name of users don’t have a backslash and a space.

However we don’t know how we can add a new user to duplicate this issue, since it’s not way to add a new user with space in the end of name, the Active Directory will auto trim the space when system save the new user to database.

My questions are:

1. Do you have this kind of experience? Any idea to resolve?

2. How we can add a new user with a space in the end of last name? and then we can replicate this issue again?

Источник

OTRS.ru

Русскоязычное сообщество OTRS Helpdesk и OTRS ITSM

  • Темы без ответов
  • Активные темы
  • Поиск
  • Наша команда

Ошибки авторизации в AD

Модератор: ykolesnikov

Сообщение justbox » 16 окт 2012, 23:55

Re: Ошибки авторизации в AD

Сообщение justbox » 16 окт 2012, 23:55

Мне нужна АД авторизация только для клиентов, агенты будут статичны.Где я допустил ошибки ?

Заранее благодарен за помощь.

Ubuntu Server
OTRS 3.1.3

Сообщение justbox » 17 окт 2012, 11:01

Сообщение justbox » 19 окт 2012, 14:21

Сообщение ykolesnikov » 19 окт 2012, 14:37

Сообщение justbox » 19 окт 2012, 17:54

Сообщение justbox » 19 окт 2012, 17:56

Сообщение justbox » 22 окт 2012, 16:05

Добавил строки , добавил агентов в группу безопасности OTRS_Agents , авторизация не проходит =( что я не так делаю , кустомеров через ад пускает.

Сообщение Romano » 22 окт 2012, 18:23

В этом поле я указывал ‘ OU=DIT,OU=Domain Users,DC=domen,DC=local‘ — т.е. разрешил заходить в юзерский интерфейс всем участникам АУшки ДИТ — это коллеги моего ИТ департамента.

А вообще то, как я считаю, самым простым и правильным вариантом было бы указать ‘ DC=domen,DC=local‘ или, например ‘ OU=Domain Users,DC=domen,DC=local‘ — чтобы логинится могли все юзеры, которые заведены в домене(если такой вариант устраивает). И получается, что не надо создавать никакой доп группы в АДшке и добавлять в неё юзерей. Вообщем все зависит от ваших требований.

Источник

Jira Active Directory sync problems 57

After the latest update ( 8.22.3) I’ve been experiencing problems with LDAP/AD Sync.

I have two LDAP user directories in Jira*, one for «Users», one for «Customers» and both are synced from the same Domain Controller.
The User Directory settings in both have slight difference in OU structure and group memberships but are otherwise identical.
This problem only manifests in the «Customer» directory while «Users» directory sync works flawlessly, and I stress this, with the same service account used in syncing.

Error message from the logs:

2022-06-07 04:58:07,094+0000 Caesium-1-2 ERROR ServiceRunner [c.a.crowd.directory.DbCachingDirectoryPoller] Error occurred while refreshing the cache for directory [ 10100 ].
com.atlassian.crowd.exception.OperationFailedException: java.util.concurrent.ExecutionException: com.atlassian.crowd.exception.OperationFailedException: org.springframework.transaction.CannotCreateTransactionException: Could not create DirContext instance for transaction; nested exception is org.springframework.ldap.AuthenticationException: [LDAP: error code 49 — 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 57, v4563^@]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 — 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 57, v4563^@]

(data 57 seems to be undocumented/reserved in LDAP wiki.)

This problem persists until I start to fiddle with the User Directory configs, this can take from couple of minutes to couple of hours, mainly changing account used to sync and suddenly it starts working again with the original account.

Problem can occur in Jira while Jira Service Management is unaffected and vice versa.

Problem also reoccurs after a day or two.

Account is and have been active this whole time and is used in the user directory sync without fail.

I’m using the official docker images.

*This problem occurs in both Jira and Jira Service Management Data Center editions (not clustered).

Any ideas what causes this/how can I fix this?

Источник

Last updated on: March 10th, 2021

vScope supports both Discovery of and integration with the Active Directory. If something goes wrong you will be prompted with an error message that can give you a hint of the cause to the issue.

The error messages might look something like this:

INVALID_CREDENTIALS: 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580

INVALID_CREDENTIALS: 80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 775, v1db1

Here is a list of common error codes that might show up:

Error code Error Description
525 User not found Returned when an invalid username is supplied.
52e Invalid credentials Returned when a valid username is supplied but an invalid password/credential is supplied. If this error is received, it will prevent most other errors from being displayed.
530 Not permitted to logon at this time Returned when a valid username and password/credential are supplied during times when login is restricted.
531 Not permitted to logon from this workstation Returned when a valid username and password/credential are supplied, but the user is restriced from using the workstation where the login was attempted.
532 Password expired Returned when a valid username is supplied, and the supplied password is valid but expired.
533 Account disabled Returned when a valid username and password/credential are supplied but the account has been disabled.
701 Account expired Returned when a valid username and password/credential are supplied but the account has expired.
773 User must reset password Returned when a valid username and password/credential are supplied, but the user must change their password immediately (before logging in for the first time, or after the password was reset by an administrator).
775 Account locked out Returned when a valid username is supplied, but the account is locked out. Note that this error will be returned regardless of whether or not the password is invalid.

Further reading

You can read more about integrating vScope with Active Directory on this Knowledge Base post.

Источник

Источник

LDAP: error code 49 — 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1

I know «52e» code is when username is valid, but password is invalid. I am using the same user name and password in my apache studio, I was able to establish the connection succesfully to LDAP.

Here is my java code 

    String userName = "*******";
    String password = "********";
    String base ="DC=PSLTESTDOMAIN,DC=LOCAL";
    String dn = "cn=" + userName + "," + base;  
    Hashtable env = new Hashtable();
    env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
    env.put(Context.PROVIDER_URL, "ldap://******");
    env.put(Context.SECURITY_AUTHENTICATION, "simple");
    env.put(Context.SECURITY_PRINCIPAL, dn);
    env.put(Context.SECURITY_CREDENTIALS, password);
    LDAPAuthenticationService ldap = new LDAPAuthenticationService();
   // LdapContext ctx;
    DirContext ctx = null;
    try {
        ctx = new InitialDirContext(env);

My error is on this line: ctx = new InitialDirContext(env);

I do not know what exactly is causing this error.

simbabque's user avatar

simbabque

53.5k8 gold badges77 silver badges133 bronze badges

asked Jul 14, 2015 at 15:59

anusha vannela's user avatar

0

For me the issue resolved when I set the principal section like this:

env.put(Context.SECURITY_PRINCIPAL, userId@domainWithoutProtocolAndPortNo);

answered Nov 9, 2016 at 15:45

Vishal's user avatar

VishalVishal

1,8332 gold badges19 silver badges22 bronze badges

4

In my case I have to use something like <username>@<domain> to successfully login.

sample_user@sample_domain

smonff's user avatar

smonff

3,3513 gold badges39 silver badges46 bronze badges

answered Sep 24, 2018 at 7:50

Linh Nguyen's user avatar

Linh NguyenLinh Nguyen

2012 silver badges8 bronze badges

When you use Context.SECURITY_AUTHENTICATION as «simple», you need to supply the userPrincipalName attribute value (user@domain_base).

answered Oct 9, 2018 at 16:19

MAW's user avatar

MAWMAW

8738 silver badges22 bronze badges

I had a similar issue when using AD on CAS , i.e. 52e error, In my case application accepts the Full Name when in the form of CN= instead of the actual username.

For example, if you had a user who’s full name is Ross Butler and their login username is rbutler —you would normally put something like, cn=rbutler,ou=Users,dc=domain,dc=com but ours failed everytime. By changing this to cn=Ross Butler,ou=Users,dc=domain,dc=com it passed!!

answered Jun 23, 2017 at 5:46

Count's user avatar

CountCount

1,3652 gold badges19 silver badges38 bronze badges

1

For me the issue is resolved by adding domain name in user name as follow:

string userName="yourUserName";
string password="passowrd";
string hostName="LdapServerHostName";
string domain="yourDomain";
System.DirectoryServices.AuthenticationTypes option = System.DirectoryServices.AuthenticationTypes.SecureSocketsLayer; 
string userNameWithDomain = string.Format("{0}@{1}",userName , domain);
DirectoryEntry directoryOU = new DirectoryEntry("LDAP://" + hostName, userNameWithDomain, password, option);

answered Nov 23, 2018 at 7:14

Mahsh Nikam's user avatar

if you debug and loook at ctx=null,maybe your username hava proble ,you shoud write like
«acadministrator»(double «») or «administrator@ac»

answered Jul 5, 2019 at 3:34

HaoSi's user avatar

HaoSiHaoSi

211 bronze badge

0

For me the cause of the issue was that the format of username was incorrect. It was earlierly specified as «mydomainuser». I removed the domain part and the error was gone.

PS I was using ServerBind authentication.

answered Feb 24, 2021 at 14:02

arslanahmad656's user avatar

1

LDAP is trying to authenticate with AD when sending a transaction to another server DB. This authentication fails because the user has recently changed her password, although this transaction was generated using the previous credentials. This authentication will keep failing until … unless you change the transaction status to Complete or Cancel in which case LDAP will stop sending these transactions.

answered Apr 13, 2017 at 20:40

Ebrahim's user avatar

For me issue is resolved by changing envs like this: 

 env.put("LDAP_BASEDN", base)
 env.put(Context.SECURITY_PRINCIPAL,"user@domain")

answered Aug 28, 2019 at 7:52

user3917389's user avatar

1

Using domain Name may solve the problem (get domain name using powershell: $env:userdomain):

    Hashtable<String, Object> env = new Hashtable<String, Object>();
    String principalName = "domainName\userName";
    env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
    env.put(Context.PROVIDER_URL, "ldap://URL:389/OU=ou-xx,DC=fr,DC=XXXXXX,DC=com");
    env.put(Context.SECURITY_AUTHENTICATION, "simple");
    env.put(Context.SECURITY_PRINCIPAL, principalName);
    env.put(Context.SECURITY_CREDENTIALS, "Your Password");

    try {
        DirContext authContext = new InitialDirContext(env);
        // user is authenticated
        System.out.println("USER IS AUTHETICATED");
    } catch (AuthenticationException ex) {
        // Authentication failed
        System.out.println("AUTH FAILED : " + ex);

    } catch (NamingException ex) {
        ex.printStackTrace();
    }

answered Feb 7, 2020 at 11:35

Praveen Gopal's user avatar

2

I’ve tested three diferent approaches and them all worked:

env.put(Context.SECURITY_PRINCIPAL, "user");
env.put(Context.SECURITY_PRINCIPAL, "user@domain.com");
env.put(Context.SECURITY_PRINCIPAL, "CN=user,OU=one,OU=two,DC=domain,DC=com");

If you use the last one, don’t forget to set all the OU’s where the user belongs to. Otherwise it won’t work.

answered Jan 27, 2022 at 15:57

Sergio Gabari's user avatar

In my case I misconfigured email credentials then I corrected

var passport = require('passport'),
    WindowsStrategy = require('passport-windowsauth'),
    User = require('mongoose').model('User');

module.exports = function () {
    passport.use(new WindowsStrategy({ldap: {
        url:            'ldap://corp.company.com:389/DC=corp,DC=company,DC=com',
        base:           'DC=corp,DC=company,DC=com',
        bindDN:         'myid@corp.company.com',
        bindCredentials:'password',
        tlsOptions: {
            ca: [fs.readFileSync("./cert.pem")],
          },
    }, integrated: false},
    function(profile, done) {
        console.log('Windows');
        console.log(profile);
        User.findOrCreate({
            username: profile.id
        }, function(err, user) {
            if (err) {
                return done(err);
            }

            if (!user) {
                return done(null, false, {
                    message: 'Unknown user'
                });
            }

            if (!user.authenticate(password)) {
                return done(null, false, {
                    message: 'Invalid password'
                });
            }

            return done(null, user);
        });
    }));
};

answered May 12, 2022 at 13:50

KARTHIKEYAN.A's user avatar

KARTHIKEYAN.AKARTHIKEYAN.A

16.7k6 gold badges115 silver badges130 bronze badges

Please remove domain from the username «mydomainuser». please put «user» only. do not put domain and backslash .

You do not use ldaps://examplehost:8080(do not use s with ldaps coz cert is required), use ldap://examplehost:8080 then use non-TLS port number. it worked for me.

answered Jul 19, 2022 at 10:13

Kumaresan Perumal's user avatar

Источник

Overview

I’m trying to get Proxmox to perform user authentication via LDAP with a Windows Server 2016 ADDS server. Proxmox is convinced that my credentials are incorrect.

Environment

  • Proxmox 6.3-1, PVE 6.3-6

  • Windows Server 2019 Datacenter 1809, b17763.1823

  • The Proxmox server and Domain Controller are on the same network (the DC is a guest on the Proxmox instance).

  • The DC’s root certificate has been added to the Proxmox server’s store.

  • Proxmox’s realm binding is set up with a dedicated standard user account in the OU OU=Service Users,DC=subdomain,DC=domain,DC=tld.

  • I have an administrative account in the standard CN=Users,DC=subdomain,DC=domain,DC=tld.

  • Proxmox’s realm binding is as follows via the GUI:

    General
---
Domain: DC=subdomain,DC=domain,DC=tld
Default: True
Server: dc.subdomain.domain.tld
Fallback Server: Unused
Port: Default
SSL: True
Verify Certificate: True
Require TFA: None

Sync Options
---
Bind User: CN=ServiceAccount,OU=Service Users,DC=subdomain,DC=domain,DC=tld
E-Mail Attribute: mail
Groupname Attr.: sAMAccountName
User Classes: user
Group Classes: group
User Filter: (&(objectCategory=Person)(sAMAccountName=*)(memberOf=CN=InfrastructureAdmins,CN=Users,DC=subdomain,DC=domain,DC=tld))
Group Filter: (sAMAccountName=InfrastructureAdmins)

What’s Happening

  • Proxmox’s login page gives the error message «Login failed. Please try again».
  • Proxmox’s syslog shows the line entry hostname pvedaemon[pid]: authentication failure; rhost=10.9.0.50 user=username@realm msg=80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563.
    • The error code 52e suggests that the password is incorrect.
  • I’m not seeing any entries for ServiceAccount or username in the DC’s security event log when the login fails.

What I’ve Tried

  • I’ve verified that Proxmox can communicate with the DC; when the realm is synced, it successfully pulls groups and users from the domain.
  • I’ve verified that the binding user ServiceAccount can log in to a domain-joined computer.
  • I’ve verified that the account I’m testing with (my admin account) can log in to domain-joined computers; it’s the account I’m logged into the DC with.
    • I’ve also created a test account with no additional settings, just the proper group membership, and attempted to use it to log into Proxmox.
  • I’ve tried simplifying the passwords for both my user account and the binding account down to P4$$w0rd.
  • LDAP works for other systems with a similar binding account.

Any guidance or suggestions would be greatly appreciated.

asked Mar 28, 2021 at 2:05

timelmer's user avatar

I can’t be sure you and I have the same problem, but I solved the same symptoms by:

  • Ensure the ‘domain’ in the LDAP settings is the actual AD domain name (eg. ad.example.com). Proxmox will append this to a user name in order to log on, so the LDAP server will reject you if you’ve got it wrong.
  • Ensure the user or group logging on has a Role assigned to them. You can do this by going to Datacentre->Permissions (the «title», not the things inside the pull-down!) and add a Group Permission (in my case, I used the LDAP group I’d created called ProxmoxAdmins and assigned it the Administrator role)

Things I’ve noticed are that the log messages don’t tell you the cause of the problem at all. I’ve also noticed that LDAP groups cannot have spaces in them (eg. Proxmox Admins doesn’t work, ProxmoxAdmins does). You can see this if you do a «sync preview» in the LDAP settings). And lastly, just because «sync» works, doesn’t mean users will — it only tests the Bind credentials (a useful check, but not everything!).

answered Jan 24, 2022 at 13:46

Ralph Bolton's user avatar

Источник
  • Remove From My Forums

locked

LDAP authentication error: LDAP: error code 49 — 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece

  • Question

  • Dear All,

    We are developing a LDAP authentication against Active Directory, we met the follow errors, although the username and password are correct.

    LDAP: error code 49 — 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece

    The user detail is: CN=Peter, Lia ,OU=DEV,OU=HK_U,OU=cita,OU=US,DC=achtest,DC=local

    As you may saw, the last name of this user has a backslash, plus a space in CN, we guess it may be the problem, since other users don’t have this problem if the last name of users don’t have a backslash and a space.

    However we don’t know how we can add a new user to duplicate this issue, since it’s not way to add a new user with space in the end of name, the Active Directory will auto trim the space when system save the new user to database.

    My questions are:

    1. Do you have this kind of experience? Any idea to resolve?

    2. How we can add a new user with a space in the end of last name? and then we can replicate this issue again?

    Thanks in advance!

    Bright.

Источник

The LDAP connection now works for us, but it had to be set up somewhat differently than described under «Troubleshooting».

In the first step we changed «Account Canonical Form» from «Dn» to «Principal» and at the same time «Full User DN» to «espocrm@domain.zz», as recommended. The other settings remained unchanged. We were then able to successfully set up a test connection to the LDAP server.

However, no user could log in (wrong username/password, error 0x0). We then tried different combinations: After we changed «Username Attribute» to Username «sAMAccountName» and at the same time «Account Canonical Form» from «Principal» to sAMAccountName «Username», a successful login succeeded.

Surprisingly, the test connection continues to work even though «Account Canonical Form» is no longer set to «Principal». We therefore assume that the change of the «Full User DN» was sufficient to enable the connection to the LDAP server.

By the way, the user gets an error at the first login (Server side error 500: User must be fetched before ACL check), but is created in EspoCRM. After the second login, the login works as expected and the user can successfully log in to EspoCRM.

In any case, thanks for the support!

Источник

Для
бизнеса

  • По заинтересованным лицам

  • IT-лидеры

  • Независимые разработчики ПО

  • Архитекторы корпоративных приложений

  • По отраслям

  • Истории успеха

  • По вариантам использования

  • Модернизация приложений

  • Сокращение расходов на ПО

  • Автоматизация внутренних процессов

Источник

  • #1

I was able to create a realm for my domain. » test.net » and sync over the group of users i wanted to pull into PVE, Assigned groups / roles to my users.

however when i go to login as the user i am using username (no @ or anything after) the AD password for the user, and selecting the realm I get a Login failed. Please try again. this happens even with the same user i did my sync with.

Can someone point me to which logs i should be viewing to troubleshoot this type of issue? or is there another step to get Active Directory working for ldap logins?

  • #2

After doing some digging in the lgos i get Authentication Failure; rhose=xxx.xxx.xxx.xxx (the server i tried to login from) user =me@domain.net msg=80090308: LdapErr: DSID-0c090446, comment: AcceptSecurityContect error, data 52e, v2580

this indicates that i used the wrong password. but its no the wrong password. also this is attempting with the same user i did my sync with. which my user was synced and assigned permissions.

Markus S.


  • #3

We have the same issue. Active Directory Sync is working. Got groups and users.

Code: 

Feb 25 12:28:07 proxmox5 pvedaemon[15648]: <root@pam> starting task UPID:proxmox5:00005C83:02BDD29C:603789C7:auth-realm-sync-test:company.com:root@pam:
Feb 25 12:28:08 proxmox5 pvedaemon[15648]: <root@pam> end task UPID:proxmox5:00005C83:02BDD29C:603789C7:auth-realm-sync-test:company.com:root@pam: OK
Feb 25 12:28:13 proxmox5 pvedaemon[4847]: <root@pam> starting task UPID:proxmox5:00005CE6:02BDD4CE:603789CD:auth-realm-sync:company.com:root@pam:
Feb 25 12:28:13 proxmox5 pvedaemon[4847]: <root@pam> end task UPID:proxmox5:00005CE6:02BDD4CE:603789CD:auth-realm-sync:company.com:root@pam: OK

When I try to login with the same user that is used for sync (which is also in the group) I get

Code: 

Feb 25 12:28:45 proxmox5 pvedaemon[4847]: authentication failure; rhost=x.x.x.x user=proxmox@company.com msg=80090308: LdapErr: DSID-0C090453, comment: AcceptSecurityContext error, data 52e, v3839#000 at /usr/share/perl5/PVE/LDAP.pm line 83.

Proxmox Version 6.3-3

Last edited: Feb 25, 2021

  • #4

I’ve got the same error as you guys on Proxmox Version 6.3-3
Did you find a solution on this at all?

Code: 

authentication failure; rhost=x.x.x.x user=firstname.surname@domain.local msg=80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563

  • #5

I would like to know this as well. Is it a configuration error or bug? sync works fine.

dcsapak


  • #6

LdapErr: DSID-0C090453, comment: AcceptSecurityContext error,

means login error on the ad side

make sure that the user can bind with «user@domain» on the ad server

  • #7

I’m confronting similar issue. I test my user credentials on a domain computer, as @dcsapak suggest, with:
powershell: runas /u:<username>@<domainname> notepad.exe and works, Notepad was open if credential are valid, if I on purpose mistype the password it fails.
But when I try to login on Proxmox I get the error message. Any suggestions?

My environment:

Code: 

proxmox-ve: 7.1-1 (running kernel: 5.13.19-6-pve)
pve-manager: 7.1-12 (running version: 7.1-12/b3c09de3)
pve-kernel-helper: 7.1-14
pve-kernel-5.13: 7.1-9
pve-kernel-5.11: 7.0-10
pve-kernel-5.13.19-6-pve: 5.13.19-15
pve-kernel-5.13.19-5-pve: 5.13.19-13
pve-kernel-5.13.19-2-pve: 5.13.19-4
pve-kernel-5.11.22-7-pve: 5.11.22-12
pve-kernel-5.4.27-1-pve: 5.4.27-1
ceph: 16.2.7
ceph-fuse: 16.2.7
corosync: 3.1.5-pve2
criu: 3.15-1+pve-1
glusterfs-client: 9.2-1
ifupdown: not correctly installed
ifupdown2: 3.1.0-1+pmx3
ksm-control-daemon: 1.4-1
libjs-extjs: 7.0.0-1
libknet1: 1.22-pve2
libproxmox-acme-perl: 1.4.1
libproxmox-backup-qemu0: 1.2.0-1
libpve-access-control: 7.1-7
libpve-apiclient-perl: 3.2-1
libpve-common-perl: 7.1-5
libpve-guest-common-perl: 4.1-1
libpve-http-server-perl: 4.1-1
libpve-network-perl: 0.7.0
libpve-storage-perl: 7.1-2
libqb0: 1.0.5-1
libspice-server1: 0.14.3-2.1
lvm2: 2.03.11-2.1
lxc-pve: 4.0.12-1
lxcfs: 4.0.12-pve1
novnc-pve: 1.3.0-2
openvswitch-switch: not correctly installed
proxmox-backup-client: 2.1.5-1
proxmox-backup-file-restore: 2.1.5-1
proxmox-mini-journalreader: 1.3-1
proxmox-widget-toolkit: 3.4-7
pve-cluster: 7.1-3
pve-container: 4.1-4
pve-docs: 7.1-2
pve-edk2-firmware: 3.20210831-2
pve-firewall: 4.2-5
pve-firmware: 3.3-6
pve-ha-manager: 3.3-3
pve-i18n: 2.6-2
pve-qemu-kvm: 6.2.0-2
pve-xtermjs: 4.16.0-1
qemu-server: 7.1-4
smartmontools: 7.2-pve2
spiceterm: 3.2-2
swtpm: 0.7.1~bpo11+1
vncterm: 1.7-1
zfsutils-linux: 2.1.4-pve1

Last edited: Apr 21, 2022

  • #8

Ran into the same issue with following datacenter -> Permissions -> Realms configuration:

Code: 

Realm:       REALM.EXAMPLE.COM
Domain:      example.com

What it solved for me:

Code: 

Realm:       REALM.EXAMPLE.COM
Domain:      realm.example.com

Not sure whether this as OP’s problem, but I hope this helps somebody.

  • #9

It worked for me, too. thx

Источник

Description
This article describes what debug log means when ‘fnbamd_ldap_parse_response-Error 49’ is checked and what is the solution to fix it.When the client accesses the LDAP Server via FortiGate , the error messages captured by FortiGate is showing as below, and cannot access to it normally.

fnbamd_ldap_parse_response-Error 49(80090308: LdapErr: DSID-0C090446, comment: AcceptSecurityContext error, data 52e, v4563)

Solution
In fnbamd debug logs, The error message is founded when tried to log on via the LDAP server.

[584] fnbamd_ldap_build_dn_search_req-base:’DC=itwea,dc=com’ filter:sAMAccountName=xxxxx
[1100] __fnbamd_ldap_dn_entry-Get DN ‘CN=XXX,CN=XXX,DC=XXX,DC=com’
[90] ldap_dn_list_add-added CN=XXX,CN=XXX,DC=XXX,DC=com
[52] ldap_dn_list_del_all-Del CN=XXX,CN=XXX,DC=XXX,DC=com
[2821] fnbamd_ldap_result-Result for ldap svr XXX.XXX.XXX.XXX is SUCCESS[1552] fnbamd_ldap_init-search filter is: sAMAccountName=XXX
[1561] fnbamd_ldap_init-search base is: DC=XXX,dc=com
[584] fnbamd_ldap_build_dn_search_req-base:’DC=XXX,dc=com’ filter:sAMAccountName=XXX
[1100] __fnbamd_ldap_dn_entry-Get DN ‘CN=XXX,OU=XXX,OU=XXX,OU=XXX,OU=XXX,DC=XXX,DC=com’
[90] ldap_dn_list_add-added CN=XXX,OU=XXX,OU=XXX,OU=XXX,OU=XXX,DC=XXX,DC=com
[429] fnbamd_ldap_build_userbind_req-Trying DN ‘ CN=XXX,OU=XXX,OU=XXX,OU=XXX,OU=XXX,DC=XXX,DC=com ‘
[196] __ldap_build_bind_req-Binding to ‘ CN=XXX,OU=XXX,OU=XXX,OU=XXX,OU=XXX,DC=XXX,DC=com’
[852] fnbamd_ldap_send-sending 123 bytes to XXX.XXX.XXX.XXX
[864] fnbamd_ldap_send-Request is sent. ID 3
[815] __ldap_rxtx-state 6(User Bind resp)
[895] __fnbamd_ldap_read-Read 8
[895] __fnbamd_ldap_read-Read 102
[1075] fnbamd_ldap_recv-Response len: 104, svr: XXX.XXX.XXX.XXX
[756] fnbamd_ldap_parse_response-Got one MESSAGE. ID:3, type:bind
[778] fnbamd_ldap_parse_response-Error 49(80090308: LdapErr: DSID-0C090446, comment: AcceptSecurityContext error, data 52e, v4563)
[791] fnbamd_ldap_parse_response-ret=49
[882] __ldap_rxtx-Change state to ‘User Binding’
[815] __ldap_rxtx-state 5(User Binding)
[425] fnbamd_ldap_build_userbind_req-No more DN left
[737] __ldap_error-
[726] __ldap_stop-svr ‘ad_server’
[52] ldap_dn_list_del_all-Del CN=XXX,OU=XXX,OU=XXX,OU=XXX,OU=XXX,DC=XXX,DC=com
[182] fnbamd_comm_send_result-Sending result 1 (error 0, nid 0) for req 1824141631
[653] destroy_auth_session-delete session 1824141631

‘Fnbamd_ldap_parse_response-error 49” means Invaild credentials (49)’

LDAP Error Codes, LDAP Error Codes is an Result Code indicating something went wrong.
There are really LDAP Result Codes and a lot of them well Indicates an Active Directory (AD) AcceptSecurityContext error, which is returned when the username is valid but the combination of password and user credential is invalid. This is the AD equivalent of LDAP error code 49. 49 / 525

In summary, the error is not a problem with FortiGate, but an error message that occurred because the user’s account information registered in LDAP was incorrect.

Reference.
+ Account Information Confirmation Commands.

#dsquery user -name [admin full user name]
#dsquery user -samid [admin login name]
#check the admin password
# diagnose test authserver ldap [server name][user][password]

Источник

Problem

Users are unable to log in. Nothing has changed in JIRA side.

The following appears in the atlassian-jira.log:

2017-10-25 14:13:07,009 ERROR [scheduler_Worker-3] [atlassian.crowd.directory.DbCachingDirectoryPoller] pollChanges Error occurred while refreshing the cache for directory [ 31064065 ].
com.atlassian.crowd.exception.OperationFailedException: Error looking up attributes for highestCommittedUSN
	at com.atlassian.crowd.directory.MicrosoftActiveDirectory.fetchHighestCommittedUSN(MicrosoftActiveDirectory.java:847)

...

Caused by: org.springframework.ldap.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580 ]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580 ]

Cause

LDAP Error 49 data 52e means that the credentials of the user configured to bind LDAP directory with JIRA are incorrect, as described here: https://confluence.atlassian.com/kb/common-user-management-errors-820119309.html#CommonUserManagementErrors-ActiveDirectoryError49

This can happen when that user is either removed or has its password changed from LDAP side.

Resolution 1

Follow the steps outlined at Restore Passwords To Recover Admin User Rights. By doing so, you’ll be able to access the User Directory settings and change the «Username» field with a valid admin user or change the «Password» field with the new password, allowing JIRA to connect to LDAP.

As an alternative to Recovery Mode, you could utilize auth_fallback by following the guide: Bypass SAML authentication for Jira Data Center 

Resolution 2

Alternatively, you can run the following query against your database to find out which one is the admin account that JIRA uses to connect to the LDAP:

SELECT * FROM cwd_directory_attribute WHERE attribute_name = 'ldap.userdn'; 

Note: The query may return multiple results in case you have more than one User Directory in your JIRA instance.

Re-adding the user back to the LDAP with the same password should resolve the issue.

Resolution 3

As JIRA storing LDAP Login credential in the database without encryption, you may also update those LDAP credential in your database:

lDAP Password Field

Select * from cwd_directory_attribute where attribute_name = 'ldap.password'

LDAP User Name Field

SELECT * FROM cwd_directory_attribute WHERE attribute_name = 'ldap.userdn';

(info) attribute_value is the fields which storing those data.

(info)  Always perform a backup before you perform edit/update query in the database. It is also highly recommended for you to perform this in a test instance before proceeding with production instance.

Источник

Last updated on: March 10th, 2021

vScope supports both Discovery of and integration with the Active Directory. If something goes wrong you will be prompted with an error message that can give you a hint of the cause to the issue.

The error messages might look something like this:

INVALID_CREDENTIALS: 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580 

INVALID_CREDENTIALS: 80090308: LdapErr: DSID-0C090400, comment: AcceptSecurityContext error, data 775, v1db1 

The code is listed after Data (in this case 52e and 775).

Here is a list of common error codes that might show up:

Error code Error Description
525 User not found Returned when an invalid username is supplied.
52e Invalid credentials Returned when a valid username is supplied but an invalid password/credential is supplied. If this error is received, it will prevent most other errors from being displayed.
530 Not permitted to logon at this time Returned when a valid username and password/credential are supplied during times when login is restricted.
531 Not permitted to logon from this workstation Returned when a valid username and password/credential are supplied, but the user is restriced from using the workstation where the login was attempted.
532 Password expired Returned when a valid username is supplied, and the supplied password is valid but expired.
533 Account disabled Returned when a valid username and password/credential are supplied but the account has been disabled.
701 Account expired Returned when a valid username and password/credential are supplied but the account has expired.
773 User must reset password Returned when a valid username and password/credential are supplied, but the user must change their password immediately (before logging in for the first time, or after the password was reset by an administrator).
775 Account locked out Returned when a valid username is supplied, but the account is locked out. Note that this error will be returned regardless of whether or not the password is invalid.

Further reading

You can read more about integrating vScope with Active Directory on this Knowledge Base post.

Источник

Понравилась статья? Поделить с друзьями:

Читайте также:

  • Accept security context failed with error code 0x80090308
  • Accent rar password recovery ошибка 303
  • Accelerometerst exe системная ошибка как исправить
  • Accelerometerst exe ошибка приложения 0xc000007b как исправить
  • Accelerometer calibration error

    • 0 0 голоса
    Рейтинг статьи
    Подписаться
    Уведомить о
    guest

    0 комментариев
    Старые
    Новые Популярные
    Межтекстовые Отзывы
    Посмотреть все комментарии