{"action":"created","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2069","repository_url":"https://api.github.com/repos/Graylog2/graylog2-server","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2069/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2069/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2069/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/2069","id":147939601,"number":2069,"title":"ldap login not working with graylog-2.0.0-3.beta.2","user":{"login":"dumpwhanau","id":14938759,"avatar_url":"https://avatars.githubusercontent.com/u/14938759?v=3","gravatar_id":"","url":"https://api.github.com/users/dumpwhanau","html_url":"https://github.com/dumpwhanau","followers_url":"https://api.github.com/users/dumpwhanau/followers","following_url":"https://api.github.com/users/dumpwhanau/following{/other_user}","gists_url":"https://api.github.com/users/dumpwhanau/gists{/gist_id}","starred_url":"https://api.github.com/users/dumpwhanau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dumpwhanau/subscriptions","organizations_url":"https://api.github.com/users/dumpwhanau/orgs","repos_url":"https://api.github.com/users/dumpwhanau/repos","events_url":"https://api.github.com/users/dumpwhanau/events{/privacy}","received_events_url":"https://api.github.com/users/dumpwhanau/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-04-13T03:53:42Z","updated_at":"2016-04-13T07:26:53Z","closed_at":"2016-04-13T06:20:54Z","body":"### Problem description\r\n\r\nI've been successfully using graylog-1.3.4 with LDAP, but when I tried to set it up with this new v2 system, it doesn't work (BTW the standalone accounts work)\r\n\r\n### Steps to reproduce the problem\r\n\r\n1. We use AD and have a forest with the LDAP groups in the parent and the user accounts in children domains. By using the AD Global Catalog server ports, you can make this work (ie log in with a child account that is a member of a parent group)\r\n2. I configured the LDAP admin page the same way as the 1.3.4 system *I think*. I also chose the cleartext LDAP port 3268 so I could run tcpdump for diagnostics\r\n3. doing a login (and viewing in wireshark) shows the following\r\n\r\n1. bind with \"system username\" succeeds. This does a search for my LDAP username I was trying to login with - and that search returns my LDAP DN plus some attributes such as the groups I am a member of - and I can see the graylog groups the \"group search pattern\" would match on show up as expected\r\n2. graylog then appears to iterate through all those groups, returning their cn - which it already knows. I have no idea what value this is doing, as it doesn't return new data\r\n3. bind with my DN and password. That succeeds. Final packets show graylog initiating the TCP FIN, cleanup occurs.  I see no evidence of any query for the group filter... The entire LDAP transaction is over with in <1sec\r\n4. login form shows \"Invalid credentials, please verify them and retry\" and the graylog logfile shows the below events\r\n\r\nSo according to tcpdump, there is no failed login event , but there is also no attempt to run the LDAP group filter (ours is \"(&(objectClass=group)(cn=cis-graylog*))\"). And logon fails\r\n\r\n2016-04-13T03:06:09.774Z WARN  [SessionsResource] Unable to log in user jhaar@ad.dom.main\r\norg.apache.shiro.authc.AuthenticationException: No account information found for authentication token [org.apache.shiro.authc.UsernamePasswordToken - jhaar@ad.dom.main, rememberMe=false] by this Authenticator instance.  Please check that it is configured correctly.\r\n\tat org.apache.shiro.authc.AbstractAuthenticator.authenticate(AbstractAuthenticator.java:202) ~[graylog.jar:?]\r\n\tat org.apache.shiro.mgt.AuthenticatingSecurityManager.authenticate(AuthenticatingSecurityManager.java:106) ~[graylog.jar:?]\r\n\tat org.apache.shiro.mgt.DefaultSecurityManager.login(DefaultSecurityManager.java:270) ~[graylog.jar:?]\r\n\tat org.apache.shiro.subject.support.DelegatingSubject.login(DelegatingSubject.java:256) ~[graylog.jar:?]\r\n\tat org.graylog2.rest.resources.system.SessionsResource.newSession(SessionsResource.java:94) [graylog.jar:?]\r\n\tat sun.reflect.GeneratedMethodAccessor401.invoke(Unknown Source) ~[?:?]\r\n\tat sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[?:1.8.0_77]\r\n\tat java.lang.reflect.Method.invoke(Unknown Source) ~[?:1.8.0_77]\r\n\tat org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) [graylog.jar:?]\r\n\tat org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) [graylog.jar:?]\r\n\tat org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) [graylog.jar:?]\r\n\tat org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205) [graylog.jar:?]\r\n\tat org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) [graylog.jar:?]\r\n\tat org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) [graylog.jar:?]\r\n\tat org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) [graylog.jar:?]\r\n\tat org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) [graylog.jar:?]\r\n\tat org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]\r\n\tat org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]\r\n\tat org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]\r\n\tat org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]\r\n\tat org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]\r\n\tat org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]\r\n\tat org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]\r\n\tat org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]\r\n\tat org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]\r\n\tat org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]\r\n\tat org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]\r\n\tat com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]\r\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:1.8.0_77]\r\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:1.8.0_77]\r\n\tat java.lang.Thread.run(Unknown Source) [?:1.8.0_77]\r\n\r\n### Environment\r\n\r\n* Graylog Version: graylog-server-2.0.0-3.beta.2.noarch\r\n* Elasticsearch Version: elasticsearch-2.3.1-1.noarch\r\n* MongoDB Version:  2.6.11-1.el7\r\n* Operating System: CentOS-7/64bit\r\n* Java: jre1.8.0_77-1.8.0_77-fcs.x86_64\r\n* Browser version: Firefox/Chrome/everything\r\n"},"comment":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/comments/209270936","html_url":"https://github.com/Graylog2/graylog2-server/issues/2069#issuecomment-209270936","issue_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/2069","id":209270936,"user":{"login":"kroepke","id":52014,"avatar_url":"https://avatars.githubusercontent.com/u/52014?v=3","gravatar_id":"","url":"https://api.github.com/users/kroepke","html_url":"https://github.com/kroepke","followers_url":"https://api.github.com/users/kroepke/followers","following_url":"https://api.github.com/users/kroepke/following{/other_user}","gists_url":"https://api.github.com/users/kroepke/gists{/gist_id}","starred_url":"https://api.github.com/users/kroepke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kroepke/subscriptions","organizations_url":"https://api.github.com/users/kroepke/orgs","repos_url":"https://api.github.com/users/kroepke/repos","events_url":"https://api.github.com/users/kroepke/events{/privacy}","received_events_url":"https://api.github.com/users/kroepke/received_events","type":"User","site_admin":false},"created_at":"2016-04-13T07:26:53Z","updated_at":"2016-04-13T07:26:53Z","body":"Great! Thanks for the feedback!"}}