{"action":"created","issue":{"url":"https://api.github.com/repos/rundeck/rundeck/issues/4057","repository_url":"https://api.github.com/repos/rundeck/rundeck","labels_url":"https://api.github.com/repos/rundeck/rundeck/issues/4057/labels{/name}","comments_url":"https://api.github.com/repos/rundeck/rundeck/issues/4057/comments","events_url":"https://api.github.com/repos/rundeck/rundeck/issues/4057/events","html_url":"https://github.com/rundeck/rundeck/issues/4057","id":363657091,"node_id":"MDU6SXNzdWUzNjM2NTcwOTE=","number":4057,"title":"RD3: AD Auth issue, Unable to login with AD credentials due to an error","user":{"login":"mrthomaskim","id":3604270,"node_id":"MDQ6VXNlcjM2MDQyNzA=","avatar_url":"https://avatars2.githubusercontent.com/u/3604270?v=4","gravatar_id":"","url":"https://api.github.com/users/mrthomaskim","html_url":"https://github.com/mrthomaskim","followers_url":"https://api.github.com/users/mrthomaskim/followers","following_url":"https://api.github.com/users/mrthomaskim/following{/other_user}","gists_url":"https://api.github.com/users/mrthomaskim/gists{/gist_id}","starred_url":"https://api.github.com/users/mrthomaskim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrthomaskim/subscriptions","organizations_url":"https://api.github.com/users/mrthomaskim/orgs","repos_url":"https://api.github.com/users/mrthomaskim/repos","events_url":"https://api.github.com/users/mrthomaskim/events{/privacy}","received_events_url":"https://api.github.com/users/mrthomaskim/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-09-25T16:08:34Z","updated_at":"2018-09-26T14:18:21Z","closed_at":null,"author_association":"NONE","body":"**Describe the bug**\r\nI followed the direction below, but I am having an issue getting AD auth to work\r\nhttps://rundeck.org/docs/administration/security/authenticating-users.html\r\n\r\n**My Rundeck detail**\r\n* Rundeck version: rundeck-3.0.6-20180917.war\r\n* install type: WAR for Windows\r\n* OS Name/version: Windows 2016\r\n* DB Type/version: MSSQL\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. Updated start-rundeck.bat\r\n2. Created jaas-ldap.conf file\r\n3. Updated admin.aclpolicy file to use security group called rundeckusers\r\n4. Restart the rundeck service using nssm.exe file\r\n5. Attempted to login with valid user credentials, but getting an error message\r\n\r\n**Expected behavior**\r\nI receive an error message `Invalid username and password.` Despite the password is correct\r\n![image](https://user-images.githubusercontent.com/3604270/46027025-71c13800-c0b2-11e8-80fa-6544c70fbd6f.png)\r\n\r\nWhen I check the log, i kept getting an error message: `Authentication request failed: org.springframework.security.authentication.AuthenticationServiceException: java.lang.NullPointerException: invalid null input(s)`\r\n\r\n**Desktop:**\r\n - OS: [e.g. iOS] Mac OS X 10.13.6 or Windows 10\r\n - Browser [e.g. chrome, safari] any updated browsers\r\n\r\n\r\n*start-rundeck.bat*\r\n```\r\nset CURDIR=%~dp0\r\ncall %CURDIR%etc\\profile.bat\r\njava %RDECK_CLI_OPTS% %RDECK_SSL_OPTS% -Dcom.dtolabs.rundeck.jetty.jaas.LEVEL=DEBUG -Drundeck.jaaslogin=true -Dloginmodule.conf.name=jaas-ldap.conf -Dloginmodule.name=activedirectory -jar rundeck-3.0.6-20180917.war --skipinstall -d >> %CURDIR%\\var\\logs\\service.log  2>&1\r\n```\r\n\r\n\r\n*jaas-ldap.conf*\r\n```\r\nactivedirectory {\r\n    com.dtolabs.rundeck.jetty.jaas.JettyCachingLdapLoginModule required\r\n        debug=\"true\"\r\n        contextFactory=\"com.sun.jndi.ldap.LdapCtxFactory\"\r\n        providerUrl=\"ldap://domain_controller_01.contoso.com:389\"\r\n        bindDn=\"CN=account,CN=Users,DC=contoso,DC=com\"\r\n        bindPassword=\"StrongPassword\"\r\n        authenticationMethod=\"simple\"\r\n        forceBindingLogin=\"true\"\r\n        userBaseDn=\"CN=Users,DC=contoso,DC=com\"\r\n        userRdnAttribute=\"sAMAccountName\"\r\n        userIdAttribute=\"sAMAccountName\"\r\n        userPasswordAttribute=\"unicodePwd\"\r\n        userObjectClass=\"user\"\r\n        roleBaseDn=\"OU=Groups,DC=contoso,DC=com\"\r\n        roleNameAttribute=\"cn\"\r\n        roleMemberAttribute=\"member\"\r\n        roleObjectClass=\"group\"\r\n        cacheDurationMillis=\"300000\"\r\n        reportStatistics=\"true\";\r\n};\r\n```\r\n\r\n\r\n*rundeck-config.properties*\r\n```\r\n#loglevel.default is the default log level for jobs: ERROR,WARN,INFO,VERBOSE,DEBUG\r\nloglevel.default=INFO\r\nrdeck.base=C:/rundeck\r\n\r\n#rss.enabled if set to true enables RSS feeds that are public (non-authenticated)\r\nrss.enabled=false\r\nserver.address=job.contoso.com\r\ngrails.serverURL=http://job.contoso.com:4440\r\n\r\n#dataSource.dbCreate = update\r\n#dataSource.url = jdbc:h2:file:C:/rundeck/server/data/grailsdb;MVCC=true\r\n\r\n# SQL Database\r\nrundeck.projectsStorageType=db\r\ndataSource.dbCreate = update\r\ndataSource.driverClassName = com.microsoft.sqlserver.jdbc.SQLServerDriver\r\ndataSource.url = jdbc:sqlserver://sql_server.contoso.com;DatabaseName=RUNDECK\r\ndataSource.username = rundeck_account\r\ndataSource.password = SomeStrongPassword\r\n\r\n\r\n# Pre Auth mode settings\r\nrundeck.security.authorization.preauthenticated.enabled=false\r\nrundeck.security.authorization.preauthenticated.attributeName=REMOTE_USER_GROUPS\r\nrundeck.security.authorization.preauthenticated.delimiter=,\r\n# Header from which to obtain user name\r\nrundeck.security.authorization.preauthenticated.userNameHeader=X-Forwarded-Uuid\r\n# Header from which to obtain list of roles\r\nrundeck.security.authorization.preauthenticated.userRolesHeader=X-Forwarded-Roles\r\n# Redirect to upstream logout url\r\nrundeck.security.authorization.preauthenticated.redirectLogout=false\r\nrundeck.security.authorization.preauthenticated.redirectUrl=/oauth2/sign_in\r\n\r\nrundeck.log4j.config.file=C:/rundeck/server/config/log4j.properties\r\n```\r\n\r\n\r\n*admin.aclpolicy*\r\n```\r\ndescription: Admin, all access.\r\ncontext:\r\n  project: '.*' # all projects\r\nfor:\r\n  resource:\r\n    - allow: '*' # allow read/create all kinds\r\n  adhoc:\r\n    - allow: '*' # allow read/running/killing adhoc jobs\r\n  job: \r\n    - allow: '*' # allow read/write/delete/run/kill of all jobs\r\n  node:\r\n    - allow: '*' # allow read/run for all nodes\r\nby:\r\n  group: rundeckusers\r\n\r\n---\r\n\r\ndescription: Admin, all access.\r\ncontext:\r\n  application: 'rundeck'\r\nfor:\r\n  resource:\r\n    - allow: '*' # allow create of projects\r\n  project:\r\n    - allow: '*' # allow view/admin of all projects\r\n  project_acl:\r\n    - allow: '*' # allow admin of all project-level ACL policies\r\n  storage:\r\n    - allow: '*' # allow read/create/update/delete for all /keys/* storage content\r\nby:\r\n  group: rundeckusers\r\n```\r\n\r\n\r\nBelow is a the log and I receive the following error:\r\n```\r\n018-09-25 10:45:14.654 DEBUG --- [tp2103376190-29] ailsUsernamePasswordAuthenticationFilter : Request is to process authentication\r\n2018-09-25 10:45:14.717  INFO --- [tp2103376190-29] c.d.r.j.j.JettyCachingLdapLoginModule    : Login attempts: 1, Hits:0, Ratio: 0%.\r\n2018-09-25 10:45:14.717 DEBUG --- [tp2103376190-29] c.d.r.j.j.JettyCachingLdapLoginModule    : Cache Miss for tkim.\r\n2018-09-25 10:45:14.717 DEBUG --- [tp2103376190-29] c.d.r.j.j.JettyCachingLdapLoginModule    : Searching for users with filter: '(&(objectClass={0})({1}={2}))' from base dn: CN=Users,DC=contoso,DC=com\r\n2018-09-25 10:45:14.732 DEBUG --- [tp2103376190-29] c.d.r.j.j.JettyCachingLdapLoginModule    : Found user?: true\r\n2018-09-25 10:45:14.748  INFO --- [tp2103376190-29] c.d.r.j.j.JettyCachingLdapLoginModule    : Attempting authentication: CN=Thomas Kim,CN=Users,DC=contoso,DC=com\r\n2018-09-25 10:45:14.764 DEBUG --- [tp2103376190-29] c.d.r.j.j.JettyCachingLdapLoginModule    : JettyCachingLdapLoginModule: User 'tkim' has roles: [rundeckusers]\r\n2018-09-25 10:45:14.764 DEBUG --- [tp2103376190-29] c.d.r.j.j.JettyCachingLdapLoginModule    : Adding tkim set to expire: 1537890354764300100\r\n2018-09-25 10:45:14.764 DEBUG --- [tp2103376190-29] ailsUsernamePasswordAuthenticationFilter : Authentication request failed: org.springframework.security.authentication.AuthenticationServiceException: java.lang.NullPointerException: invalid null input(s)\r\n        at java.base/java.util.Objects.requireNonNull(Unknown Source)\r\n\r\n\r\n2018-09-25 10:49:10.934 DEBUG --- [tp1919292887-26] ailsUsernamePasswordAuthenticationFilter : Authentication request failed: org.springframework.security.authentication.AuthenticationServiceException: java.lang.NullPointerException: invalid null input(s)\r\n        at java.base/java.util.Objects.requireNonNull(Unknown Source)\r\n        at java.base/javax.security.auth.Subject$SecureSet.add(Unknown Source)\r\n        at java.base/java.util.Collections$SynchronizedCollection.add(Unknown Source)\r\n        at org.eclipse.jetty.jaas.spi.AbstractLoginModule$JAASUserInfo.setJAASInfo(AbstractLoginModule.java:89)\r\n        at org.eclipse.jetty.jaas.spi.AbstractLoginModule.commit(AbstractLoginModule.java:200)\r\n        at com.dtolabs.rundeck.jetty.jaas.JettyCachingLdapLoginModule.commit(JettyCachingLdapLoginModule.java:986)\r\n        at java.base/javax.security.auth.login.LoginContext.invoke(Unknown Source)\r\n        at java.base/javax.security.auth.login.LoginContext.access$000(Unknown Source)\r\n        at java.base/javax.security.auth.login.LoginContext$4.run(Unknown Source)\r\n        at java.base/javax.security.auth.login.LoginContext$4.run(Unknown Source)\r\n        at java.base/java.security.AccessController.doPrivileged(Native Method)\r\n        at java.base/javax.security.auth.login.LoginContext.invokePriv(Unknown Source)\r\n        at java.base/javax.security.auth.login.LoginContext.login(Unknown Source)\r\n        at org.springframework.security.authentication.jaas.AbstractJaasAuthenticationProvider.authenticate(AbstractJaas\r\nAuthenticationProvider.java:180)\r\n        at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174)\r\n        at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(Us\r\nernamePasswordAuthenticationFilter.java:94)\r\n        at grails.plugin.springsecurity.web.authentication.GrailsUsernamePasswordAuthenticationFilter.attemptAuthenticat\r\nion(GrailsUsernamePasswordAuthenticationFilter.groovy:53)\r\n        at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthe\r\nnticationProcessingFilter.java:212)\r\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\r\n        at grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter.doFilter(MutableLogoutFilter.groov\r\ny:64)\r\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)\r\n        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistence\r\nFilter.java:105)\r\n```\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/rundeck/rundeck/issues/comments/424732801","html_url":"https://github.com/rundeck/rundeck/issues/4057#issuecomment-424732801","issue_url":"https://api.github.com/repos/rundeck/rundeck/issues/4057","id":424732801,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNDczMjgwMQ==","user":{"login":"sjrd218","id":36643360,"node_id":"MDQ6VXNlcjM2NjQzMzYw","avatar_url":"https://avatars3.githubusercontent.com/u/36643360?v=4","gravatar_id":"","url":"https://api.github.com/users/sjrd218","html_url":"https://github.com/sjrd218","followers_url":"https://api.github.com/users/sjrd218/followers","following_url":"https://api.github.com/users/sjrd218/following{/other_user}","gists_url":"https://api.github.com/users/sjrd218/gists{/gist_id}","starred_url":"https://api.github.com/users/sjrd218/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sjrd218/subscriptions","organizations_url":"https://api.github.com/users/sjrd218/orgs","repos_url":"https://api.github.com/users/sjrd218/repos","events_url":"https://api.github.com/users/sjrd218/events{/privacy}","received_events_url":"https://api.github.com/users/sjrd218/received_events","type":"User","site_admin":false},"created_at":"2018-09-26T14:18:21Z","updated_at":"2018-09-26T14:18:21Z","author_association":"CONTRIBUTOR","body":"Based on your debug logs, it looks like you've successfully configured the JAAS/AD connection. Your user authenticated with the AD server and returned the user's roles. There appears to be something that's happening after the AD bind that's producing the error. Thanks for reporting this bug."}}
{"actor":{"display_login":"sjrd218"}}