LDAP Connectivity

book

Article ID: 7933

calendar_today

Updated On:

Products

CA Application Test Service Virtualization CA Continuous Application Insight (PathFinder) CA Service Virtualization (DevTest / LISA / VSE / Application Test)

Issue/Introduction

Customer configured the  authentication-providers.xml file to connect to LDAP through DevTest.  When they tried to login to the workstation they are getting the pop-up message: " Workstation does not have permission to connect to the Registry". When they login through the portal,  they are able to login but all the tabs are greyed out. 

 The LDAP credentials were validated against JXplorer on the same machine where DevTest is running and everything is working fine.  The issue is happening only when user tries to login to DevTest workstation and the portal.  

 The ACL logs in lisa_tmp.x.x  folder  shows the following.  

 

INFO  com.ca.dts.security.authentication.internal.DevTestLdapAuthenticationProvider - Authentication successful for user 'QA-CALISA' with the 'ABC. LDAP Server' authentication provider.

 

2017-08-23 20:23:16,083Z (16:23) [ServerRequestResponder 5] DEBUG com.ca.dts.security.authentication.internal.DevTestLdapAuthenticationProvider - Loading group/member info for 'QA-CALISA'
2017-08-23 20:23:16,083Z (16:23) [ServerRequestResponder 5] DEBUG com.ca.dts.security.authentication.internal.DevTestLdapAuthenticationProvider - No values for 'memberOf' attribute.
2017-08-23 20:23:16,083Z (16:23) [ServerRequestResponder 5] DEBUG com.ca.dts.security.authentication.internal.utils.LdapHelper - Automatically adding users enabled: true
2017-08-23 20:23:16,192Z (16:23) [ServerRequestResponder 5] DEBUG org.springframework.security.ldap.userdetails.LdapUserDetailsMapper - Mapping user details from context with DN: cn=QA-CALISA,ou=Service Accounts,dc=devs,dc=COM...

Cause

The LDAP connectivity strings and the parameters used in the authentication-providers.xml file are valid.  

But in the acl.log we noticed the below message:

2017-08-23 20:23:16,083Z (16:23) [ServerRequestResponder 5] DEBUG com.ca.dts.security.authentication.internal.DevTestLdapAuthenticationProvider - No values for 'memberOf' attribute.

 We verified this message with the customer and we came to know that the LDAP user or service-account user was not a member ANY group in LDAP and this caused the issue. 

Environment

All supported DevTest releases and platforms.

Resolution

An LDAP user or service-account user MUST be a member of at-least one LDAP group for authentication to work within DevTest.  After adding the user to a group, customer was able to login to the Workstation and the Portal fine.