nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

unable to add user in LDAP

Karthikb

Hi All,

we configured LDAP on our Teamsite 7.41 on Linux envireonment. in the we are able to search the user but when we try to add a user its showing the following user could not be add due to the listed problems: failed to add user. please find the screen shot attached. please some one help us.

Thanks,

Karthik

Find more posts tagged with

Comments

Reji Varghese

Since you have enabled LDAP user addition, you wont be able to add it through the TeamSite GUI.

You should be adding the TeamSite users directly to the LDAP by specifying a separty property in LDA for each user.

Then you just need to issue the CLT iwldapsync.

The users will be sync'ed to TeamSite.

Karthikb

we tryied this is not working.

Reji Varghese

Do you have the attr_sync attribute mentioned in user_databases.xml and correct authentication mentod mentioned in iw.cfg ?

Adam Stoller

reji_kv wrote:
Since you have enabled LDAP user addition, you wont be able to add it through the TeamSite GUI.

[...]

I think you're talking about adding a user to LDAP - which isn't the issue here. The user was already found in LDAP, but they are unable to add them to TeamSite - which they should be able to do through the GUI.

Adam Stoller

Karthikb - can you find any additional diagnostic messages in any of the log files

(IWHOME/local/logs/*, IWHOME/local/logs/iwui/*, ApplicationContainer/server/default/log/server.log)?

That might help narrow down the scope of the issue.

You should also probably open a ticket with Support, if you haven't already.

Reji Varghese

ghoti wrote:
reji_kv wrote:
Since you have enabled LDAP user addition, you wont be able to add it through the TeamSite GUI.

[...]
I think you're talking about adding a user to LDAP - which isn't the issue here. The user was already found in LDAP, but they are unable to add them to TeamSite - which they should be able to do through the GUI.

What I meant to say is that If attr_sync is defined, TeamSite users from the LDAP file can only be
created by the synchronization process; TeamSite users from LDAP cannot be added or deleted through the Administration Console or using the iwuseradm CLT.

SuperStore.datadesign

Karthikb

we got a error in /apps/Interwoven/TeamSite/local/logs/iwtrace.log it shows

ERROR: 'Can't contact LDAP server' in binding to (10.193.104.131) on port 7501
[Tue Sep 16 12:34:07 2014] ERROR: LDAP Connect() FAILED. Unable to search for user 1169690

nipper

Well. That seems pretty self explanatory. Check your LDAP connection string. You will want to get your internal networking team involved because it likely will need to change. The file is in TeamSite/conf/user_database.xml or something similar.

Karthikb

hi,

please find the attachment for my user_database.xml and the log files. and I already raised a ticket in support. looking for a clearty on this issue.

Regards,

Karthik

Reji Varghese

The error states that you are not able to LDAP.

[Wed Sep 17 05:54:10 2014] ERROR: LDAP Connect() FAILED. Unable to search for user 1481062

Did you check if you have the correct values mentioned in the [authentication] section inside iw.cfg ?

[authentication]
ldap_server=xxxxxxxxxxxxxxxxxx
ldap_port=389
ldap_dnbase=ou=xxxxx,dc=xxxxxxx,dc=xxxx
ldap_key=cn
ldap_account=cn=xxxxxxxx
ldap_pwd=xxxxxxxxxxxxx

Karthikb

I had given all this details in user_database.xml. again i need to give it in iw.cfg? can you advice me.

Reji Varghese

Dont think thats needed, but you give it a try on ur DEV machine. Make sure login works after you make any change Smiley Wink

Also note that the “CAFile” tag in user_databases.xml expects a directory name where the CA files exist, not the name of the cert7.db file. These files should all be copied to a single directory.
They should also match what is specified in the authentication section of iw.cfg
Be sure that the .db file(s), certificate file(s) and truststore are readable by iwts and iwui (chmod 644 is recommended for most installations).

Karthikb

I had put all .db and my CAFile in the same folder which i referred in the user_databases.xml
They are matching with specified in the authentication section of iw.cfg
.db file(s), certificate file(s) and truststore are having 777 permission

but still i am getting the same error.

when i run the

./iwldapsync -t

i am getting the following data

[Thu Sep 18 05:55:47 2014] Start synchronizing LDAP user information...
[Thu Sep 18 05:55:47 2014] There is 1 LDAP user database configured for TeamSite                                                                                        :
[Thu Sep 18 05:55:47 2014]
  xxxxxxxxxxxx
        "xxxxxxxxxxxxx"
        OS
        "xx.xx.xx.xx"
        "389"
        "uid"
        "7501"
        "/apps/Interwoven/TeamSite/conf/roles/CAFile"
        "(o=standardchartered)"
        "cn=1481062,ou=users,o=xxxxxxxxxxxx"
        "mail"
        "cn"
        ""
        ""
[Thu Sep 18 05:55:47 2014] Getting existing TeamSite users for LDAP server "xxxxxxxxxxxxxx"
[Thu Sep 18 05:55:47 2014] There are 2 existing TeamSite users for LDAP server " xxxxxxxxxxxxxxxxxx".
[Thu Sep 18 05:55:47 2014] Synchronizing users from LDAP server "xxxxxxxxxxxxxxx".
ERROR: 'Can't contact LDAP server' in binding to (10.193.104.131) on port 7501
[Thu Sep 18 05:55:47 2014] ERROR: LDAP Connect(10.193.104.131) FAILED.
[Thu Sep 18 05:55:47 2014] There is no LDAP user to be updated.
[Thu Sep 18 05:55:47 2014] There is no LDAP user to be removed.
[Thu Sep 18 05:55:47 2014] There is no LDAP user to be created.
[Thu Sep 18 05:55:47 2014] Finished synchronizing LDAP user information.
[root@dl1095 bin]#

Reji Varghese

I am not exactly sure what you are really trying to acheive :

Are you planning to add users through the Admin GUI ? , or
using iwldapsync to sync TeamSite users ?

Both the wont work simultaneously. So, you have to decide what you really want.

In your last post you mentioned you tried iwldapsync and logs do say that you are able to connect to LDAP. The error is when you try to sync the users. To sync the users you would need to mention attr_sync parameter in your users_databases.xml file.

Something like this :

<attr_sync name="xxxxxxxxxxx" value="master,tsuser,ccpro,ccstd,ccpro_only,ccstd_only"> </attr_sync>

where xxxxxxxxxxx is the parameter in the LDAP schema where the sync will be performed.

Karthikb

yes your right i need to sync the ldap users.

already tried to the attr_sync.

But when i add this tag my ldap tab has got disabled. So i removed that.

please find the attachment for my user_database.xml and the error page of my teamsite UI

Reji Varghese

Thats normal that the "LDAP Browse" button is disabled and its not an error.

Now, if you try iwldapsync, what do you get in the logs ?

Karthikb

i am not able to search the users and when i run the iwldapsync the output is bellow.

[Thu Sep 18 11:05:21 2014] Start synchronizing LDAP user information...
[Thu Sep 18 11:05:21 2014] There is 1 LDAP user database configured for TeamSite                                                                                        :
[Thu Sep 18 11:05:21 2014]
        xxxxxxxxxx
        "xxxxxxxxxx"
        OS
        "xx.xx.xx.xx"
        "389"
        "uid"
        "7501"
        "/apps/Interwoven/TeamSite/conf/roles/CAFile"
        "(o=xxxxxxxxxx)"
        "cn=1481062,ou=users,o=xxxxxxxxxx"
        "mail"
        "cn"
        "description"
        "master,tsuser,ccpro,ccstd,ccpro_only,ccstd_only"
[Thu Sep 18 11:05:21 2014] Getting existing TeamSite users for LDAP server "stan                                                                                        dardchartered"
[Thu Sep 18 11:05:21 2014] There are 2 existing TeamSite users for LDAP server "                                                                                        xxxxxxxxxx".
[Thu Sep 18 11:05:21 2014] Synchronizing users from LDAP server "xxxxxxxxxx".
ERROR: 'Can't contact LDAP server' in binding to (10.193.104.131) on port 7501
[Thu Sep 18 11:05:21 2014] ERROR: LDAP Connect(10.193.104.131) FAILED.
[Thu Sep 18 11:05:21 2014] There is no LDAP user to be updated.
[Thu Sep 18 11:05:21 2014] There is no LDAP user to be removed.
[Thu Sep 18 11:05:21 2014] There is no LDAP user to be created.
[Thu Sep 18 11:05:21 2014] Finished synchronizing LDAP user information.

please find my iw.cfg file in the attachment

Reji Varghese

I am out of options now.

One thing I dont seem right is, in your user_database.xml, you have mentioned port 7501 and os="f".

But the log file mentions OS, "10.193.104.131", "389"

No idea where from where this information is being pulled.

And you got any help from support yet ?

Rick Poulin

Well you can query users but you can't get the details about the user, so that leads me to think maybe the account you're using to connect to LDAP doesn't have sufficient perms on their end.

Karthikb

hi,

7501 is the OVD port. and 389 is the actual LDAP port number. here 7501 is working as layer it will get redirect to the 389 port.

and we are planning to add users through the Admin GUI.

Karthik Smiley Happy

Reji Varghese

OVD, i guess its oracle virtual directory. Never worked/integrated it.

Since you are planning to add it via the GUI or command line, you wouldnt need the LDAP sync anyways Smiley Very Happy

Karthikb

Thanks reji,

i don't understand completely. Can you explain me bit briefly please. And can you tell me is there any alternate way to use this in GUI?

Karthik

Reji Varghese

Initially you mentioned you plan to use LDAP sync, now that you have changed the plan to add the users via the Admin GUI, you can remove the <attr_sync> from user_database.xml.

Then you will get your LDAP browse option enabled. And you already were able to search user, you can just Add the users using GUI.

TagPrintReport.rptdesign

Capture1.JPG

Capture2.JPG

Karthikb

I did that. LDAP browser is enabling now and i can able to search user. when i add the user it shows unable to add user (add user failed) error at UI.

Karthik