RSSE implementation

Ok, first off my excuses for the lengthy post but I was writing a manual for the RSSE thing and it just didnt work and now I use the manual part to explain what I did and I hope you can help me figure out what went wrong. 
 
I started yesterday to get acquainted with the RSSE (Report Server Security Extension) in the Actuate iServer Express 11. This technology should enable you to make your standard iServer Express work within your security environment like Microsoft?s Active Directory or LDAP. 
 
<blockquote class='ipsBlockquote' >
Now information about this is quite spread so here is what I found up to now. 
 
First we have the <a class='bbc_url' href='https://www.birt-exchange.com/be/documentation/actuate11-pdfs/using-iserver-integration-tech.pdf'>Official Documenatation</a> - page 561 or PDF page 585 
 
Then we have the <a class='bbc_url' href='https://www.birt-exchange.org/org/wiki/index.php?title=Report_Server_Security_Extention'>birt-exchange wiki</a>. 
 
Afther a bit more diging i found this on defshare: 
<a class='bbc_url' href='https://www.birt-exchange.com/be/documentation/actuate11-pdfs/using-iserver-integration-tech.pdf'>Based on Actuate 10 code</a> and also I found <a class='bbc_url' href=' <a class='bbc_url' href='https://www.birt-exchange.org/org/devshare/deploying-birt-reports/315-implementing-iserver-express-security-with-java-report-server-secruity-extension/'>https://www.birt-exchange.org/org/devshare/deploying-birt-reports/315-implementing-iserver-express-security-with-java-report-server-secruity-extension/'</a>>this one based on Actuate 10 code</a>. 
 
So armed with information and an example I started reading the official documentation. Here in there are several mentions of the the Actuate iServer Integration Technology. Now I toucht maybe smart to have some info on this <a class='bbc_url' href='https://www.birt-exchange.org/org/wiki/index.php?title=Server_Integration_Technology'>well</a> ? warning links in this wiki post are broken. 
 
So armed with this I decided to go meat the challenge afther reading the documentation. I came to the conclusion that the out of the 3 options available the Autentication is the way to go for me. Now there is a little snag all the code I found up 2 now was for Actuate 10 but no problem I thought because it should all work. So I started copying the $SERVER_HOME\servletcontainer\webapps\acrsse to myacrsse folder so to be sure I looked in the lib folder I saw the rsseLdap.jar (for the ones that read the documentation this is for LDAP extenral registration) 2 bad the rsseAuthenticate.jar was in there but I have my demo code so I compiled the rsseAuthenticate.jar from <a class='bbc_url' href='https://www.birt-exchange.org/org/devshare/deploying-birt-reports/315-implementing-iserver-express-security-with-java-report-server-secruity-extension/'>this example based on Actuate 10</a> with the handy ant file in my Eclipse environment. 
 
We continue following the instructions in the official documentation creating a new webapp etc. But we make a copy of the actuate11/rsse/wsdl folder and rename it to actuate10 just to be sure. (As far as I can tell they just added a few functions but I don?t think its going to mess things up). 
 
Now the 4th step should be done difrently this because we didn?t have the original package they are writing about in the documentation this should be I think: class=com.actuate10.rsse.authenticationSample.SampleRSSE. We change this in both the 10 and 11 folder to be sure we do not mess things up. 
 
So now we have the servlet with the soap service up and running (I think). 
 
So now we need to configure the encyclopaedia volume to work as we want it to. We create in the the $SERVER_HOME\etc folder a ldapconfig_your volumename.xml file. Containing the following: 
 
<pre class='_prettyXprint _lang-auto _linenums:0'>

<Config>

<Server>Server Name</Server>

<Port>389</Port>


<UserBaseDN>ou=O2U, dc=o2u, dc=nl</UserBaseDN>
</Config></pre>
 
Now that that?s done we only need to tell the serverconfiguration we want to use RSSE. Now with the enterprise we got a nice interface. But since were using the Express lets go to the AC_DATA_HOME\server\config (usely C:\Actuate11\iServer\data\config) we have the add the following data to the xml file: 
<pre class='_prettyXprint _lang-auto _linenums:0'>
<Volumes>
<Volume
?
EnableRSSEService="true"
RSSEIPAddress="hostname or IP address"
RSSESOAPPort="8900 or other port number"
RSSEContextString="/myrsse/servlet/AxisServlet"
?
</Volume>
<Volumes></pre>
 
Now save it and it should work: 
 
Restart your iServer express by going to <a class='bbc_url' href='http://localhost:8900/acadmin/config/'>http://localhost:8900/acadmin/config/</a> and brining the volume ofline. Then going to the $SERVER_HOME\bin folder and running the StopMC.bat wait till it stoped and start it up with the StartMC.bat and going again to the <a class='bbc_url' href='http://localhost:8900/acadmin/config/'>http://localhost:8900/acadmin/config/</a> and bring the volume on-line. </blockquote>
 
Now I done all that but somting go's wrong I get the folowing error: 
8008:Load balancer cannot locate meber. The specified volume is not online. 
Parameter0 = volumename. 
 
What did I do wrong did I foret somting or is the actuate10 code not competible with the actuate11 server if so were can I get my hands on the code. 
 
Thanks in advance for your time of reading the lengty post and any help is welcome.

Find more posts tagged with

Comments

mcremer

Ok a little update is in order. 
 
I am one step further now after playing a bit with the settings a bit I came to the folowing settings: 
<pre class='_prettyXprint _lang-auto _linenums:0'>


<Config>

<Server>name of server that has the active directory controll (not a slave)</Server>

<Port>389</Port>


<UserBaseDN>ou=O2u, dc=o2u, dc=local, dc=nl</UserBaseDN>

<UserObject>organizationalPerson</UserObject>
</Config>
</pre>
 
I also changed some settings of the RSSEIPadress I changed it to the ip address that I put in here as <server>. 
 
Now instead of the 8008 error I at least can access the iServer again. However I have the feeling its not authenticating trough the Active Directory. I still can login with the administrator of the iServer (and the Administrator account of the Active Directory has a diffident password). 
 
I also created a user birt that exists in the Active Directory on the iServer this users has a license is part of the local admin group and has no password. In the Active Directory it has a password. Now if I try to use this user I still have to leave the password field blank instead of using my Active Directory password for the user birt. 
 
So still not working as expected. But also not quite sure how I should approach this with authenticate i expect that I should add still the users manually to the iServer but there passwords are stored in the Active Directory meaning that the user names should be 1 on 1 the same. 
 
Please let me know if I got it wrong.

mcremer

Ok, afther a bit of tweaking and a lot of help of our reseller (he send us the current version of Actuate iServer Integration Technolgie with the authenticationSample that I was using was based on 10). 
 
I get now the folowing error: 
 
<pre class='_prettyXprint _lang-auto _linenums:0'>
2010-12-31 10:04:36,674 [http-8900-1] ERROR com.actuate11.rsse.authenticationSample.SampleRSSE - [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece ]
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece ]
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3041)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703)
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:293)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
at javax.naming.InitialContext.init(InitialContext.java:223)
at javax.naming.InitialContext.<init>(InitialContext.java:197)
at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
at com.actuate11.rsse.authenticationSample.LdapUserDAO.getInitialLdapContext(LdapUserDAO.java:59)
at com.actuate11.rsse.authenticationSample.LdapUserDAO.authenticate(LdapUserDAO.java:34)
at com.actuate11.rsse.authenticationSample.SampleRSSE.authenticateUser(SampleRSSE.java:74)
at com.actuate11.rsse.wsdl.ActuateSoapBindingImpl.authenticate(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.axis.providers.java.RPCProvider.invokeMethod(RPCProvider.java:388)
at org.apache.axis.providers.java.RPCProvider.processMessage(RPCProvider.java:283)
at org.apache.axis.providers.java.JavaProvider.invoke(JavaProvider.java:323)
at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)
at org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)
at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)
at org.apache.axis.handlers.soap.SOAPService.invoke(SOAPService.java:453)
at org.apache.axis.server.AxisServer.invoke(AxisServer.java:281)
at org.apache.axis.transport.http.AxisServlet.doPost(AxisServlet.java:699)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
at org.apache.axis.transport.http.AxisServletBase.service(AxisServletBase.java:327)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:567)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454)
at java.lang.Thread.run(Thread.java:619)
</pre>
 
my ldap config is somting like this: 
 
<pre class='_prettyXprint _lang-auto _linenums:0'>

<Config>

<Server>zlm-dc1</Server>

<Port>389</Port>


<UserBaseDN>OU=Intranet,OU=O2U,DC=o2u,DC=local</UserBaseDN>

<UserObject>organizationalPerson</UserObject>
</Config>
</pre>
 
Now I searched on the error and it says that it probably means that the LDAP does not allow for Anonymous searches. 
 
I checked the code and found this: 
 
<pre class='_prettyXprint _lang-auto _linenums:0'>
String uid = "uid = " + userName;
String userDN = uid + ", " + Scanner.getInstance().getUserBaseDN();
String providerURL = "ldap://" + Scanner.getInstance().getLDAPServer()
+ ":" + Scanner.getInstance().getLDAPPort();
Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.INITIAL_CONTEXT_FACTORY, contextFactory);
env.put(Context.PROVIDER_URL, providerURL);
env.put(Context.SECURITY_PRINCIPAL, userDN);
env.put(Context.SECURITY_CREDENTIALS, password);
</pre>
 
I checked the ldap version and it uses the Query Account (from the more complex ldap config in the documentation. But a user can always query it self. So I am not sure what is going wrong here any insights?

mcremer

Afther a bit of digging I found this bit of <a class='bbc_url' href='http://www-01.ibm.com/support/docview.wss?uid=swg21290631'>info</a> I think eny one using LDAP/RSSE needs to know. 
 
 
Cause 
The error shown below is similar each time there is an LDAP authentication issue. 
"The exception is [LDAP: error code 49 - 80090308: LdapErr: DSID-0Cxxxxxx, comment: AcceptSecurityContext error, data ****, vece ]." 
 
However, there are several values that can indicate what LDAP function is causing the issue. Here are some general references for Microsoft Active Directory: 
 
The AD-specific error code is the one after "data" and before "vece" or "v893" in the actual error string returned to the binding process 
 
525 user not found 
52e invalid credentials 
530 not permitted to logon at this time 
531 not permitted to logon at this workstation 
532 password expired 
533 account disabled 
701 account expired 
773 user must reset password 
775 user account locked 
 
 
Common Active Directory LDAP bind errors: 
 
80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 525, v893 
HEX: 0x525 - user not found 
DEC: 1317 - ERROR_NO_SUCH_USER (The specified account does not exist.) 
NOTE: Returns when username is invalid. 
 
80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 52e, v893 
HEX: 0x52e - invalid credentials 
DEC: 1326 - ERROR_LOGON_FAILURE (Logon failure: unknown user name or bad password.) 
NOTE: Returns when username is valid but password/credential is invalid. Will prevent most other errors from being displayed as noted. 
 
80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 530, v893 
HEX: 0x530 - not permitted to logon at this time 
DEC: 1328 - ERROR_INVALID_LOGON_HOURS (Logon failure: account logon time restriction violation.) 
NOTE: Returns only when presented with valid username and password/credential. 
 
80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 531, v893 
HEX: 0x531 - not permitted to logon from this workstation 
DEC: 1329 - ERROR_INVALID_WORKSTATION (Logon failure: user not allowed to log on to this computer.) 
LDAP[userWorkstations: <multivalued list of workstation names>] 
NOTE: Returns only when presented with valid username and password/credential. 
 
80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 532, v893 
HEX: 0x532 - password expired 
DEC: 1330 - ERROR_PASSWORD_EXPIRED (Logon failure: the specified account password has expired.) 
LDAP[userAccountControl: <bitmask=0x00800000>] - PASSWORDEXPIRED 
NOTE: Returns only when presented with valid username and password/credential. 
 
80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 533, v893 
HEX: 0x533 - account disabled 
DEC: 1331 - ERROR_ACCOUNT_DISABLED (Logon failure: account currently disabled.) 
LDAP[userAccountControl: <bitmask=0x00000002>] - ACCOUNTDISABLE 
NOTE: Returns only when presented with valid username and password/credential. 
 
80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 701, v893 
HEX: 0x701 - account expired 
DEC: 1793 - ERROR_ACCOUNT_EXPIRED (The user's account has expired.) 
LDAP[accountExpires: <value of -1, 0, or extemely large value indicates account will not expire>] - ACCOUNTEXPIRED 
NOTE: Returns only when presented with valid username and password/credential. 
 
80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 773, v893 
HEX: 0x773 - user must reset password 
DEC: 1907 - ERROR_PASSWORD_MUST_CHANGE (The user's password must be changed before logging on the first time.) 
LDAP[pwdLastSet: <value of 0 indicates admin-required password change>] - MUST_CHANGE_PASSWD 
NOTE: Returns only when presented with valid username and password/credential. 
 
80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 775, v893 
HEX: 0x775 - account locked out 
DEC: 1909 - ERROR_ACCOUNT_LOCKED_OUT (The referenced account is currently locked out and may not be logged on to.) 
LDAP[userAccountControl: <bitmask=0x00000010>] - LOCKOUT 
NOTE: Returns even if invalid password is presented

sgummuluru

Have you successfully integrated LDAP? I'm following thru the same steps in Actuate 11 SP1 and running into
different issues. Your inputs are helpful for me. How long it took for you to resolve the issues eventually?

Thank you!
Sudha

RSiegler

<blockquote class='ipsBlockquote' data-author="'sgummuluru'" data-cid="79345" data-time="1309382741" data-date="29 June 2011 - 02:25 PM">
Have you successfully integrated LDAP? I'm following thru the same steps in Actuate 11 SP1 and running into 
different issues. Your inputs are helpful for me. How long it took for you to resolve the issues eventually? 
 
Thank you! 
Sudha </blockquote>
 
 
Sudha, 
 
What issues are you running into? What kind of LDAP are you going against as well (Active Directory, etc)? 
 
--Ryan

johnw

Actuate 11 SP1 has a LDAP module for RSSE already included. Check the documentation on how to configure it.

Let me know if you need any further help.

mcremer

<blockquote class='ipsBlockquote' data-author="'sgummuluru'" data-cid="79345" data-time="1309382741" data-date="29 June 2011 - 02:25 PM">
Have you successfully integrated LDAP? I'm following thru the same steps in Actuate 11 SP1 and running into 
different issues. Your inputs are helpful for me. How long it took for you to resolve the issues eventually? 
 
Thank you! 
Sudha </blockquote>
 
We have it working, trought the actuate 11 included funcitonalety. But our custumer wants for now not intergrated so we disabled it for now. 
 
I mainly made this set of post to sort of help eny one that walked in to weard problems I had. This had 2 do with the domain the users was in etc. To truly validate a user a understanding of those errors is inportaint. Hence the post.

sgummuluru

Thanks for the response. I was able to compile and deploy RSSE with Actaute 11 SP1, but still having this error showing up. Have you came across something simialar? What does this mean?

Following is the error.

Operation: VOLUME ONLINE
The client sub-operation was Custom JSP Tag (takeVolumeOnline)
The server sub-operation was IDAPI (TakeVolumeOnline)

Item: VOLUMES
Error Code: 3165
Message: Problem with the Report Server Security Extension. Please contact your administrator.
Parameter1=-1
Parameter2=null

johnw

It couldn't bring the volume online, meaning there is some issue with the RSSE. Check the logs in the servlet container that is hosting the RSSE app and see if it is throwing errors.

lnallamalli

<blockquote class='ipsBlockquote' data-author="'sgummuluru'" data-cid="79504" data-time="1309545465" data-date="01 July 2011 - 11:37 AM">
Thanks for the response. I was able to compile and deploy RSSE with Actaute 11 SP1, but still having this error showing up. Have you came across something simialar? What does this mean? 
 
Following is the error. 
 
Operation: VOLUME ONLINE 
The client sub-operation was Custom JSP Tag (takeVolumeOnline) 
The server sub-operation was IDAPI (TakeVolumeOnline) 
 
Item: VOLUMES 
Error Code: 3165 
Message: Problem with the Report Server Security Extension. Please contact your administrator. 
Parameter1=-1 
Parameter2=null </blockquote>
 
 
Hi, How did you solve this issue? I am getting similar error in 11 SP3 
 
Thanks, 
Prasad