Uploaded image for project: 'Observium'
  1. Observium
  2. OBS-1830

Require bind entity permissions is not working

Details

    Description

      I update observium version, but i get the same error on ticket OBSERVIUM-1828 Resume: [I create diferents user in active directory and gave diferents levels of access, 1,5, 10. Everything work fine except level 1.
      When I gave access with level 1 to anyone and special permission on specified device, but permission no working. Not show anything. I atached some images with user permissions example]. I attached the image with version and permission.

      Attachments

        1. Config LDAP.PNG
          Config LDAP.PNG
          35 kB
        2. Debug1.PNG
          Debug1.PNG
          139 kB
        3. Debug2.PNG
          Debug2.PNG
          135 kB
        4. Debug3.PNG
          Debug3.PNG
          23 kB
        5. Sanpshot Version.PNG
          Sanpshot Version.PNG
          12 kB
        6. SFUser_ID.PNG
          SFUser_ID.PNG
          11 kB
        7. SQL_Device_Permission.PNG
          SQL_Device_Permission.PNG
          22 kB
        8. User Permission.PNG
          User Permission.PNG
          52 kB
        9. UsuarioSantaFe.PNG
          UsuarioSantaFe.PNG
          13 kB
        10. UsuarioSantaFe2.PNG
          UsuarioSantaFe2.PNG
          24 kB
        11. UsuarioSantaFe3.PNG
          UsuarioSantaFe3.PNG
          21 kB
        12. UsuarioSantaFe-SessionObservium.PNG
          UsuarioSantaFe-SessionObservium.PNG
          46 kB

        Activity

          [OBS-1830] Require bind entity permissions is not working

          Hi. i found something. I have direferents users in differents OU in the root AD domain. When I set 'auth_ldap_suffix for one selected OU, the user who lives in ths OU login perfectly with the rights permission, but the rest of users cant login. So if use 'auth_ldap_suffix whith ",DC=domain,dc=com" so can authenticate all users, but cant read permission in level 1 or another level. There are any configuration o work around to resolve this?

          favella@boldt.com.ar Fernando Avella added a comment - Hi. i found something. I have direferents users in differents OU in the root AD domain. When I set 'auth_ldap_suffix for one selected OU, the user who lives in ths OU login perfectly with the rights permission, but the rest of users cant login. So if use 'auth_ldap_suffix whith ",DC=domain,dc=com" so can authenticate all users, but cant read permission in level 1 or another level. There are any configuration o work around to resolve this?

          And check User IDs in user edit page, they not should -1 or 0!

          landy Mike Stupalov added a comment - And check User IDs in user edit page, they not should -1 or 0 !

          Observium fully support authentication via LDAP (and AD also).
          Your config and auth work well, except not get correct User ID from AD (can be this is related to your specific install).
          My devel AD config also work fine.

          Please sure, that you use rolling (trunk, not stable!) branch.
          Relogin with this user.
          Add you should set used permissions again, since old user_id was incorrect.

          landy Mike Stupalov added a comment - Observium fully support authentication via LDAP (and AD also). Your config and auth work well, except not get correct User ID from AD (can be this is related to your specific install). My devel AD config also work fine. Please sure, that you use rolling (trunk, not stable!) branch. Relogin with this user. Add you should set used permissions again, since old user_id was incorrect.

          I red the documentation y and the config, so I think observium not support user authentication via LDAP (Active Directory) in diferents OU, so I have to put all users that have access to observium in the same OU?

          favella@boldt.com.ar Fernando Avella added a comment - I red the documentation y and the config, so I think observium not support user authentication via LDAP (Active Directory) in diferents OU, so I have to put all users that have access to observium in the same OU?

          This message non informative

          landy Mike Stupalov added a comment - This message non informative

          We are on this revision

          [root@observium observium]# svn update
          At revision 7850.

          favella@boldt.com.ar Fernando Avella added a comment - We are on this revision [root@observium observium] # svn update At revision 7850.

          Please update to latest revision (r7850) and try now, I think should be fixed.

          landy Mike Stupalov added a comment - Please update to latest revision (r7850) and try now, I think should be fixed.

          I attached the screenshots. Debug1, Debug2, Debug3 because the is to large to take one screen picture.

          favella@boldt.com.ar Fernando Avella added a comment - I attached the screenshots. Debug1, Debug2, Debug3 because the is to large to take one screen picture.

          Ok, now I see where trouble, needed some more test than.

          • Please add debug option into config.php (remove after this tests):

            $config['web_debug_unprivileged'] = TRUE;
            

          • Logout from user (if logged)
          • add /debug to end of url (in browser url field) and hit enter (you will see some additional debug strings)
          • fill login/password fields (user SFUser) and click to "Login"
          • now you should see long debug output with LDAP auth debug, please store this full output and attach it here.
          landy Mike Stupalov added a comment - Ok, now I see where trouble, needed some more test than. Please add debug option into config.php (remove after this tests): $config['web_debug_unprivileged'] = TRUE; Logout from user (if logged) add /debug to end of url (in browser url field) and hit enter (you will see some additional debug strings) fill login/password fields (user SFUser) and click to "Login" now you should see long debug output with LDAP auth debug, please store this full output and attach it here.

          I did it. I attached output screenshot.

          favella@boldt.com.ar Fernando Avella added a comment - I did it. I attached output screenshot.

          People

            landy Mike Stupalov
            favella@boldt.com.ar Fernando Avella
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: