{"action":"created","issue":{"url":"https://api.github.com/repos/gitblit/gitblit/issues/920","labels_url":"https://api.github.com/repos/gitblit/gitblit/issues/920/labels{/name}","comments_url":"https://api.github.com/repos/gitblit/gitblit/issues/920/comments","events_url":"https://api.github.com/repos/gitblit/gitblit/issues/920/events","html_url":"https://github.com/gitblit/gitblit/issues/920","id":107226992,"number":920,"title":"LDAP login fails, resulting in incorrect user permissions until the next sync","user":{"login":"rconaway","id":481618,"avatar_url":"https://avatars.githubusercontent.com/u/481618?v=3","gravatar_id":"","url":"https://api.github.com/users/rconaway","html_url":"https://github.com/rconaway","followers_url":"https://api.github.com/users/rconaway/followers","following_url":"https://api.github.com/users/rconaway/following{/other_user}","gists_url":"https://api.github.com/users/rconaway/gists{/gist_id}","starred_url":"https://api.github.com/users/rconaway/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rconaway/subscriptions","organizations_url":"https://api.github.com/users/rconaway/orgs","repos_url":"https://api.github.com/users/rconaway/repos","events_url":"https://api.github.com/users/rconaway/events{/privacy}","received_events_url":"https://api.github.com/users/rconaway/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-18T15:45:17Z","updated_at":"2015-09-25T02:08:44Z","closed_at":null,"body":"We are using LDAP for authentication.  When a user logs in, an error is  logged and the user seems to be logged in correctly, but his permissions are not correct until the next LDAP sync.  \r\n\r\nWe've debugged the code to line 523 in class LDAPAuthProvider.  When we take the LDAP arguments (base, filter, attributes) from that point and manually make the LDAP call using Softerra LDAP browser, the manual call works fine.\r\n\r\nThe production instance in Linux, but I can reproduce on a machine running Windows 7, GitBlit go version 1.6.2.\r\n\r\nOur next step will be to try to build from source and reproduce.  We'd appreciate any suggestions about what might be wrong or how best to pinpoint the problem.\r\n\r\nRob Conaway\r\n\r\n---\r\nThe following is the (redacted) log message:\r\n\r\n    2015-09-18 09:26:09 [INFO ] Running on Windows 7 (6.1)\r\n    2015-09-18 09:26:09 [INFO ] Logging initialized @461ms\r\n    2015-09-18 09:26:09 [INFO ] Using JCE Standard Encryption Policy files, encryption key lengths will be limited\r\n    2015-09-18 09:26:09 [INFO ] Setting up HTTPS transport on port 443\r\n    2015-09-18 09:26:09 [INFO ]    certificate alias = localhost\r\n    2015-09-18 09:26:09 [INFO ]    keyStorePath   = C:\\REDACTED\\gitblit-1.6.2\\data\\serverKeyStore.jks\r\n    2015-09-18 09:26:09 [INFO ]    trustStorePath = C:\\REDACTED\\gitblit-1.6.2\\data\\serverTrustStore.jks\r\n    2015-09-18 09:26:09 [INFO ]    crlPath        = C:\\REDACTED\\gitblit-1.6.2\\data\\certs\\caRevocationList.crl\r\n    2015-09-18 09:26:09 [INFO ] Setting up HTTP transport on port 80\r\n    2015-09-18 09:26:09 [INFO ] Shutdown Monitor listening on port 8081\r\n    2015-09-18 09:26:09 [INFO ] jetty-9.2.3.v20140905\r\n    2015-09-18 09:26:12 [INFO ] NO JSP Support for /, did not find org.apache.jasper.servlet.JspServlet\r\n    2015-09-18 09:26:12 [INFO ] \r\n      . . .\r\n    2015-09-18 09:26:23 [ERROR] Problem Searching LDAP\r\n    LDAPSearchException(resultCode=32 (no such object), numEntries=0, numReferences=0, errorMessage='0000208D: NameErr: DSID-0315258B, problem 2001 (NO_OBJECT), data 0, best match of:\r\n      'O=REDACTED,C=US'\r\n    ', matchedDN='O=REDACTED,C=US')\r\n      at com.unboundid.ldap.sdk.LDAPConnection.search(LDAPConnection.java:3091)\r\n      at com.gitblit.auth.LdapAuthProvider.doSearch(LdapAuthProvider.java:523)\r\n      at com.gitblit.auth.LdapAuthProvider.getTeamsFromLdap(LdapAuthProvider.java:456)\r\n      at com.gitblit.auth.LdapAuthProvider.authenticate(LdapAuthProvider.java:340)\r\n      at com.gitblit.manager.AuthenticationManager.authenticate(AuthenticationManager.java:380)\r\n      at com.gitblit.wicket.pages.RootPage$LoginForm$1.onSubmit(RootPage.java:567)\r\n      at org.apache.wicket.markup.html.form.Form.delegateSubmit(Form.java:1595)\r\n      at org.apache.wicket.markup.html.form.Form.process(Form.java:960)\r\n      at org.apache.wicket.markup.html.form.Form.onFormSubmitted(Form.java:922)\r\n      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)\r\n      at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)\r\n      at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)\r\n      at java.lang.reflect.Method.invoke(Unknown Source)\r\n      at org.apache.wicket.RequestListenerInterface.invoke(RequestListenerInterface.java:182)\r\n      . . .\r\n      \r\n---\r\nHere is the LDAP portion of the gitblit.properties\r\n\r\n    realm.authenticationProviders = ldap\r\n    realm.ldap.server = ldaps://REDACTED.com:636\r\n    realm.ldap.username = REDACTED=2031441, ou=Employee, ou=People, o=REDACTED, c=US\r\n    realm.ldap.password = gv3$0819\r\n    realm.ldap.maintainTeams = true\r\n    realm.ldap.accountBase = ou=Employee, ou=People, o=REDACTED, c=US\r\n    realm.ldap.accountPattern = (&(objectClass=person)(uid=rconawa2)(|(memberOf=CN=REDACTED-DEVELOPERS,OU=Groups,O=REDACTED,C=US)(memberOf=CN=REDACTED-DEVELOPERS,OU=Groups,O=REDACTED,C=US)))\r\n    realm.ldap.groupBase = OU=Groups,O=REDACTED,C=US\r\n    realm.ldap.groupMemberPattern = (&(objectClass=group)(member=REDACTEDGID=1988870,OU=Employee,OU=People,O=REDACTED,C=US))\r\n    realm.ldap.groupEmptyMemberPattern = (&(objectClass=group)(!(member=*)))\r\n    realm.ldap.admins = (CN=REDACTED-GIT-ADMINISTRATORS,OU=Groups,O=REDACTED,C=US)\r\n    realm.ldap.displayName = REDACTEDDisplayName \r\n    realm.ldap.email = mail\r\n    realm.ldap.synchronize = true\r\n    realm.ldap.syncPeriod = 5 MINUTES\r\n    realm.ldap.removeDeletedUsers = true\r\n"},"comment":{"url":"https://api.github.com/repos/gitblit/gitblit/issues/comments/143102568","html_url":"https://github.com/gitblit/gitblit/issues/920#issuecomment-143102568","issue_url":"https://api.github.com/repos/gitblit/gitblit/issues/920","id":143102568,"user":{"login":"gitblit","id":868217,"avatar_url":"https://avatars.githubusercontent.com/u/868217?v=3","gravatar_id":"","url":"https://api.github.com/users/gitblit","html_url":"https://github.com/gitblit","followers_url":"https://api.github.com/users/gitblit/followers","following_url":"https://api.github.com/users/gitblit/following{/other_user}","gists_url":"https://api.github.com/users/gitblit/gists{/gist_id}","starred_url":"https://api.github.com/users/gitblit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gitblit/subscriptions","organizations_url":"https://api.github.com/users/gitblit/orgs","repos_url":"https://api.github.com/users/gitblit/repos","events_url":"https://api.github.com/users/gitblit/events{/privacy}","received_events_url":"https://api.github.com/users/gitblit/received_events","type":"User","site_admin":false},"created_at":"2015-09-25T02:08:44Z","updated_at":"2015-09-25T02:08:44Z","body":"Sorry Rob, I'm not an LDAP expert.  It does seem suspicious that reusing the connection fails.  When you get a fresh connection, the connection is either bound to fixed credentials specified in the config or is not bound at all - depends on your config.  When you re-use the connection from authenticate, the connection is bound to the logging-in user, I think.  I'm sure you already know that but I'm wondering if that detail is significant here."}}