MarkLogic LDAP - assigning an external name to a role not working

Question

I am using MarkLogic version 8.04 on CentOS 6. I am trying to do external authentication/authorization using LDAP.

I've created an external security authentication object:

name              ldap-config-simple
authentication    ldap
authorization     ldap
ldap server url   ldap://<my server address>:389
ldap base         ou=<mycompany>,dc=<info>,dc=<my org>
ldap attribute    sAMAccountName
ldap default user cn=<user id>,ou=xxxx,ou=yyyyy,dc=<info>,dc=<my org>
ldap bind method  simple

and associated it with an HTML App server (here are the pertinent settings):

authentication    basic
internal security true
external security ldap-config-simple

And I have associated an LDAP group to a role (here are the pertinent settings):

external name     cn=marklogic,ou=groups,dc=<info>,dc=<my org>

The problem is that authentication fails when I try to access the App server using my LDAP user. The log for the external LDAP server shows that the search string that MarkLogic sends looks like this:

(member=cn=marklogic,ou=groups,dc=<info>,dc=<my org>)

But the LDAP server is expecting the search to be:

(memberOf=cn=marklogic,ou=groups,dc=<info>,dc=<my org>)

The LDAP Server admin assures me that "memberOf" is the accepted standard for this type of query. We are using an OpenLDAP server - it is a pretty standard LDAP installation. Is there a way to have MarkLogic send "memberOf=" for the search rather than "member=" ?

Note that I was able to authenticate with my LDAP user ID through the App Server when I associated my user's DN in the LDAP server to a configured MarkLogic user. But I would prefer to use the Role based authentication since that puts the access controls in the LDAP server.

Any help appreciated.

Can you update the question with your external authentication configuration? — Tyler Replogle
@TylerReplogle I edited the question to add the external authentication configuration (not sure when you get notified ...) — Lou Klimoff

Lou Klimoff Lou Klimoff · Accepted Answer · 2016-05-31T13:59:02

Answering my own question. It is working now with the configuration above - although I didn't make any changes. MarkLogic support told me that a previous configuration may have been cached. In the process of debugging this I did a network packet trace to see exactly what MarkLogic was sending and it looks like it actually requests both the "memberOf" and "member" groups - I guess the LDAP admin only saw the latter in the logs.

MarkLogic LDAP - assigning an external name to a role not working

1 Answers