MarkLogic LDAP authentication

Question

I'm running ML9 on a MacOS. I am trying to setup External Authentication (and Authorization eventually) on Query Console (on App-Server port 8000).

I have: 1. Created OpenLDAP server with some users 2. Created LDAP config with below details:

Name: ExtLDAP
authentication: ldap
authorization: internal
ldap server uri: ldap://localhost:389
ldap base: dc=babji,dc=com
ldap attribute: cn
ldap default user: cn=Manager,dc=babji,dc=com
ldap password: [password of the above default user in OpenLDAP database]
ldap bind method: simple
ldap memberof attribute: ou
ldap memer attribute: ou
ssl require client certificate: false

Updated Query Console App-Services [port 8000] with below details:

authentication: basic internal security: false external securities: ExtLDAP default user: nobody
Created an internal user with below details:

name: ldapuser external name: cn=Newer Surname,ou=BizUser,dc=babji,dc=com

Tested below: Successful

xdmp:ldap-search( "sn=Surname", options xmlns="xdmp:ldap"> username>cn=Manager,dc=babji,dc=com password>xxxx server-uri>ldap://localhost:389 search-base>ou=BiZUser,dc=babji,dc=com bind-method>simple /options>) (Forgive the format above. I was unable to change this to a code format.)

ldapsearch works too:

ldapsearch -D "cn=manager,dc=babji,dc=com" -b dc=babji,dc=com -W objectclass=*

Issue:

When I try to login to query console using the browser with one of the cn entries (users) in the LDAP database, I am unable to login. Also, below command does not work.

xdmp:http-get("http://localhost:8000",
     <options xmlns="xdmp:http">
       <authentication>
         <username>Newer Surname</username>
         <password>xxxx</password>
       </authentication>
     </options>)

I am unsure what configurations should I put in the config page. Can you please help or re-direct me to a right location?

regards, Bharadwaj

David Ennis David Ennis · Accepted Answer · 2017-12-17T18:54:22

There are 3 parts involved:

Auth set to basic or application
Internal security to false
An external security object created and used (as a bridge to your external security service)

Once you created the external security object, did you remember to go back to your app server config and actually configure it to use the security object?

Also, you mention nothing about the log files. How about posting the error (if any) from there.

My suggested steps for you to go back through and verify:

Please look at this chapter:
https://docs.marklogic.com/8.0/guide/security/external-auth#id_81861

Then proceed to the external security object configuration section: https://docs.marklogic.com/8.0/guide/security/external-auth#id_35317

And finally, the actual configuration of the app server to use the object(it sounds like you have done 1/2 of this already):
https://docs.marklogic.com/8.0/guide/security/external-auth#id_63262

MarkLogic LDAP authentication

1 Answers