LDAP authentication is not working with Microsoft Active Directory

[senthil13]

Everything works fine with the Kafka-UI, but when we enable the authentication for LDAP to login, it's not working and we are not getting proper errors in the logs.

Below is the docker-compose config file, I masked a couple of parameters.

version: '2'
services:
  kafka-ui:
    image:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXkafka-ui:master-v0.5.0
    container_name: kafka-ui
    ports:
      - "9080:8080"
    restart: always
    environment:
      - KAFKA_CLUSTERS_0_NAME=POC
      - KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=localhost:9092
      - KAFKA_CLUSTERS_0_ZOOKEEPER=localhost:2181
      - KAFKA_CLUSTERS_0_READONLY=true
      - LOGGING_LEVEL_ROOT="debug"
      - AUTH_TYPE="LDAP"
      - SPRING_LDAP_URLS="ldap://ldap.corp.XXXXX.com:389"
      - SPRING_LDAP_DN_PATTERN:"cn={0},DC=corp,DC=XXX,DC=com"
      - SPRING_LDAP_USERFILTER_SEARCHBASE="OU=XXXX,OU=XXX,DC=corp,DC=XXXX,DC=com"
      - SPRING_LDAP_USERFILTER_SEARCHFILTER=(&(uid={0})(objectClass=inetOrgPerson))

Error logs

kafka-ui    | 2022-09-22 13:49:20,748 DEBUG [boundedElastic-1] o.s.s.w.s.a.AuthenticationWebFilter: Authentication failed: Invalid Credentials
kafka-ui    | 2022-09-22 13:49:20,749 DEBUG [boundedElastic-1] o.s.s.w.s.DelegatingServerAuthenticationEntryPoint: Trying to match using org.springframework.security.config.web.server.ServerHttpSecurity$HttpBasicSpec$$Lambda$926/0x0000000801116440@5791dfa1
kafka-ui    | 2022-09-22 13:49:20,750 DEBUG [boundedElastic-1] o.s.s.w.s.DelegatingServerAuthenticationEntryPoint: No match found. Using default entry point org.springframework.security.web.server.authentication.HttpBasicServerAuthenticationEntryPoint@693b4c2b
kafka-ui    | 2022-09-22 13:49:20,750 DEBUG [boundedElastic-1] o.s.w.s.a.HttpWebHandlerAdapter: [851ddcd1-4] Completed 401 UNAUTHORIZED
kafka-ui    | 2022-09-22 13:49:20,752 DEBUG [boundedElastic-1] r.n.h.s.HttpServerOperations: [851ddcd1-2, L:/172.21.0.2:8080 - R:/172.31.52.65:53198] Last HTTP response frame
kafka-ui    | 2022-09-22 13:49:20,752 DEBUG [boundedElastic-1] r.n.h.s.HttpServerOperations: [851ddcd1-2, L:/172.21.0.2:8080 - R:/172.31.52.65:53198] No sendHeaders() called before complete, sending zero-length header
kafka-ui    | 2022-09-22 13:49:20,752 DEBUG [boundedElastic-2] o.s.s.w.s.a.AuthenticationWebFilter: Authentication failed: Invalid Credentials

Any help will be much appriciated.

Thanks
Senhtil

[Haarolean]

Hey, thanks for reaching out.

Debugging auth issue with spring can be problematic.
First of all, I'd suggest trying to connect to the same ldap instance via a third-party software to verify your credentials integrity, like jxplorer for example. Here's a bit of description how do use that software. Let me know how it goes.

[rja1]

Yea, seems like I always have to set up a tcpdump to really figure out what's happening with ldap calls. Every implementation is a little different, both client and server. IE "tcpdump -s 0 -v -n port 389 -w capture.out", then analyze in wireshark.

[senthil13]

It didn't capture any packets

# tcpdump -s 0 -v -n port 389 -w capture.out
tcpdump: listening on docker0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C0 packets captured
0 packets received by filter
0 packets dropped by kernel

but telnet works fine so there is no connectivity issue.

# telnet ldap.corp.XXXXc.com 389
Trying XXXXXXXXXXX...
Connected to ldap.corp.XXXX.com.
Escape character is '^]'.

Still the same authentication error in the DEBUG logs.

kafka-ui    | 2022-09-27 00:43:12,148 DEBUG [reactor-http-epoll-2] o.s.h.c.FormHttpMessageReader: [e8193d91-3] Read form fields [username, password, _csrf] (content masked)
kafka-ui    | 2022-09-27 00:43:12,149 DEBUG [reactor-http-epoll-2] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/login', method=POST}
kafka-ui    | 2022-09-27 00:43:12,149 DEBUG [reactor-http-epoll-2] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Checking match of request : '/login'; against '/login'
kafka-ui    | 2022-09-27 00:43:12,149 DEBUG [reactor-http-epoll-2] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: matched
kafka-ui    | 2022-09-27 00:43:12,153 DEBUG [boundedElastic-3] o.s.s.w.s.a.AuthenticationWebFilter: Authentication failed: Invalid Credentials
kafka-ui    | 2022-09-27 00:43:12,154 DEBUG [boundedElastic-3] o.s.s.w.s.DefaultServerRedirectStrategy: Redirecting to '/login?error'
kafka-ui    | 2022-09-27 00:43:12,154 DEBUG [boundedElastic-3] o.s.w.s.a.HttpWebHandlerAdapter: [e8193d91-3] Completed 302 FOUND

However, the same password and user name work fine when you connect directly.

Thanks

[rja1]

For the tcpdump, guessing the host isn't using the default interface. You should be able to check which interface is being used with an ifconfig and include it with the tcpdump. IE. tcpdump -s 0 -v -n port 389 -i eth0 -w capture.out

Just wondering if the SPRING_LDAP_ADMIN is failing authentication or the actual user trying to auth. If you get a good tcpdump you should at the least get that answer

[senthil13]

Captured package, checked, and found that nothing is going to the LDAP server.

# tcpdump -s 0 -v -n port 389 -i ens192 -w capture.out
tcpdump: listening on ens192, link-type EN10MB (Ethernet), capture size 262144 bytes
^C93 packets captured
94 packets received by filter
0 packets dropped by kernel

I am looking for some other way to secure the URL, may be through some apache and then SiteMinder.

thanks for your continuous response rja1.