Background:
The JFrog Platform supports authenticating users against an LDAP server out of the box. We can refer to the Artifactory LDAP to learn how to set it up.
To troubleshoot the authentication failure caused by the abnormal disconnection between the Artifactory and LDAP service, proceed as follows:
First, we can refer to the LDAP Debug loggers to open the ldap debug logs and check the debug logs for the ldap connect questions.
Second, we can use the tcpdump tool and the Wireshark tool to capture packets of tcp stream from the Artifactory to the LDAP service.
Finally, we can check error messages of authentication in the ldap debug logs, and the tcp stream package captured to check the cause of the problem.
For more information about the ldap troubleshooting, can see How to troubleshoot LDAP configuration
Issue:
The customer feedback some user authentication fails occasionally when using LDAP service for authentication in the Artifactory.
After enabling the ldap debug logs, we found an error in the LDAP debug log that the LDAP connection has been closed when the Artifactory send user search query to the LDAP service:
org.springframework.ldap.UncategorizedLdapException: Uncategorized exception occurred during LDAP processing; nested exception is javax.naming.NamingException: LDAP connection has been closed; remaining name 'ou=xxx,ou=xxx,dc=xxx,dc=xxx'
at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:228)
at org.springframework.ldap.core.LdapTemplate.executeWithContext(LdapTemplate.java:824)
at org.springframework.ldap.core.LdapTemplate.executeReadOnly(LdapTemplate.java:807)
at org.artifactory.security.ldap.NewSpringSecurityLdapTemplate.searchForSingleEntry(NewSpringSecurityLdapTemplate.java:346)
at org.artifactory.security.ldap.search.InjectionProtectionLdapFilter.searchForUser(InjectionProtectionLdapFilter.java:110)
at org.artifactory.security.ldap.LdapServiceImpl.searchUserInLdap(LdapServiceImpl.java:213)
at org.artifactory.security.ldap.LdapServiceImpl.getUserWithAttributesFromDomain(LdapServiceImpl.java:161)
at org.artifactory.security.ldap.LdapUtils.findSettingAndUser(LdapUtils.java:140)
at org.artifactory.security.ldap.LdapUtils.refreshUserFromLdap(LdapUtils.java:78)
Cause:
We used the tcpdump tool to capture the stream between Artifactory and ldap service, and used the wireshark tool to analyze the captured packets and we saw the following phenomenon:
1. When Artifactory is started, it will create a long connection link with the ldap service for requests of user searching and by default the connection doesn't close.
ֿֿֿ2. When we check the search query failure LDAP stream, the LDAP stream has been anomalously closed. So, when the search query runs in the ldap stream which has been closed, the Artifactory will return this error log and can't return the right user authentication information.
Solutions:
The cause of this problem is that the LDAP service closed the connected stream abnormally because the search query connection is timeout, causing the Artifactory to send an ldap search query to a closed connection and get a failed return.
So we need to adjust the timeout of the Artifactory LDAP stream free stream to solve this problem.
-
We found the artifactory.security.ldap.pool.timeoutMillis parameter in the Artifactory system parameter, but it did not take effect after testing.
-
We found the JVM parameters to adjust the timeout of the LDAP free stream. The (com.sun.jndi.ldap.connect.pool.timeout) parameters can set the timeout of the connection ldap free stream
Then the solution is using the com.sun.jndi.ldap.connect.pool.timeout parameter to set the Artifactory LDAP stream free stream timeout, which should be less than the ldap service free stream timeout. This setting could solve the problem.
The system.yaml($JFROG_HOME/artifactory/var/etc/system.yam) file configuration in the Artifactory:
shared:
## Java 11 distribution to use
#javaHome: "JFROG_HOME/artifactory/app/third-party/java"
## Extra Java options to pass to the JVM. These values add to or override the defaults.
#extraJavaOpts: "-Xms512m -Xmx2g"
extraJavaOpts: "-Dcom.sun.jndi.ldap.connect.pool.timeout=<timeout_num>"
Restart the Artifactory to enable the parameter.
After testing, When setting the Artifactory free stream timeout less than the timeout parameter in LDAP server, the free stream will be closed normally between the Artifactory and the LDAP service.
More parameters description can refer: LDAP Connection Pooling Configuration