After setting up Okta LDAP integration, sometime users may find that usernames are found and able to log in to Artifactory via Okta LDAP, and groups are generated, but they do not tie to each other. Hence, groups cannot be looked up by usernames via Synchronize LDAP Group.
Some errors that you may encounter:
Could not find DN for user: XXX
The user: 'test-ldap@test.com' has 0 groups
An error occurred while retrieving LDAP groups with strategy STATIC, {}
org.springframework.ldap.InvalidAttributeValueException: [LDAP: error code 21 - Invalid Attribute Syntax]; nested exception is javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21 - Invalid Attribute Syntax]; remaining name 'ou=groups'
And in Okta’s Report > System Logs, you may see a similar error:
Controls=[1.2.840.113556.1.4.319], SearchBase=dc=dev-81584278,dc=okta,dc=com, SearchFilter=(&(objectclass=groupofuniquenames)(|(uniquemember=uid=test-ldap@test.com,ou=users,dc=dev-81584278,dc=okta,dc=com)(uniquemember=test-ldap@test.com))), SearchScope=SUB, LdapErrorCode=invalid attribute syntax, Returned Entries=0
Please refer to the following steps:
1. Check the attribute syntax in Okta for the user and group attributes that you are using.
2. Ensure that the user is assigned to the correct group in Okta and also the group has permission to access Artifactory.
If all items are checked but the issue persists with the same errors listed above, it could be because some LDAP servers don't accept the search filter which had UID value, even when the OR operation is used. When using Static group strategy and searching a group and filtering it by username, Artifactory will send a similar query to LDAP server as below:
(&(objectclass=groupofuniquenames)(|(uniquemember=uid=test-ldap@test.com,ou=users,dc=test,dc=okta,dc=com) (uniquemember=test-ldap@test.com)))
Therefore, we created a system property to modify this behavior on Artifactory side, so that it will send 'Group Member Attribute' with the full DN instead of UID. Please follow these steps to enable that:
1. Edit the '$ARTIFACTORY_HOME/etc/artifactory.system.properties' file
2. Add 'artifactory.security.ldap.forceGroupMemberAttFullDN=true'
3. Save the file and restart Artifactory