LDAP - Zope - ACLUsers &- Manage Local Roles
Hi List. I've recently recreated a zope installation that someone else built, in the process updating to zope 2.6 from 2.3.3 I'm not having much joy with LDAP + local roles upon the manage local role interface. I've discovered in the dtml source for listLocalRoles there is a try/except for overflow, which is being caught and therefore not bringing the list of users up. Does this mean that my ldap server is returning too many results? It works properly on zope 2-3-3 without a try/except statement. Is there something else I can do to stop the overflow error? I feel that with this out of the way, everything else will work properly (I hope) When I manually enter a user name and assign a local role, then attempt to test it, the LDAP log shows a successful authentication, however, I'm still getting unauthorized errors. :( this is an extract from the LDAP log.. (9) Mon 11:51: Checking julcla (9) Mon 11:51: julcla not found in user cache (9) Mon 11:51: Opened connection to ldap server (9) Mon 11:51: Closed connection to ldap server (9) Mon 11:51: julcla connect returned cn=Julian Clarke (julcla),ou=people,dc=b-online,dc=com,dc=au,o=internet (5) Mon 11:51: julcla user authenticated (9) Mon 11:51: Checking julcla (9) Mon 11:51: julcla found in user cache (7) Mon 11:51: julcla authenticated from cache (9) Mon 12:02: Checking julcla (9) Mon 12:02: julcla found in user cache (7) Mon 12:02: julcla authenticated from cache Which gives me the impression that I should be able to login from here. However, I am continuously prompted for username & password, which always fails, when I cancel, I get these errors... Time 2004/01/12 12:01:58.342 GMT+0800 User Name (User Id) Anonymous User (None) Request URL http://testserver/knowledge_backup/index_html Exception Type Unauthorized Exception Value <strong>You are not authorized to access this resource.</strong> Traceback (innermost last): * Module ZPublisher.Publish, line 89, in publish * Module ZPublisher.BaseRequest, line 436, in traverse * Module ZPublisher.HTTPResponse, line 667, in unauthorized Unauthorized: <strong>You are not authorized to access this resource.</strong> Time 2004/01/12 12:02:03.049 GMT+0800 User Name (User Id) julcla (julcla) Request URL http://testserver/knowledge_backup/index_html Exception Type Unauthorized Exception Value You are not allowed to access -1 in this context Traceback (innermost last): * Module ZPublisher.Publish, line 98, in publish * Module ZPublisher.mapply, line 88, in mapply * Module ZPublisher.Publish, line 39, in call_object * Module OFS.DTMLMethod, line 126, in __call__ * Module DocumentTemplate.DT_String, line 474, in __call__ * Module DocumentTemplate.DT_With, line 76, in render * Module OFS.DTMLMethod, line 119, in __call__ * Module DocumentTemplate.DT_String, line 474, in __call__ * Module DocumentTemplate.DT_With, line 76, in render * Module OFS.DTMLMethod, line 119, in __call__ * Module DocumentTemplate.DT_String, line 474, in __call__ * Module OFS.DTMLMethod, line 119, in __call__ * Module DocumentTemplate.DT_String, line 474, in __call__ * Module DocumentTemplate.DT_Util, line 201, in eval __traceback_info__: PARENTS * Module <string>, line 2, in f * Module AccessControl.DTML, line 32, in guarded_getitem * Module AccessControl.ZopeGuards, line 94, in guarded_getitem Unauthorized: You are not allowed to access -1 in this context Any Suggestions would be greatly appreciated. Thanks in advance. Julian Clark
Julian Clark wrote at 2004-1-12 12:10 +0800:
I've recently recreated a zope installation that someone else built, in the process updating to zope 2.6 from 2.3.3
I'm not having much joy with LDAP + local roles upon the manage local role interface.
I've discovered in the dtml source for listLocalRoles there is a try/except for overflow, which is being caught and therefore not bringing the list of users up. Does this mean that my ldap server is returning too many results?
At least this is possible... You can easily find out: temporarily remove the "try/except" and see what happens... -- Dieter
Hi Dieter (and List) Thanks for your response. I had tried this, and surprisingly, an overflow error occurred. This seems a little bizarre, as in the listLocalRoles on the zope 2-3-3 instance, there is no try/except, and this error does not occur. Is there a way of determining how many results will cause overflow? Or are there other reasons that overflow occurs? When I limited LDAP adapter properties to search in the root only, such that it didn't return any results, no overflow error occurred. Though obviously this is not the desired situation. I am of the opinion in the listLocalRoles interface, that a list should appear of all user-names that should be able to authenticate. This is as it currently works under the zope 2-3-3 instance. Is there a product that I should install to trigger this? I've looked against the products installed on 2-3-3, and there's a pretty minimal set within the products directory, though I have a feeling that there's products installed elsewhere. Control Panel >> Products shows more products than are in the products directory. According to the LDAP logs, I'm successfully authenticating against the LDAP server, but I'm still raising unauthorised errors. Unless I set the security to anonymous (but then - that's not authenticating anything). Is there something special that I need to do to pass LDAP info back to zope's security? It has created an acl_users folder where I want it. Thanks again Julian Clark Dieter Maurer wrote:
Julian Clark wrote at 2004-1-12 12:10 +0800:
I've recently recreated a zope installation that someone else built, in the process updating to zope 2.6 from 2.3.3
I'm not having much joy with LDAP + local roles upon the manage local role interface.
I've discovered in the dtml source for listLocalRoles there is a try/except for overflow, which is being caught and therefore not bringing the list of users up. Does this mean that my ldap server is returning too many results?
At least this is possible...
You can easily find out: temporarily remove the "try/except" and see what happens...
Julian Clark wrote at 2004-1-14 09:09 +0800:
I had tried this, and surprisingly, an overflow error occurred. This seems a little bizarre, as in the listLocalRoles on the zope 2-3-3 instance, there is no try/except, and this error does not occur. Is there a way of determining how many results will cause overflow? Or are there other reasons that overflow occurs?
The overflow is usually indicated by the LDAP server. It has a limit (which can probably be changed via configuration) how many records it is ready to deliver in a request. It issues an overflow when the limit is reached. -- Dieter
participants (2)
-
Dieter Maurer -
Julian Clark