[jboss-jira] [JBoss JIRA] Created: (JBPORTAL-977) 403 error when logging in as admin with LDAP

[Kevin Barfield (JIRA)]

403 error when logging in as admin with LDAP
--------------------------------------------

                 Key: JBPORTAL-977
                 URL: http://jira.jboss.com/jira/browse/JBPORTAL-977
             Project: JBoss Portal
          Issue Type: Bug
      Security Level: Public (Everyone can see)
          Components: Portal Core
    Affects Versions: 2.4 Final
         Environment: Portal 2.4 CR3 bundled
            Reporter: Kevin Barfield
             Fix For: 2.4 Final


A 403 error is shown when logging in as admin using LDAP.  Open a new browser, and now you are logged in.  Same issue with logout.  Logging in as a regular user is fine.

Here is the login config:
<policy>
   <!-- For the JCR CMS -->
   <application-policy name="cms">
      <authentication>
         <login-module code="org.apache.jackrabbit.core.security.SimpleLoginModule" flag="required"/>
      </authentication>
   </application-policy>
   
   <application-policy name="portal">
      <authentication>
            <login-module code="org.jboss.security.auth.spi.LdapLoginModule" flag="required">
                            <module-option name="java.naming.factory.initial"> 
                                com.sun.jndi.ldap.LdapCtxFactory
                                </module-option>
                            <module-option name="java.naming.provider.url">
                                ldap://localhost/
                            </module-option>
                            <module-option name="java.naming.security.authentication">
                                simple
                            </module-option>
                            <module-option name="java.naming.security.principal">
      		       cn=Manager,dc=example,dc=com
                            </module-option>
                            <module-option name="java.naming.security.credentials">
      		        secret
                            </module-option>
                            <module-option name="principalDNPrefix">cn=</module-option>                    
                            <module-option name="principalDNSuffix">
                                ,ou=people,dc=example,dc=com
                            </module-option>
                        <module-option name="password-stacking">useFirstPass</module-option>
                            <module-option name="rolesCtxDN">
                                ou=groups,dc=example,dc=com
                            </module-option>
                            <module-option name="uidAttributeID">member</module-option>
                            <module-option name="matchOnUserDN">true</module-option>
                            <module-option name="roleAttributeID">cn</module-option>
                <module-option name="roleAttributeIsDN">false </module-option>
         <!--
         <login-module code="org.jboss.portal.identity.auth.IdentityLoginModule" flag="required">
            <module-option name="unauthenticatedIdentity">guest</module-option>
            <module-option name="userModuleJNDIName">java:/portal/UserModule</module-option>
            <module-option name="roleModuleJNDIName">java:/portal/RoleModule</module-option>
            <module-option name="additionalRole">Authenticated</module-option>
            <module-option name="password-stacking">useFirstPass</module-option>
            -->
         </login-module>
      </authentication>
   </application-policy>
</policy>


-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira