Unable to add Users after enabling LDAP with LDAP Password Policy

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 6.1.0 CE RC1, 6.1.1 CE GA2, 6.1.20 EE GA2
• Fix Version/s: 6.1.X EE, 6.2.0 CE M2
• Component/s: Infrastructure, Infrastructure > LDAP
• Labels:
  • QA-R
• Environment: Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: e52a1750d0d246d1d7862ab3de9ee3d49b07e70a. ; Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: 228bcefc4e621f15b8999134ca552897c128524d.
• Branch Version/s:
  6.1.x
• Backported to Branch:
  Committed
• Fix Priority: 5
• Similar Issues: Show 4 results ; ;

  LPS-23178	LDAP Importing Password Policies
  LPS-18625	Cannot add a User after enabling LDAP export
  LPS-13921	Unable to add users in Liferay after integrating LDAP
  LPS-23434	LDAP - Unable to export users

1. Start LDAP server with users
2. Startup Liferay

CASE ONE
3. Enable LDAP or not
i. [LDAP required] uncheck
ii. [Import Enabled] check or uncheck
iii. [Export Enabled] uncheck
iv. [Use LDAP Password Policy] check, save

CASE TWO
3. Enable LDAP,
i. [LDAP required] uncheck
ii. [Import Enabled] check or uncheck
iii. [Export Enabled] check
iv. [Use LDAP Password Policy] uncheck, save

4. Add LDAP server, save
5. As admin, add a new user and save

Results:
Admin sees 'Users and Organizations is temporarily unavailable' and user will not be added.
Exceptions for CASE ONE:
ERROR [render_portlet_jsp:154] java.lang.NullPointerException

Exceptions for CASE TWO:
ERROR [render_portlet_jsp:154] com.liferay.portal.ModelListenerException:

javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C090B38, comment: Error in attribute conversion operation, data 0, vece ]; remaining name 'sAMAccountName=joe,dc=exa
mple,dc=com'

[Tammy Fong]

This bug is also on 6.0.12EE.

[Tammy Fong]

Case 2 is no longer an issue on 6.1.x Revision: 91402.

[Eric Min]

Still can reproduce case 2 on trunk.

[Garry X]

Here is another case. I set system to use LDAP Password policy and call UserLocalServiceUtil.addUser with userId=0 and autoPassword=0 and no organization ids. Then in UserLocalServiceImpl following is called:

if (autoPassword) {
PasswordPolicy passwordPolicy =
passwordPolicyLocalService.getPasswordPolicy(
user.getCompanyId(), user.getOrganizationIds());

This will return null..

Then it calls: password = PwdToolkitUtil.generate(passwordPolicy);

And this will cause following NullPointerException:

java.lang.NullPointerException
at com.liferay.portal.security.pwd.PasswordPolicyToolkit.generateDynamic(PasswordPolicyToolkit.java:164)
at com.liferay.portal.security.pwd.PasswordPolicyToolkit.generate(PasswordPolicyToolkit.java:76)
at com.liferay.portal.security.pwd.PwdToolkitUtil._generate(PwdToolkitUtil.java:56)
at com.liferay.portal.security.pwd.PwdToolkitUtil.generate(PwdToolkitUtil.java:32)
at com.liferay.portal.service.impl.UserLocalServiceImpl.completeUserRegistration(UserLocalServiceImpl.java:1442)

[Tammy Fong]

Reproduced on:
Tomcat 7.0 + MySQL 5. Portal 6.1.x EE GIT ID: e52a1750d0d246d1d7862ab3de9ee3d49b07e70a.
Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: 228bcefc4e621f15b8999134ca552897c128524d.

Admin sees 'Users and Organizations is temporarily unavailable' and user will not be added.

[Tomas Polesovsky]

• CASE ONE is fixed in the pull.

• CASE TWO is caused by improper configuration when exporting users to Active Directory. It's important to change Export -> Users DN section in LDAP configuration screen.

Active Directory doesn't know base DN: dc=example,dc=com and creating user sAMAccountName=joe,dc=example,dc=com ends with the error described in CASE2.txt. Correct value for Users DN section should be similar to cn=Users,dc=my,dc=existing-domain,dc=com where dc=my,dc=existing-domain,dc=com is the base DN of the Active Directory Server.

[Michael Saechang]

Committed on:
Portal 6.2.x GIT ID: 735f923f1dffb675d769448aec6c465c458def27.

[Tammy Fong]

PASSED Manual Testing following the steps in the description.

Fixed on:
Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: b9c744b090650f554a2ef1d44f3aca50ea55a934.

Users can be created successfully after LDAP import is enabled in CASE 1 and CASE 2.