BIRT Exchange Forum: RSSE implementation - BIRT Exchange Forum

Jump to content


 

No Latest Open Poll.

Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

RSSE implementation what did I do wrong Rate Topic: ****- 1 Votes

#1 User is offline   mcremer Icon

  • Senior Member
  • Group: Members
  • Posts: 234
  • Joined: 02-November 10


Posted 29 December 2010 - 02:38 AM

Ok, first off my excuses for the lengthy post but I was writing a manual for the RSSE thing and it just didnt work and now I use the manual part to explain what I did and I hope you can help me figure out what went wrong.

I started yesterday to get acquainted with the RSSE (Report Server Security Extension) in the Actuate iServer Express 11. This technology should enable you to make your standard iServer Express work within your security environment like Microsoft’s Active Directory or LDAP.

Quote

Now information about this is quite spread so here is what I found up to now.

First we have the Official Documenatation - page 561 or PDF page 585

Then we have the birt-exchange wiki.

Afther a bit more diging i found this on defshare:
Based on Actuate 10 code and also I found this one based on Actuate 10 code.

So armed with information and an example I started reading the official documentation. Here in there are several mentions of the the Actuate iServer Integration Technology. Now I toucht maybe smart to have some info on this well – warning links in this wiki post are broken.

So armed with this I decided to go meat the challenge afther reading the documentation. I came to the conclusion that the out of the 3 options available the Autentication is the way to go for me. Now there is a little snag all the code I found up 2 now was for Actuate 10 but no problem I thought because it should all work. So I started copying the $SERVER_HOME\servletcontainer\webapps\acrsse to myacrsse folder so to be sure I looked in the lib folder I saw the rsseLdap.jar (for the ones that read the documentation this is for LDAP extenral registration) 2 bad the rsseAuthenticate.jar was in there but I have my demo code so I compiled the rsseAuthenticate.jar from this example based on Actuate 10 with the handy ant file in my Eclipse environment.

We continue following the instructions in the official documentation creating a new webapp etc. But we make a copy of the actuate11/rsse/wsdl folder and rename it to actuate10 just to be sure. (As far as I can tell they just added a few functions but I don’t think its going to mess things up).

Now the 4th step should be done difrently this because we didn’t have the original package they are writing about in the documentation this should be I think: class=com.actuate10.rsse.authenticationSample.SampleRSSE. We change this in both the 10 and 11 folder to be sure we do not mess things up.

So now we have the servlet with the soap service up and running (I think).

So now we need to configure the encyclopaedia volume to work as we want it to. We create in the the $SERVER_HOME\etc folder a ldapconfig_your volumename.xml file. Containing the following:

<!-- ldapconfig_zlm-birta.xml -->
<!--"-->
<Config>
	<!-- Name of the LDAP server. For example, servername.actuate.com. -->
	<Server>Server Name</Server>
	<!-- Port number where the LDAP server listens. The default port is 389. -->
	<Port>389</Port>
	<!-- LDAP distinguished name used for a query operation to the LDAP server. -->
	<!-- OU stands for organizational unit and dc stands for Domain Component-->
	<UserBaseDN>ou=O2U, dc=o2u, dc=nl</UserBaseDN>
</Config>


Now that that’s done we only need to tell the serverconfiguration we want to use RSSE. Now with the enterprise we got a nice interface. But since were using the Express lets go to the AC_DATA_HOME\server\config (usely C:\Actuate11\iServer\data\config) we have the add the following data to the xml file:
<Volumes>
    <Volume
	…
	EnableRSSEService="true"
	RSSEIPAddress="hostname or IP address"
	RSSESOAPPort="8900 or other port number"
	RSSEContextString="/myrsse/servlet/AxisServlet"
	…
    </Volume>
<Volumes>


Now save it and it should work:

Restart your iServer express by going to http://localhost:8900/acadmin/config/ and brining the volume ofline. Then going to the $SERVER_HOME\bin folder and running the StopMC.bat wait till it stoped and start it up with the StartMC.bat and going again to the http://localhost:8900/acadmin/config/ and bring the volume on-line.


Now I done all that but somting go's wrong I get the folowing error:
8008:Load balancer cannot locate meber. The specified volume is not online.
Parameter0 = volumename.

What did I do wrong did I foret somting or is the actuate10 code not competible with the actuate11 server if so were can I get my hands on the code.

Thanks in advance for your time of reading the lengty post and any help is welcome.
1

#2 User is offline   mcremer Icon

  • Senior Member
  • Group: Members
  • Posts: 234
  • Joined: 02-November 10


Posted 29 December 2010 - 07:16 AM

Ok a little update is in order.

I am one step further now after playing a bit with the settings a bit I came to the folowing settings:
<!-- ldapconfig_volume.xml -->
<!--"-->
<Config>
	<!-- Name of the LDAP server. For example, servername.actuate.com. -->
	<Server>name of server that has the active directory controll (not a slave)</Server>
	<!-- Port number where the LDAP server listens. The default port is 389. -->
	<Port>389</Port>
	<!-- LDAP distinguished name used for a query operation to the LDAP server. -->
	<!-- organizational unit, ou, and domain components, dc. -->
	<UserBaseDN>ou=O2u, dc=o2u, dc=local, dc=nl</UserBaseDN>
	<!-- Name of  LDAP object class that the Actuate open security application uses to find Actuate user names. -->
	<UserObject>organizationalPerson</UserObject>
</Config>



I also changed some settings of the RSSEIPadress I changed it to the ip address that I put in here as <server>.

Now instead of the 8008 error I at least can access the iServer again. However I have the feeling its not authenticating trough the Active Directory. I still can login with the administrator of the iServer (and the Administrator account of the Active Directory has a diffident password).

I also created a user birt that exists in the Active Directory on the iServer this users has a license is part of the local admin group and has no password. In the Active Directory it has a password. Now if I try to use this user I still have to leave the password field blank instead of using my Active Directory password for the user birt.

So still not working as expected. But also not quite sure how I should approach this with authenticate i expect that I should add still the users manually to the iServer but there passwords are stored in the Active Directory meaning that the user names should be 1 on 1 the same.

Please let me know if I got it wrong.
1

#3 User is offline   mcremer Icon

  • Senior Member
  • Group: Members
  • Posts: 234
  • Joined: 02-November 10


Posted 31 December 2010 - 01:24 AM

Ok, afther a bit of tweaking and a lot of help of our reseller (he send us the current version of Actuate iServer Integration Technolgie with the authenticationSample that I was using was based on 10).

I get now the folowing error:

2010-12-31 10:04:36,674 [http-8900-1] ERROR com.actuate11.rsse.authenticationSample.SampleRSSE - [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece ]
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece ]
	at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3041)
	at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
	at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789)
	at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703)
	at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:293)
	at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
	at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
	at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
	at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
	at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
	at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
	at javax.naming.InitialContext.init(InitialContext.java:223)
	at javax.naming.InitialContext.<init>(InitialContext.java:197)
	at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
	at com.actuate11.rsse.authenticationSample.LdapUserDAO.getInitialLdapContext(LdapUserDAO.java:59)
	at com.actuate11.rsse.authenticationSample.LdapUserDAO.authenticate(LdapUserDAO.java:34)
	at com.actuate11.rsse.authenticationSample.SampleRSSE.authenticateUser(SampleRSSE.java:74)
	at com.actuate11.rsse.wsdl.ActuateSoapBindingImpl.authenticate(Unknown Source)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
	at org.apache.axis.providers.java.RPCProvider.invokeMethod(RPCProvider.java:388)
	at org.apache.axis.providers.java.RPCProvider.processMessage(RPCProvider.java:283)
	at org.apache.axis.providers.java.JavaProvider.invoke(JavaProvider.java:323)
	at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)
	at org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)
	at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)
	at org.apache.axis.handlers.soap.SOAPService.invoke(SOAPService.java:453)
	at org.apache.axis.server.AxisServer.invoke(AxisServer.java:281)
	at org.apache.axis.transport.http.AxisServlet.doPost(AxisServlet.java:699)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
	at org.apache.axis.transport.http.AxisServletBase.service(AxisServletBase.java:327)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
	at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:567)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849)
	at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454)
	at java.lang.Thread.run(Thread.java:619)



my ldap config is somting like this:

<!-- ldapconfig_o2u-iserver.xml -->
<!--"-->
<Config>
	<!-- Name of the LDAP server. For example, servername.actuate.com. -->
	<Server>zlm-dc1</Server>
	<!-- Port number where the LDAP server listens. The default port is 389. -->
	<Port>389</Port>
	<!-- LDAP distinguished name used for a query operation to the LDAP server. -->
	<!-- organizational unit, ou, and domain components, dc. -->
	<UserBaseDN>OU=Intranet,OU=O2U,DC=o2u,DC=local</UserBaseDN>
	<!-- Name of  LDAP object class that the Actuate open security application uses to find Actuate user names. -->
	<UserObject>organizationalPerson</UserObject>
</Config>



Now I searched on the error and it says that it probably means that the LDAP does not allow for Anonymous searches.

I checked the code and found this:

		  String uid = "uid = " + userName;
		  String userDN = uid + ", " + Scanner.getInstance().getUserBaseDN();
		  String providerURL = "ldap://" + Scanner.getInstance().getLDAPServer()
		  					 + ":" + Scanner.getInstance().getLDAPPort();
		  Hashtable<String, String> env = new Hashtable<String, String>();
		  env.put(Context.INITIAL_CONTEXT_FACTORY, contextFactory);
		  env.put(Context.PROVIDER_URL, providerURL);
		  env.put(Context.SECURITY_PRINCIPAL, userDN);
		  env.put(Context.SECURITY_CREDENTIALS, password);



I checked the ldap version and it uses the Query Account (from the more complex ldap config in the documentation. But a user can always query it self. So I am not sure what is going wrong here any insights?
0

#4 User is offline   mcremer Icon

  • Senior Member
  • Group: Members
  • Posts: 234
  • Joined: 02-November 10


Posted 31 December 2010 - 05:44 AM

Afther a bit of digging I found this bit of info I think eny one using LDAP/RSSE needs to know.


Cause
The error shown below is similar each time there is an LDAP authentication issue.
"The exception is [LDAP: error code 49 - 80090308: LdapErr: DSID-0Cxxxxxx, comment: AcceptSecurityContext error, data xxx, vece ]."

However, there are several values that can indicate what LDAP function is causing the issue. Here are some general references for Microsoft Active Directory:

The AD-specific error code is the one after "data" and before "vece" or "v893" in the actual error string returned to the binding process

525 user not found
52e invalid credentials
530 not permitted to logon at this time
531 not permitted to logon at this workstation
532 password expired
533 account disabled
701 account expired
773 user must reset password
775 user account locked


Common Active Directory LDAP bind errors:

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 525, v893
HEX: 0x525 - user not found
DEC: 1317 - ERROR_NO_SUCH_USER (The specified account does not exist.)
NOTE: Returns when username is invalid.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 52e, v893
HEX: 0x52e - invalid credentials
DEC: 1326 - ERROR_LOGON_FAILURE (Logon failure: unknown user name or bad password.)
NOTE: Returns when username is valid but password/credential is invalid. Will prevent most other errors from being displayed as noted.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 530, v893
HEX: 0x530 - not permitted to logon at this time
DEC: 1328 - ERROR_INVALID_LOGON_HOURS (Logon failure: account logon time restriction violation.)
NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 531, v893
HEX: 0x531 - not permitted to logon from this workstation
DEC: 1329 - ERROR_INVALID_WORKSTATION (Logon failure: user not allowed to log on to this computer.)
LDAP[userWorkstations: <multivalued list of workstation names>]
NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 532, v893
HEX: 0x532 - password expired
DEC: 1330 - ERROR_PASSWORD_EXPIRED (Logon failure: the specified account password has expired.)
LDAP[userAccountControl: <bitmask=0x00800000>] - PASSWORDEXPIRED
NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 533, v893
HEX: 0x533 - account disabled
DEC: 1331 - ERROR_ACCOUNT_DISABLED (Logon failure: account currently disabled.)
LDAP[userAccountControl: <bitmask=0x00000002>] - ACCOUNTDISABLE
NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 701, v893
HEX: 0x701 - account expired
DEC: 1793 - ERROR_ACCOUNT_EXPIRED (The user's account has expired.)
LDAP[accountExpires: <value of -1, 0, or extemely large value indicates account will not expire>] - ACCOUNTEXPIRED
NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 773, v893
HEX: 0x773 - user must reset password
DEC: 1907 - ERROR_PASSWORD_MUST_CHANGE (The user's password must be changed before logging on the first time.)
LDAP[pwdLastSet: <value of 0 indicates admin-required password change>] - MUST_CHANGE_PASSWD
NOTE: Returns only when presented with valid username and password/credential.

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 775, v893
HEX: 0x775 - account locked out
DEC: 1909 - ERROR_ACCOUNT_LOCKED_OUT (The referenced account is currently locked out and may not be logged on to.)
LDAP[userAccountControl: <bitmask=0x00000010>] - LOCKOUT
NOTE: Returns even if invalid password is presented
0

#5 User is offline   sgummuluru Icon

  • Advanced Member
  • PipPipPip
  • Group: Members
  • Posts: 30
  • Joined: 19-May 10


Posted 29 June 2011 - 01:25 PM

Have you successfully integrated LDAP? I'm following thru the same steps in Actuate 11 SP1 and running into
different issues. Your inputs are helpful for me. How long it took for you to resolve the issues eventually?

Thank you!
Sudha
0

#6 User is offline   RSiegler Icon

  • Advanced Member
  • PipPipPip
  • Group: Members
  • Posts: 49
  • Joined: 02-November 10


Posted 29 June 2011 - 01:50 PM

View Postsgummuluru, on 29 June 2011 - 02:25 PM, said:

Have you successfully integrated LDAP? I'm following thru the same steps in Actuate 11 SP1 and running into
different issues. Your inputs are helpful for me. How long it took for you to resolve the issues eventually?

Thank you!
Sudha



Sudha,

What issues are you running into? What kind of LDAP are you going against as well (Active Directory, etc)?

--Ryan
Ryan Siegler
Actuate Corporation – The BIRT Company™
http://www.actuate.com | http://birtondemand.com
0

#7 User is offline   johnw Icon

  • Senior Member
  • View blog
  • Group: Members
  • Posts: 712
  • Joined: 08-May 08


Posted 29 June 2011 - 04:38 PM

Actuate 11 SP1 has a LDAP module for RSSE already included. Check the documentation on how to configure it.

Let me know if you need any further help.
0

#8 User is offline   mcremer Icon

  • Senior Member
  • Group: Members
  • Posts: 234
  • Joined: 02-November 10


Posted 30 June 2011 - 12:26 AM

View Postsgummuluru, on 29 June 2011 - 10:25 PM, said:

Have you successfully integrated LDAP? I'm following thru the same steps in Actuate 11 SP1 and running into
different issues. Your inputs are helpful for me. How long it took for you to resolve the issues eventually?

Thank you!
Sudha


We have it working, trought the actuate 11 included funcitonalety. But our custumer wants for now not intergrated so we disabled it for now.

I mainly made this set of post to sort of help eny one that walked in to weard problems I had. This had 2 do with the domain the users was in etc. To truly validate a user a understanding of those errors is inportaint. Hence the post.
0

#9 User is offline   sgummuluru Icon

  • Advanced Member
  • PipPipPip
  • Group: Members
  • Posts: 30
  • Joined: 19-May 10


Posted 01 July 2011 - 10:37 AM

Thanks for the response. I was able to compile and deploy RSSE with Actaute 11 SP1, but still having this error showing up. Have you came across something simialar? What does this mean?

Following is the error.

Operation: VOLUME ONLINE
The client sub-operation was Custom JSP Tag (takeVolumeOnline)
The server sub-operation was IDAPI (TakeVolumeOnline)

Item: VOLUMES
Error Code: 3165
Message: Problem with the Report Server Security Extension. Please contact your administrator.
Parameter1=-1
Parameter2=null
0

#10 User is offline   johnw Icon

  • Senior Member
  • View blog
  • Group: Members
  • Posts: 712
  • Joined: 08-May 08


Posted 01 July 2011 - 08:11 PM

It couldn't bring the volume online, meaning there is some issue with the RSSE. Check the logs in the servlet container that is hosting the RSSE app and see if it is throwing errors.
0

#11 User is offline   lnallamalli Icon

  • Member
  • PipPip
  • Group: Members
  • Posts: 18
  • Joined: 30-March 12


Posted 13 July 2012 - 06:43 AM

View Postsgummuluru, on 01 July 2011 - 11:37 AM, said:

Thanks for the response. I was able to compile and deploy RSSE with Actaute 11 SP1, but still having this error showing up. Have you came across something simialar? What does this mean?

Following is the error.

Operation: VOLUME ONLINE
The client sub-operation was Custom JSP Tag (takeVolumeOnline)
The server sub-operation was IDAPI (TakeVolumeOnline)

Item: VOLUMES
Error Code: 3165
Message: Problem with the Report Server Security Extension. Please contact your administrator.
Parameter1=-1
Parameter2=null



Hi, How did you solve this issue? I am getting similar error in 11 SP3

Thanks,
Prasad
0

Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users