LDAP authentication Failing

[DanukaPraneeth]

Hi All,

I am trying to enable ldap based authentication for the kafka-ui application and below is my configuration.

kafka:
  clusters:
    -
      name: local
      bootstrapServers: "192.100.100.10:9092"

auth:
  type: LDAP
spring:
  ldap:
    urls: ldap://172.10.10.10
    base: "uid={0},ou=people,dc=upc,dc=biz"
    user-filter-search-base: "dc=upc,dc=biz"
    user-filter-search-filter: "(&(uid={0})(objectClass=inetOrgPerson))"
oauth2:
  ldap:
    activeDirectory: false

As per the logs, I can see that the user get properly authenticated via the ldap. But it fails to redirect the user back to the /kakfaui and I can see the below error message in logs.

request 'GET /kafkaui' doesn't match 'POST /login'

Full error is as below.

2023-07-24 11:58:01,672 DEBUG [reactor-http-epoll-58] o.s.w.s.a.HttpWebHandlerAdapter: [8e6e93d4-800] HTTP POST "/login"
2023-07-24 11:58:01,673 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/login', method=POST}
2023-07-24 11:58:01,673 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Checking match of request : '/login'; against '/login'
2023-07-24 11:58:01,673 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: matched
2023-07-24 11:58:01,673 DEBUG [reactor-http-epoll-58] r.n.c.FluxReceive: [8e6e93d4-5, L:/172.23.112.142:8080 - R:/172.31.139.152:29199] [terminated=false, cancelled=false, pending=0, error=null]: subscribing inbound receiver
2023-07-24 11:58:01,674 DEBUG [reactor-http-epoll-58] o.s.h.c.FormHttpMessageReader: [8e6e93d4-800] Read form fields [username, password] (content masked)
2023-07-24 11:58:01,746 DEBUG [boundedElastic-11] o.s.l.c.s.AbstractContextSource: Got Ldap context on server 'ldap://172.16.89.138'
2023-07-24 11:58:01,759 DEBUG [boundedElastic-11] o.s.s.l.a.BindAuthenticator: Bound uid=XXX,ou=people,dc=upc,dc=biz
2023-07-24 11:58:01,760 DEBUG [boundedElastic-11] o.s.s.l.u.LdapUserDetailsMapper: Mapping user details from context with DN uid=XXX,ou=people,dc=upc,dc=biz
2023-07-24 11:58:01,760 DEBUG [boundedElastic-11] o.s.s.l.a.LdapAuthenticationProvider: Authenticated user
2023-07-24 11:58:01,761 DEBUG [boundedElastic-11] o.s.s.w.s.c.WebSessionServerSecurityContextRepository: Saved SecurityContext 'SecurityContextImpl [Authentication=UsernamePasswordAuthenticationToken [Principal=LdapUserDetailsImpl [Dn=uid=XXX,ou=people,dc=upc,dc=biz; Username=XXX; Password=[PROTECTED]; Enabled=true; AccountNonExpired=true; CredentialsNonExpired=true; AccountNonLocked=true; Granted Authorities=[]], Credentials=[PROTECTED], Authenticated=true, Details=null, Granted Authorities=[]]]' in WebSession: 'org.springframework.web.server.session.InMemoryWebSessionStore$InMemoryWebSession@36c87f34'
2023-07-24 11:58:01,762 DEBUG [parallel-18] o.s.s.w.s.DefaultServerRedirectStrategy: Redirecting to '/kafkaui'
2023-07-24 11:58:01,763 DEBUG [parallel-18] o.s.w.s.a.HttpWebHandlerAdapter: [8e6e93d4-800] Completed 302 FOUND
2023-07-24 11:58:01,763 DEBUG [parallel-18] r.n.h.s.HttpServerOperations: [8e6e93d4-5, L:/172.23.112.142:8080 - R:/172.31.139.152:29199] Last HTTP response frame
2023-07-24 11:58:01,763 DEBUG [parallel-18] r.n.h.s.HttpServerOperations: [8e6e93d4-5, L:/172.23.112.142:8080 - R:/172.31.139.152:29199] No sendHeaders() called before complete, sending zero-length header
2023-07-24 11:58:01,764 DEBUG [reactor-http-epoll-58] r.n.h.s.HttpServerOperations: [8e6e93d4-5, L:/172.23.112.142:8080 - R:/172.31.139.152:29199] Decreasing pending responses, now 0
2023-07-24 11:58:01,764 DEBUG [reactor-http-epoll-58] r.n.c.ChannelOperations: [8e6e93d4-5, L:/172.23.112.142:8080 - R:/172.31.139.152:29199] [HttpServer] Channel inbound receiver cancelled (subscription disposed).
2023-07-24 11:58:01,764 DEBUG [reactor-http-epoll-58] r.n.h.s.HttpServerOperations: [8e6e93d4-5, L:/172.23.112.142:8080 - R:/172.31.139.152:29199] Last HTTP packet was sent, terminating the channel
2023-07-24 11:58:02,065 DEBUG [reactor-http-epoll-58] r.n.h.s.HttpServerOperations: [8e6e93d4, L:/172.23.112.142:8080 - R:/172.31.139.152:29199] Increasing pending responses, now 1
2023-07-24 11:58:02,065 DEBUG [reactor-http-epoll-58] r.n.h.s.HttpServer: [8e6e93d4-6, L:/172.23.112.142:8080 - R:/172.31.139.152:29199] Handler is being applied: org.springframework.http.server.reactive.ReactorHttpHandlerAdapter@378722fd
2023-07-24 11:58:02,065 DEBUG [reactor-http-epoll-58] o.s.w.s.a.HttpWebHandlerAdapter: [8e6e93d4-801] HTTP GET "/kafkaui"
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/login', method=POST}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'POST /login'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: No matches found
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/login', method=GET}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'GET /login'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: No matches found
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/logout', method=GET}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'GET /logout'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: No matches found
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.s.WebSessionServerRequestCache: Request removed from WebSession: '/kafkaui'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/logout', method=POST}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'POST /logout'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: No matches found
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/css/**', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /css/**'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/js/**', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /js/**'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/media/**', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /media/**'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/resources/**', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /resources/**'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/actuator/health/**', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /actuator/health/**'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/actuator/info', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /actuator/info'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/auth', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /auth'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/login', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /login'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/logout', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /logout'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/oauth2/**', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /oauth2/**'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: Trying to match using PathMatcherServerWebExchangeMatcher{pattern='/static/**', method=null}
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /kafkaui' doesn't match 'null /static/**'
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.u.m.OrServerWebExchangeMatcher: No matches found
2023-07-24 11:58:02,066 DEBUG [reactor-http-epoll-58] o.s.s.w.s.a.DelegatingReactiveAuthorizationManager: Checking authorization on '/kafkaui' using org.springframework.security.authorization.AuthenticatedReactiveAuthorizationManager@9d9359
2023-07-24 11:58:02,067 DEBUG [reactor-http-epoll-58] o.s.s.w.s.c.WebSessionServerSecurityContextRepository: Found SecurityContext 'SecurityContextImpl [Authentication=UsernamePasswordAuthenticationToken [Principal=LdapUserDetailsImpl [Dn=uid=XXX,ou=people,dc=upc,dc=biz; Username=XXX; Password=[PROTECTED]; Enabled=true; AccountNonExpired=true; CredentialsNonExpired=true; AccountNonLocked=true; Granted Authorities=[]], Credentials=[PROTECTED], Authenticated=true, Details=null, Granted Authorities=[]]]' in WebSession: 'org.springframework.web.server.session.InMemoryWebSessionStore$InMemoryWebSession@36c87f34'
2023-07-24 11:58:02,067 DEBUG [reactor-http-epoll-58] o.s.s.w.s.a.AuthorizationWebFilter: Authorization successful
2023-07-24 11:58:02,070 DEBUG [reactor-http-epoll-58] o.s.w.r.h.SimpleUrlHandlerMapping: [8e6e93d4-801] Mapped to ResourceWebHandler [classpath [META-INF/resources/], classpath [resources/], classpath [static/], classpath [public/]]
2023-07-24 11:58:02,073 DEBUG [reactor-http-epoll-58] o.s.w.r.r.ResourceWebHandler: [8e6e93d4-801] Resource not found
2023-07-24 11:58:02,076 DEBUG [reactor-http-epoll-58] o.s.b.a.w.r.e.AbstractErrorWebExceptionHandler: [8e6e93d4-801] Resolved [ResponseStatusException: 404 NOT_FOUND] for HTTP GET /kafkaui
2023-07-24 11:58:02,086 DEBUG [reactor-http-epoll-58] o.s.h.c.j.Jackson2JsonEncoder: [8e6e93d4-801] Encoding [class ErrorResponseDTO {<EOL>    code: 5000<EOL>    message: 404 NOT_FOUND<EOL>    timestamp: 1690199882074<EOL>     (truncated)...]

Appreciate your inputs.

[Haarolean]

Hi, is the config you shared a full one?
You might be missing SERVER_SERVLET_CONTEXT_PATH: /kafkaui