This article addresses one issue for Active Directory users attempting to log in to the Liferay platform.
- Liferay is configured for use with an LDAP server (without mapping the "Group" attribute in the User section)
- LDAP export is enabled
- LDAP user, "user1" is able to log in to Liferay
- user1 joins a user group, "Group1"
- user1 tries to log into Liferay using the same LDAP credentials
Results:
Unfortunately, the user is denied and the following stacktrace occurs:
com.liferay.portal.ModelListenerException: javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21 - invalid type '']; remaining name 'cn=john.johnson,ou=Users,ou=test,dc=test-dev,dc=com'at com.liferay.portal.model.UserListener.onAfterUpdate(UserListener.java:75)at com.liferay.portal.model.UserListener.onAfterUpdate(UserListener.java:1)at com.liferay.portal.model.BaseModelListener.onAfterUpdate(BaseModelListener.java:1)at com.liferay.portal.service.persistence.impl.BasePersistenceImpl.update(BasePersistenceImpl.java:264)at com.liferay.portal.service.impl.UserLocalServiceImpl.authenticate(UserLocalServiceImpl.java:5012)at com.liferay.portal.service.impl.UserLocalServiceImpl.authenticateByEmailAddress(UserLocalServiceImpl.java:855)Resolution
When the LDAP export is enabled, a Liferay user's information will normally be exported to the LDAP server upon log-in. In this case, the user was in a user group in Liferay, so when that user tried to log in, Liferay tried to export the group that the user was in. Unfortunately, the group setting was not mapped in Liferay so the export failed along with the login.
The solution is simply to set the mapping for the users' groups in Settings -> Authentication -> LDAP -> (Select LDAP server). Under the User heading select an appropriate mapping for the "Group" field (e.g. "memberOf").