LDAP Error debugging

[Kalinga]

Hi,
there are several LDAP-related issues created and answered here, most of which I have gone through.
My problem is, even though I have enabled the appropriate log level for the logger, I don't find a good debug log that would help me solve my issue.

From below logs, it is not very clear what is going wrong.

2023-01-12 11:35:02,625 DEBUG pGroup-1-3 i.m.context.lifecycle Created bean [io.micronaut.security.endpoints.$LoginController$Definition$Intercepted@56e8ee93] from definition [Definition: io.micronaut.security.endpoints.$LoginController$Definition$Intercepted] with qualifier [null]
2023-01-12 11:35:02,625 DEBUG pGroup-1-3 i.m.c.DefaultBeanContext Registering singleton bean io.micronaut.security.endpoints.$LoginController$Definition$Intercepted@56e8ee93 for type [$LoginController$Definition$Intercepted] using bean key $LoginController$Definition$Intercepted
2023-01-12 11:35:02,634 DEBUG pGroup-1-3 .b.DefaultBeanIntrospector Found BeanIntrospection for type: class io.micronaut.security.authentication.UsernamePasswordCredentials
2023-01-12 11:35:02,634 DEBUG pGroup-1-3 .b.DefaultBeanIntrospector Found BeanIntrospection for type: class io.micronaut.security.authentication.UsernamePasswordCredentials
2023-01-12 11:35:02,637 DEBUG pGroup-1-3 i.m.s.a.Authenticator io.micronaut.security.ldap.LdapAuthenticationProviderorg.akhq.modules.BasicAuthAuthenticationProvider
2023-01-12 11:35:02,677 DEBUG r-thread-1 LdapAuthenticationProvider Starting authentication with configuration [default]
2023-01-12 11:35:02,678 DEBUG r-thread-1 LdapAuthenticationProvider Attempting to initialize manager context
2023-01-12 11:35:02,744 DEBUG r-thread-1 LdapAuthenticationProvider Failed to create manager context. Returning unknown authentication failure. Encountered ldaps.company.de:636
2023-01-12 11:35:02,745 DEBUG r-thread-1 .ApplicationEventPublisher Publishing event: io.micronaut.security.event.LoginFailedEvent[source=io.micronaut.security.authentication.AuthenticationFailed@51ecb92]
2023-01-12 11:35:02,745 DEBUG r-thread-1 i.m.c.DefaultBeanContext Resolving beans for type: io.micronaut.context.event.ApplicationEventListener
2023-01-12 11:35:02,745 DEBUG r-thread-1 i.m.c.DefaultBeanContext Qualifying bean [ApplicationEventListener] from candidates [Definition: io.micronaut.management.health.indicator.service.ServiceReadyHealthIndicator$ApplicationEventListener$onServerStarted2$Intercepted, Definition: org.akhq.utils.LoginFailedEventListener, Definition: io.micronaut.management.health.indicator.service.ServiceReadyHealthIndicator$ApplicationEventListener$onServiceStarted1$Intercepted, Definition: io.micronaut.runtime.context.scope.refresh.RefreshScope, Definition: io.micronaut.logging.PropertiesLoggingLevelsConfigurer, Definition: io.micronaut.runtime.http.scope.RequestCustomScope, Definition: io.micronaut.http.server.netty.DefaultNettyEmbeddedServerFactory] for qualifier:
2023-01-12 11:35:02,746 DEBUG r-thread-1 i.m.context.lifecycle Created bean [org.akhq.utils.LoginFailedEventListener@68e018f0] from definition [Definition: org.akhq.utils.LoginFailedEventListener] with qualifier []
2023-01-12 11:35:02,746 DEBUG r-thread-1 i.m.c.DefaultBeanContext Registering singleton bean org.akhq.utils.LoginFailedEventListener@68e018f0 for type [ ApplicationEventListener] using bean key LoginFailedEventListener
2023-01-12 11:35:02,746 DEBUG r-thread-1 i.m.c.DefaultBeanContext Found 1 beans for type [ ApplicationEventListener]: [BeanRegistration: org.akhq.utils.LoginFailedEventListener@68e018f0]
2023-01-12 11:35:02,747 WARN r-thread-1 u.LoginFailedEventListener Login failed reason UNKNOWN, username unknown, message Unknown

With all unknown, I have no clue how do I debug further.

[Kalinga]

Here is the corresponding config that I use, Password is omitted for obvious reasons.

logger:
   levels:
     #root: DEBUG
     org.akhq.configs: TRACE
     io.micronaut: DEBUG
     io.micronaut.security.ldap: TRACE
     io.micronaut.configuration.security: TRACE
     java.security: DEBUG
micronaut:
  endpoints:
    loggers.enabled: true
    routes:
        enabled: true
        sensitive: true      
  security:
    enabled: true
    ldap:
      default:
        enabled: true
        context:
          #server: 'ldap://localhost:10389'
          #managerDn: 'uid=admin,ou=system'
          #managerPassword: 'secret'
          server: 'ldaps://ldaps.company.de:636'
          managerDn: 'CN=username,OU=level2,OU=level1,DC=company,DC=de'
          managerPassword: 'password-in-cleartext'
          search:
            base: "OU=level2,OU=level1,DC=company,DC=de"
            filter: "sAMAccountName={0}"
            subtree: true  # Pay attention here, this is needed
          groups:
            enabled: true
            subtree: true  # Pay attention here, this is needed
            base: "OU=Gruppen,OU=level2,OU=level1,DC=company,DC=de"
            filter: "memberOf={0}"
    token:
      jwt:
        signatures:
          secret:
            generator:
              secret: "dummy-token-to-override-default-token"
akhq.security:
  groups:
    no-roles:
        roles: []
    topic-reader:
    name: topic-reader # Group name
    roles:  # roles for the group
      - topic/read
    attributes:
      # List of Regexp to filter topic available for group
      # Single line String also allowed
      # topics-filter-regexp: "^(projectA_topic|projectB_.*)$"
      topics-filter-regexp:
        - "^projectA_topic$" # Individual topic
        - "^projectB_.*$" # Topic group
      connects-filter-regexp:
        - "^test.*$"
      consumer-groups-filter-regexp:
        - "consumer.*"
    topic-writer:
      name: topic-writer # Group name
      roles:
        - topic/read
        - topic/insert
        - topic/delete
        - topic/config/update
      attributes:
        topics-filter-regexp:
          - "test.*"
        connects-filter-regexp:
          - "^test.*$"
        consumer-groups-filter-regexp:
          - "consumer.*"
  #default-group: reader
  default-group: no-roles  
  ldap:
    groups:
      - name: KAFKAUSERS
        groups:
          - topic-reader
      - name: KAFKAADMIN
        groups:
          - topic-reader
          - topic-writer
    users:
      - username: username
        groups:
          - topic-reader
          - topic-writer 
  #basic-auth:
   # - username: admin
    #  password: ""
     # passwordHash: SHA256
      #groups:
      #- admin
    #- username: reader
     # password: ""
      #passwordHash: SHA256
      #groups:
      #- reader
akhq:
  server:
    access-log: # Access log configuration (optional)
      enabled: true # true by default
      name: org.akhq.log.access # Logger name
      format: "[Date: {}] [Duration: {} ms] [Url: {} {}] [Status: {}] [Ip: {}] [User: {}]" # Logger format

  # default kafka properties for each clients, available for admin / producer / consumer (optional)
  clients-defaults:
    consumer:
      properties:
        isolation.level: read_committed

  # list of kafka cluster available for akhq
  connections:
    ....

[kentatoi]

Any updates on this ?
I have the exact same issue here

akhq version: 0.24.0

[2024-02-08 16:22:41,690][AKHQ][DEBUG][io.micronaut.security.ldap.LdapAuthenticationProvider][io-executor-thread-1] Starting authentication with configuration [default]
[2024-02-08 16:22:41,691][AKHQ][DEBUG][io.micronaut.security.ldap.LdapAuthenticationProvider][io-executor-thread-1] Attempting to initialize manager context
[2024-02-08 16:22:41,749][AKHQ][DEBUG][io.micronaut.security.ldap.LdapAuthenticationProvider][io-executor-thread-1] Failed to create manager context. Returning unknown authentication failure. Encountered ldaps.server.com:636

[2024-02-08 16:22:41,751][AKHQ][WARN][org.akhq.utils.LoginFailedEventListener][io-executor-thread-1] Login failed reason UNKNOWN, username unknown, message Unknown

[kentatoi]

Ok I found the issue !

[carlosfwrk]

Any thougths?
I have the same error with the newest version 0.25.1 (and it worked fine during the last year with the 0.24.0 version).

[AlexisSouquiere]

Please put some logs and your configuration file to investigate