HTML form is invalid for ldap authentication

[anonymous]

I can login trac via a HTML form. But after I change into Active Directory authentication trac is always popup the username/password dialog to input username/password. I can login trac via AD successfully. If I comment "Require valid-user" from httpd.conf login is becoming HTML form. But I failed to login. Install plugin: LdapPlugin 0.6.0, TracAccountManager 0.2.1dev

[anonymous]

I failed to login is because retriving session ID is not my user name. (Got the information from trac log.) So it cannot verify my password. I was confused why enabled HTML form to login caused login id lost.

[John Hampton]

I don't quite understand the problem.

Is apache LDAP now doing authentication? If so, you need to turn of the account manager LoginModule and re-enable the trac LoginModule.

If you are trying to use an LDAP password store, then this is an problem for the plugin in question.

Can you give more detail?

[anonymous]

I used apache LDAP as authentication. Also LoginModule is enabled. But it is failed to login. Do I need to install other plugin about linking LdapPlugin to AccountManagerPlugin if I want to use LDAP password store?

[Steffen Hoffmann]

(I'm stepping in after quite some months of almost no active support here as the new AccountManagerPlugin maintainer. Sorry for the delay anyway.) Replying to anonymous:

I used apache LDAP as authentication. Also LoginModule is enabled. But it is failed to login. Do I need to install other plugin about linking LdapPlugin to AccountManagerPlugin if I want to use LDAP password store?

To clarify the situation a little bit, there is no such thing like (native) LDAP authentication with AccountManagerPlugin these days, while there are at least the following options:

stand-alone

• AccountLdapPlugin permission store extension to Trac
• LdapPlugin, utilizes Trac HTTP Auth, so it's a ACL, not the authentication itself

AuthStore for AccountManagerPlugin packaged as separate plugin

• LdapAuthnzPlugin
• LdapAuthStorePlugin that spun off of #1147 - a 'wontfix'ed enhancement request for AccountManagerPlugin
• ​http://pypi.python.org/pypi/TracLDAPAuth/ and
  • TracLdapAuthPlugin as an enhanced fork of it

suggested native AuthStore for AccountManagerPlugin (see currently supported ones here)

• #1600, a spin-off of LdapPlugin

In general, to go for Trac authentication you could go with or without AccountManagerPlugin, but if you decide for the «with» option, you'll most probably want to disable Trac's own login form.

I'm still investigating the various possible ways towards a native LdapAuthStore, actually following #1600 for a start, but there is nothing decided and final by now.

Hope, this will still help you somehow. If so, I'd appreciate your feedback to help with the decision, how to proceed with this ticket. After all it might be a local installation/configuration issue (better served by experienced admins and users at the mailing-list) or related to a different plugin or Trac itself.

[MyName]

is there any possibility to get all passwords from this site: ​https://portal.bih.net.ba/amserver/UI/Login?

if yes please answer with your email..

[Steffen Hoffmann]

Replying to MyName:

is there any possibility to get all passwords from this site: ​https://portal.bih.net.ba/amserver/UI/Login?

if yes please answer with your email..

I don't understand your question at all. Don't mistake AcctMgr for a cracker tool.

Btw, password management is delegated and done within all active Trac components that implement AcctMgr's IPasswordStore interface. You're asking for an exploit here? Don't dare!

[Steffen Hoffmann]

The ticket title still represents the main ticket issue. I can only repeat: Yes, that's the way it's meant to be, and no one promised different behavior. Furthermore, the LdapPlugin wiki docomentation explains, that

LdapPlugin does not perform authentication

So this is not a defect, just a misunderstanding. If you want LDAP authentication, follow-up on #1600, please. However, thanks for taking care and reporting here.