title: How to configuring jasper server with ldaps authentication?
body: <p>I've been working on authenticating against an active directory server with jasper 6.4.0 for a while now, and have been getting the following error.</p>
  
  <pre><code>2017-10-16 13:39:35,145  WARN JSLdapAuthenticationProvider,http-apr-8080-exec-9:62 - [
  LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580 ]; 
  nested exception is javax.naming.AuthenticationException: 
  [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580 ]
  </code></pre>
  
  <p>From what I've gathered, <code>data 52e</code> indicates invalid credentials. I tried changing my service account password in my configuration to <code>bob</code> to see if I would get the same error (showing that it's an error when binding to the ldaps server rather than the test account I was logging in with), and I did.</p>
  
  <p>Here is the configuration for the service account in jasper.</p>
  
  <pre><code>&lt;bean id="ldapContextSource" class="com.jaspersoft.jasperserver.api.security.externalAuth.ldap.JSLdapContextSource"&gt;
      &lt;constructor-arg value="ldaps://MyLDAPSServer:636/"/&gt;
      &lt;!-- manager user name and password (may not be needed)  --&gt;
      &lt;property name="userDn" value="dc=mydomain,dc=com,uid=MyServiceAccount"/&gt;
      &lt;property name="password" value="SomePasswordWithSpecialCharacters"/&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>I'm confident that the username and password are correct. I'm able to authenticate against the same ldaps server using the following Python code.</p>
  
  <pre><code>from ldap3 import Server, \
      Connection, \
      AUTO_BIND_NO_TLS, \
      SUBTREE, \
      ALL_ATTRIBUTES
  
  def get_ldap_info(u):
      with Connection(Server('MyLDAPSServer', port=636, use_ssl=True),
                      auto_bind=AUTO_BIND_NO_TLS,
                      read_only=True,
                      check_names=True,
                      user='MyServiceAccount', password='SomePasswordWithSpecialCharacters') as c:
  
          c.search(search_base='DC=mydomain,DC=com',
                  search_filter='(&amp;(samAccountName=' + u + '))',
                  search_scope=SUBTREE,
                  attributes=ALL_ATTRIBUTES,
                  get_operational_attributes=True)
          print(c.response_to_json())
          print(c.result)
  
  
  get_ldap_info('test.user')
  </code></pre>
  
  <p>The one thing I've been able to think of, is maybe jasper doesn't like having special characters in the password?</p>
  
  <p>Here is the remainder of the configuration for the jasper server in case I'm missing something.</p>
  
  <pre><code>&lt;!--
   ~ Copyright (C) 2005 - 2014 TIBCO Software Inc. All rights reserved.
   ~ http://www.jaspersoft.com.
   ~ Licensed under commercial Jaspersoft Subscription License Agreement
    --&gt;
  
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd"&gt;
  
      &lt;!-- ############ LDAP authentication ############
        - Sample configuration of external authentication via an external LDAP server.
      --&gt;
  
      &lt;bean id="proxyAuthenticationProcessingFilter" class="com.jaspersoft.jasperserver.api.security.EncryptionAuthenticationProcessingFilter"
            parent="mtAuthenticationProcessingFilter"&gt;
          &lt;property name="authenticationManager"&gt;
              &lt;ref local="ldapAuthenticationManager"/&gt;
          &lt;/property&gt;
  
          &lt;property name="authenticationSuccessHandler" ref="externalAuthSuccessHandler" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="proxyAuthenticationSoapProcessingFilter"
            class="com.jaspersoft.jasperserver.multipleTenancy.security.externalAuth.MTDefaultAuthenticationSoapProcessingFilter"&gt;
          &lt;property name="authenticationManager" ref="ldapAuthenticationManager"/&gt;
          &lt;property name="authenticationSuccessHandler" ref="externalAuthSuccessHandler" /&gt;
  
          &lt;property name="filterProcessesUrl" value="/services"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="proxyAuthenticationRestProcessingFilter" class="com.jaspersoft.jasperserver.multipleTenancy.security.externalAuth.MTDefaultAuthenticationRestProcessingFilter"&gt;
          &lt;property name="authenticationManager"&gt;
              &lt;ref local="ldapAuthenticationManager"/&gt;
          &lt;/property&gt;
          &lt;property name="authenticationSuccessHandler" ref="externalAuthSuccessHandler" /&gt;
          &lt;property name="filterProcessesUrl" value="/rest/login"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="proxyRequestParameterAuthenticationFilter"
            class="com.jaspersoft.jasperserver.war.util.ExternalRequestParameterAuthenticationFilter" parent="requestParameterAuthenticationFilter"&gt;
          &lt;property name="authenticationManager"&gt;
              &lt;ref local="ldapAuthenticationManager"/&gt;
          &lt;/property&gt;
          &lt;property name="externalDataSynchronizer" ref="externalDataSynchronizer"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="externalAuthSuccessHandler"
            class="com.jaspersoft.jasperserver.api.security.externalAuth.JrsExternalAuthenticationSuccessHandler" parent="successHandler"&gt;
          &lt;property name="externalDataSynchronizer"&gt;
              &lt;ref local="externalDataSynchronizer"/&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="proxyBasicProcessingFilter"
            class="com.jaspersoft.jasperserver.multipleTenancy.security.externalAuth.MTExternalAuthBasicProcessingFilter" parent="mtBasicProcessingFilter"&gt;
          &lt;property name="authenticationManager" ref="ldapAuthenticationManager"/&gt;
          &lt;property name="externalDataSynchronizer" ref="externalDataSynchronizer"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="ldapAuthenticationManager" class="com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.JSProviderManager"&gt;
          &lt;property name="providers"&gt;
              &lt;list&gt;
                  &lt;ref local="ldapAuthenticationProvider"/&gt;
                  &lt;ref bean="${bean.daoAuthenticationProvider}"/&gt;
                  &lt;!--anonymousAuthenticationProvider only needed if filterInvocationInterceptor.alwaysReauthenticate is set to true
                  &lt;ref bean="anonymousAuthenticationProvider"/&gt;--&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="ldapAuthenticationProvider" class="com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.ldap.JSLdapAuthenticationProvider"&gt;
          &lt;constructor-arg&gt;
              &lt;bean class="com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.ldap.JSBindAuthenticator"&gt;
                  &lt;constructor-arg&gt;&lt;ref local="ldapContextSource"/&gt;&lt;/constructor-arg&gt;
                  &lt;property name="userSearch" ref="userSearch"/&gt;
              &lt;/bean&gt;
          &lt;/constructor-arg&gt;
          &lt;constructor-arg&gt;
              &lt;bean class="com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.ldap.JSDefaultLdapAuthoritiesPopulator"&gt;
                  &lt;constructor-arg index="0"&gt;&lt;ref local="ldapContextSource"/&gt;&lt;/constructor-arg&gt;
                  &lt;constructor-arg index="1"&gt;&lt;value&gt;&lt;/value&gt;&lt;/constructor-arg&gt;
                  &lt;property name="groupRoleAttribute" value="title"/&gt;
                  &lt;property name="groupSearchFilter" value="(uid={1})"/&gt;
                  &lt;property name="searchSubtree" value="true"/&gt;
                  &lt;!-- Can setup additional external default roles here  &lt;property name="defaultRole" value="LDAP"/&gt; --&gt;
              &lt;/bean&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;bean id="userSearch"
            class="com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.ldap.JSFilterBasedLdapUserSearch"&gt;
          &lt;constructor-arg index="0"&gt;
              &lt;value&gt;cn=Users&lt;/value&gt;
          &lt;/constructor-arg&gt;
          &lt;constructor-arg index="1"&gt;
              &lt;!--&lt;value&gt;(uid={0})&lt;/value&gt;--&gt;
              &lt;!--&lt;value&gt;(uid=test.user)&lt;/value&gt;--&gt;
              &lt;value&gt;(sAMAccountName={0})&lt;/value&gt;
          &lt;/constructor-arg&gt;
          &lt;constructor-arg index="2"&gt;
              &lt;ref local="ldapContextSource" /&gt;
          &lt;/constructor-arg&gt;
          &lt;property name="searchSubtree"&gt;
              &lt;value&gt;true&lt;/value&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
  &lt;bean id="ldapContextSource" class="com.jaspersoft.jasperserver.api.security.externalAuth.ldap.JSLdapContextSource"&gt;
      &lt;constructor-arg value="ldaps://MyLDAPSServer:636/"/&gt;
      &lt;!-- manager user name and password (may not be needed)  --&gt;
      &lt;property name="userDn" value="dc=mydomain,dc=com,uid=MyServiceAccount"/&gt;
      &lt;property name="password" value="SomePasswordWithSpecialCharacters"/&gt;
  &lt;/bean&gt;
      &lt;!-- ############ LDAP authentication ############ --&gt;
  
      &lt;!-- ############ JRS Synchronizer ############ --&gt;
      &lt;bean id="externalDataSynchronizer"
            class="com.jaspersoft.jasperserver.multipleTenancy.security.externalAuth.MTExternalDataSynchronizerImpl"&gt;
          &lt;property name="externalUserProcessors"&gt;
              &lt;list&gt;
                  &lt;ref local="ldapExternalTenantProcessor"/&gt;
                  &lt;ref local="mtExternalUserSetupProcessor"/&gt;
                  &lt;!-- Example processor for creating user folder--&gt;
                  &lt;!--&lt;ref local="externalUserFolderProcessor"/&gt;--&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="abstractExternalProcessor" class="com.jaspersoft.jasperserver.api.security.externalAuth.processors.AbstractExternalUserProcessor" abstract="true"&gt;
          &lt;property name="repositoryService" ref="${bean.repositoryService}"/&gt;
          &lt;property name="userAuthorityService" ref="${bean.userAuthorityService}"/&gt;
          &lt;property name="tenantService" ref="${bean.tenantService}"/&gt;
          &lt;property name="profileAttributeService" ref="profileAttributeService"/&gt;
          &lt;property name="objectPermissionService" ref="objectPermissionService"/&gt;
      &lt;/bean&gt;
  
      &lt;!--
          Multi-tenant configuration. For a JRS deployment with multiple
          organizations, modify this bean to set up your organizations. For
          single-organization deployments, comment this out and uncomment the version
          below.
      --&gt;
      &lt;bean id="ldapExternalTenantProcessor" class="com.jaspersoft.jasperserver.multipleTenancy.security.externalAuth.processors.ldap.LdapExternalTenantProcessor" parent="abstractExternalProcessor"&gt;
          &lt;property name="ldapContextSource" ref="ldapContextSource"/&gt;
          &lt;property name="multiTenancyService"&gt;&lt;ref bean="internalMultiTenancyService"/&gt;&lt;/property&gt;
          &lt;property name="excludeRootDn" value="false"/&gt;
          &lt;!--only following LDAP attributes will be used in creation of organization hierarchy.
                  Eg. cn=Smith,ou=Developement,o=Jaspersoft will produce tanant Development as child of
                  tenant Jaspersoft (if excludeRootDn=false) as child of default tenant organization_1--&gt;
          &lt;property name="organizationRDNs"&gt;
              &lt;list&gt;
                  &lt;value&gt;dc&lt;/value&gt;
                  &lt;value&gt;c&lt;/value&gt;
                  &lt;value&gt;o&lt;/value&gt;
                  &lt;value&gt;ou&lt;/value&gt;
                  &lt;value&gt;st&lt;/value&gt;
              &lt;/list&gt;
          &lt;/property&gt;
          &lt;property name="rootOrganizationId" value="organization_1"/&gt;
          &lt;property name="tenantIdNotSupportedSymbols" value="#{configurationBean.tenantIdNotSupportedSymbols}"/&gt;
  
          &lt;!-- User credentials are setup in js.externalAuth.properties--&gt;
          &lt;property name="externalTenantSetupUsers"&gt;
              &lt;list&gt;
                  &lt;bean class="com.jaspersoft.jasperserver.multipleTenancy.security.externalAuth.processors.MTAbstractExternalProcessor.ExternalTenantSetupUser"&gt;
                      &lt;property name="username" value="${new.tenant.user.name.1}"/&gt;
                      &lt;property name="fullName" value="${new.tenant.user.fullname.1}"/&gt;
                      &lt;property name="password" value="${new.tenant.user.password.1}"/&gt;
                      &lt;property name="emailAddress" value="${new.tenant.user.email.1}"/&gt;
                      &lt;property name="roleSet"&gt;
                          &lt;set&gt;
                              &lt;value&gt;ROLE_ADMINISTRATOR&lt;/value&gt;
                              &lt;value&gt;ROLE_USER&lt;/value&gt;
                          &lt;/set&gt;
                      &lt;/property&gt;
                  &lt;/bean&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;!--
          Single tenant configuration. For a JRS deployment with a single
          organization, uncomment this bean and configure it to set up your organization.
          Comment out the multi-tenant version of ldapExternalTenantProcessor above
      --&gt;
      &lt;!--&lt;bean id="ldapExternalTenantProcessor" class="com.jaspersoft.jasperserver.multipleTenancy.security.externalAuth.processors.ldap.LdapExternalTenantProcessor" parent="abstractExternalProcessor"&gt;
          &lt;property name="ldapContextSource" ref="ldapContextSource"/&gt;
          &lt;property name="multiTenancyService"&gt;&lt;ref bean="internalMultiTenancyService"/&gt;&lt;/property&gt;
          &lt;property name="excludeRootDn" value="true"/&gt;
          &lt;property name="defaultOrganization" value="organization_1"/&gt;
      &lt;/bean&gt;--&gt;
  
      &lt;bean id="mtExternalUserSetupProcessor" class="com.jaspersoft.jasperserver.multipleTenancy.security.externalAuth.processors.MTExternalUserSetupProcessor" parent="abstractExternalProcessor"&gt;
          &lt;!--Default permitted role characters; others are removed. Change regular expression to allow other chars.
                      &lt;property name="permittedExternalRoleNameRegex" value="[A-Za-z0-9_]+"/&gt;--&gt;
  
          &lt;property name="userAuthorityService"&gt;
              &lt;ref bean="${bean.internalUserAuthorityService}"/&gt;
          &lt;/property&gt;
          &lt;property name="defaultInternalRoles"&gt;
              &lt;list&gt;
                  &lt;value&gt;ROLE_USER&lt;/value&gt;
              &lt;/list&gt;
          &lt;/property&gt;
  
          &lt;property name="organizationRoleMap"&gt;
              &lt;map&gt;
                  &lt;!-- Example of mapping customer roles to JRS roles --&gt;
                  &lt;entry&gt;
                      &lt;key&gt;
                          &lt;value&gt;ROLE_ADMIN_EXTERNAL_ORGANIZATION&lt;/value&gt;
                      &lt;/key&gt;
                      &lt;!-- JRS role that the &lt;key&gt; external role is mapped to--&gt;
                      &lt;value&gt;ROLE_ADMINISTRATOR&lt;/value&gt;
                  &lt;/entry&gt;
              &lt;/map&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;!-- EXAMPLE Processor
      &lt;bean id="externalUserFolderProcessor"
            class="com.jaspersoft.jasperserver.api.security.externalAuth.processors.ExternalUserFolderProcessor"
            parent="abstractExternalProcessor"&gt;
          &lt;property name="repositoryService" ref="${bean.unsecureRepositoryService}"/&gt;
      &lt;/bean&gt;
      --&gt;
      &lt;!-- ############ JRS Synchronizer ############ --&gt;
  &lt;/beans&gt;
  </code></pre>