starred/cloudbeaver

Fork 0

mirror of https://github.com/dbeaver/cloudbeaver.git synced 2026-04-26 06:06:00 +03:00

[GH-ISSUE #3536] LDAP User ID cryptic #1278

New issue

Closed

opened 2026-03-07 21:01:59 +03:00 by kerem · 11 comments

kerem commented

2026-03-07 21:01:59 +03:00

Owner

Originally created by @MatthiasSchnoeke on GitHub (Jun 20, 2025).
Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/3536

Originally assigned to: @HocKu7 on GitHub.

Description

We run CB community edition 25.1.0.202506020921

After LDAP integration the AD user will shown with cryptical user id name. That's difficult to ready the user list.
e.g ��u[��d��k��p
How to work with AD groups.
We create a new AD group "SG_Cloudbeaver_Developer" and in CB a new team with CN "SG_Cloudbeaver_Developer" as LDAP Group Name. After that we would expect that the members of this AD group will shown as a team user automaticly after frist login and the team database connection is visible.

Steps to reproduce

No response

Expected/Desired Behavior

User id is readable and not cryptic. (e.g. sAMAccountName)
After creating an AD group, specifying an AD user as a member and creating a team with the corresponding LDAP group name (CN), the user is automatically displayed as a team member and gets database connection access as defined.

CloudBeaver Version

25.1.0.202506020921

Additional context

No response

Originally created by @MatthiasSchnoeke on GitHub (Jun 20, 2025). Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/3536 Originally assigned to: @HocKu7 on GitHub. ### Description We run CB community edition 25.1.0.202506020921 1. After LDAP integration the AD user will shown with cryptical user id name. That's difficult to ready the user list. e.g ��u[��d��k��p ![Image](https://github.com/user-attachments/assets/4daec901-75ba-4244-9800-f674216fc153) 2. How to work with AD groups. We create a new AD group "SG_Cloudbeaver_Developer" and in CB a new team with CN "SG_Cloudbeaver_Developer" as LDAP Group Name. After that we would expect that the members of this AD group will shown as a team user automaticly after frist login and the team database connection is visible. ### Steps to reproduce _No response_ ### Expected/Desired Behavior 1. User id is readable and not cryptic. (e.g. sAMAccountName) 2. After creating an AD group, specifying an AD user as a member and creating a team with the corresponding LDAP group name (CN), the user is automatically displayed as a team member and gets database connection access as defined. ### CloudBeaver Version 25.1.0.202506020921 ### Additional context _No response_

kerem

2026-03-07 21:01:59 +03:00

closed this issue
added the
xf:authentication

xf:ldap

wait for review
labels

kerem commented

2026-03-07 21:02:00 +03:00

Author

Owner

@EvgeniaBzzz commented on GitHub (Jun 20, 2025):

Hi @MatthiasSchnoeke
1.Set ldap-identifier-attr to sAMAccountName so that users can log in with their sAMAccountName, and their user ID will match it as well

@EvgeniaBzzz commented on GitHub (Jun 20, 2025): Hi @MatthiasSchnoeke 1.Set `ldap-identifier-attr` to `sAMAccountName` so that users can log in with their `sAMAccountName`, and their user ID will match it as well

kerem commented

2026-03-07 21:02:01 +03:00

Author

Owner

@EvgeniaBzzz commented on GitHub (Jun 20, 2025):

Does your CB team look like that?

I just checked on my side, and the new user was successfully mapped to the CB team on his first login.

@EvgeniaBzzz commented on GitHub (Jun 20, 2025): 2. Does your CB team look like that? ![Image](https://github.com/user-attachments/assets/0f686989-6828-4bf5-a35c-0d496f78eecc) I just checked on my side, and the new user was successfully mapped to the CB team on his first login.

kerem commented

2026-03-07 21:02:01 +03:00

Author

Owner

@MatthiasSchnoeke commented on GitHub (Jun 21, 2025):

Thank you for the quick response.

to 1. After changing to ldap-identifier-attr="sAMAccountName" I get an authentication error even though the user is not locked in the AD. The same when I switched back do ldap-identifier-attr="CN". After deleting storage (PVC OpenShift) the login with DN is possible again.

So I am confused why ldap-identifier-attr=‘CN’ expects the DN
and
ldap-identifier-attr=“sAMAccountName” leads to an invalid credential and later to a wrong error message ‘User locked’.

org.jkiss.dbeaver.model.exec.DBCException: User account is locked
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.findUserByCredentials(CBEmbeddedSecurityController.java:1039)
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.findUserByCredentials(CBEmbeddedSecurityController.java:966)
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.findOrCreateExternalUserByCredentials(CBEmbeddedSecurityController.java:2545)
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.finishAuthentication(CBEmbeddedSecurityController.java:2269)
at io.cloudbeaver.service.security.CBEmbeddedSecurityController.authenticate(CBEmbeddedSecurityController.java:1670)
at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.initiateAuthentication(WebServiceAuthImpl.java:171)
at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authLogin(WebServiceAuthImpl.java:74)
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)

@MatthiasSchnoeke commented on GitHub (Jun 21, 2025): Thank you for the quick response. to 1. After changing to ldap-identifier-attr="sAMAccountName" I get an authentication error even though the user is not locked in the AD. The same when I switched back do ldap-identifier-attr="CN". After deleting storage (PVC OpenShift) the login with DN is possible again. So I am confused why ldap-identifier-attr=‘CN’ expects the DN and ldap-identifier-attr=“sAMAccountName” leads to an invalid credential and later to a wrong error message ‘User locked’. org.jkiss.dbeaver.model.exec.DBCException: User account is locked at io.cloudbeaver.service.security.CBEmbeddedSecurityController.findUserByCredentials(CBEmbeddedSecurityController.java:1039) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.findUserByCredentials(CBEmbeddedSecurityController.java:966) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.findOrCreateExternalUserByCredentials(CBEmbeddedSecurityController.java:2545) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.finishAuthentication(CBEmbeddedSecurityController.java:2269) at io.cloudbeaver.service.security.CBEmbeddedSecurityController.authenticate(CBEmbeddedSecurityController.java:1670) at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.initiateAuthentication(WebServiceAuthImpl.java:171) at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authLogin(WebServiceAuthImpl.java:74) at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103) at java.base/java.lang.reflect.Method.invoke(Method.java:580)

kerem commented

2026-03-07 21:02:01 +03:00

Author

Owner

@MatthiasSchnoeke commented on GitHub (Jun 21, 2025):

my current config:

    authConfigurations: [
        {
            id: "ldap",
            provider: "ldap",
            displayName: "LDAP",
            disabled: false,
            iconURL: "",
            description: "Login with your Aareon user",
            parameters: {
            ldap-host: "ldap.xxx",
            ldap-port: "389",
            ldap-login: "sAMAccountName",
            ldap-dn: "OU=xxx DE,OU=xxx,DC=xxx,DC=xxx,DC=xxx",
            ldap-identifier-attr: "CN",
            ldap-bind-user: "CN=xxx,OU=xxx,OU=xxx DE,OU=xxx,DC=xxx,DC=xxx,DC=com",
            ldap-bind-user-pwd: 'xxx'
            }
        }
    ],

@MatthiasSchnoeke commented on GitHub (Jun 21, 2025): my current config: authConfigurations: [ { id: "ldap", provider: "ldap", displayName: "LDAP", disabled: false, iconURL: "", description: "Login with your Aareon user", parameters: { ldap-host: "ldap.xxx", ldap-port: "389", ldap-login: "sAMAccountName", ldap-dn: "OU=xxx DE,OU=xxx,DC=xxx,DC=xxx,DC=xxx", ldap-identifier-attr: "CN", ldap-bind-user: "CN=xxx,OU=xxx,OU=xxx DE,OU=xxx,DC=xxx,DC=xxx,DC=com", ldap-bind-user-pwd: 'xxx' } } ],

kerem commented

2026-03-07 21:02:01 +03:00

Author

Owner

@MatthiasSchnoeke commented on GitHub (Jun 23, 2025):

Unfortunaley after LDAP Login (via DN) my user is not automatically mapped and can not find the team related dn connections.

@MatthiasSchnoeke commented on GitHub (Jun 23, 2025): Unfortunaley after LDAP Login (via DN) my user is not automatically mapped and can not find the team related dn connections. ![Image](https://github.com/user-attachments/assets/1606a680-e27b-44e6-8021-09b5fb052cf4) ![Image](https://github.com/user-attachments/assets/3679b0c4-c57b-416c-aa8a-12cc9cc0ff16) ![Image](https://github.com/user-attachments/assets/ddbc427f-ec91-4458-84c2-82dc285c399a)

kerem commented

2026-03-07 21:02:01 +03:00

Author

Owner

@MatthiasSchnoeke commented on GitHub (Jun 23, 2025):

My ldap user also does not receive database connections after being assigned to an existing team (without ldap team)

@MatthiasSchnoeke commented on GitHub (Jun 23, 2025): My ldap user also does not receive database connections after being assigned to an existing team (without ldap team) ![Image](https://github.com/user-attachments/assets/2bb1b2d3-f2fc-4b0a-98ac-a3e84ffb15e5)

kerem commented

2026-03-07 21:02:01 +03:00

Author

Owner

@HocKu7 commented on GitHub (Jun 24, 2025):

@MatthiasSchnoeke

to 1. After changing to ldap-identifier-attr="sAMAccountName" I get an authentication error even though the user is not locked in the AD

What was the error? Are the credentials valid?

@HocKu7 commented on GitHub (Jun 24, 2025): @MatthiasSchnoeke > to 1. After changing to ldap-identifier-attr="sAMAccountName" I get an authentication error even though the user is not locked in the AD What was the error? Are the credentials valid?

kerem commented

2026-03-07 21:02:01 +03:00

Author

Owner

@MatthiasSchnoeke commented on GitHub (Jun 24, 2025):

Yes, the credetials are ok.

@MatthiasSchnoeke commented on GitHub (Jun 24, 2025): Yes, the credetials are ok.

kerem commented

2026-03-07 21:02:01 +03:00

Author

Owner

@HocKu7 commented on GitHub (Jul 2, 2025):

@MatthiasSchnoeke Hi, can you please provide footage showing your issue? Also, it would be very useful to see a server's log file to understand your issue

@HocKu7 commented on GitHub (Jul 2, 2025): @MatthiasSchnoeke Hi, can you please provide footage showing your issue? Also, it would be very useful to see a server's log file to understand your issue

kerem commented

2026-03-07 21:02:01 +03:00

Author

Owner

@MatthiasSchnoeke commented on GitHub (Jul 11, 2025):

IT seems I'm not the only one with this issue.

Here my current configutation.

    authConfigurations: [
        {
            id: "ldap",
            provider: "ldap",
            displayName: "LDAP",
            disabled: false,
            iconURL: "",
            description: "Login with your User",
            parameters: {
            ldap-host: "[my_host]",
            ldap-port: "389",
            ldap-login: "sAMAccountName",
            ldap-dn: "OU=[my_ou2],OU=[my_ou1],DC=ad,DC=[my_domain],DC=com",
            ldap-identifier-attr: "CN",
            ldap-bind-user: "CN=svc_Cloudbeaver,OU=ResourceAccounts,OU=[my_ou2],OU=[my_ou1],DC=ad,DC=[my_domain],DC=com",
            ldap-bind-user-pwd: '[my_password]'
            }
        }
    ]

Group DN: CN=SG_Cloudbeaver_Developer,OU=Cloudbeaver,OU=Access,OU=Groups,OU=[my_ou2],OU=[my_ou1],DC=ad,DC=[my_domain],DC=com

User DN: CN=Matthias,OU=User,OU=Mainz,OU=Locations,OU=[my_ou2],OU=[my_ou1],DC=ad,DC=[my_domain],DC=com

@MatthiasSchnoeke commented on GitHub (Jul 11, 2025): IT seems I'm not the only one with this issue. Here my current configutation. authConfigurations: [ { id: "ldap", provider: "ldap", displayName: "LDAP", disabled: false, iconURL: "", description: "Login with your User", parameters: { ldap-host: "[my_host]", ldap-port: "389", ldap-login: "sAMAccountName", ldap-dn: "OU=[my_ou2],OU=[my_ou1],DC=ad,DC=[my_domain],DC=com", ldap-identifier-attr: "CN", ldap-bind-user: "CN=svc_Cloudbeaver,OU=ResourceAccounts,OU=[my_ou2],OU=[my_ou1],DC=ad,DC=[my_domain],DC=com", ldap-bind-user-pwd: '[my_password]' } } ] Group DN: CN=SG_Cloudbeaver_Developer,OU=Cloudbeaver,OU=Access,OU=Groups,OU=[my_ou2],OU=[my_ou1],DC=ad,DC=[my_domain],DC=com User DN: CN=Matthias,OU=User,OU=Mainz,OU=Locations,OU=[my_ou2],OU=[my_ou1],DC=ad,DC=[my_domain],DC=com <img width="1076" height="372" alt="Image" src="https://github.com/user-attachments/assets/c3aaa0cb-ddd0-4ea2-9ae8-7796c8fffa28" />

kerem commented

2026-03-07 21:02:01 +03:00

Author

Owner

@MatthiasSchnoeke commented on GitHub (Jul 15, 2025):

The same problem when I move the SVC to Goups OU.

@MatthiasSchnoeke commented on GitHub (Jul 15, 2025): The same problem when I move the SVC to Goups OU. <img width="550" height="228" alt="Image" src="https://github.com/user-attachments/assets/117e24df-3b94-4358-b37b-5b475f817437" />