2.1.* and ldap

It doesn’'t look like there has been a resolution to this issue, so I thought I would post some more information. Our JM 2.2.0 Windows server began exhibiting the same behaviour (previously we only had 3 users and I just added about 10 more). This morning I download the JM 2.2.0 RPM and set it up on a Fedora Core 4 server. I have tested the connection with GAIM v1.3.1, Pandion v2.1.1, and Exodus v0.9.1.0 (our typical client). We are not using SSL, but we are using LDAP, pointed at our Windows Server 2003 Active Directory.

Pandion seems to connect, but then it just hangs with a “One moment please…” and no groups are populated. GAIM connects and shows groups that it cached previously. Exodus connects but hangs indefinitely at the “Authenticated. Getting Contacts…” message. I have tried using the internal database, but currently I am using a SQL Server 2000 database. Other than this, my environment is about as plain vanilla as it gets.

The only error that seems to show up, both in the Error log and stdout / stderror is the following:

2005.08.17 18:57:43 org.jivesoftware.messenger.handler.PresenceUpdateHandler.process(PresenceUpdateH andler.java:130) Internal server error

java.lang.IllegalArgumentException: Illegal JID: group policy creator owners@portal.ips-sendero.com

at org.xmpp.packet.JID.init(JID.java:391)

at org.xmpp.packet.JID.(Roster.java:108)

at org.jivesoftware.messenger.roster.RosterManager.getRoster(RosterManager.java:69 )

at org.jivesoftware.messenger.handler.PresenceUpdateHandler.broadcastUpdate(Presen ceUpdateHandler.java:238)

at org.jivesoftware.messenger.handler.PresenceUpdateHandler.process(PresenceUpdate Handler.java:103)

at org.jivesoftware.messenger.handler.PresenceUpdateHandler.process(PresenceUpdate Handler.java:141)

at org.jivesoftware.messenger.PresenceRouter.handle(PresenceRouter.java:87)

at org.jivesoftware.messenger.PresenceRouter.route(PresenceRouter.java:60)

at org.jivesoftware.messenger.PacketRouter.route(PacketRouter.java:73)

at org.jivesoftware.messenger.net.SocketReader.processPresence(SocketReader.java:3 01)

at org.jivesoftware.messenger.net.ClientSocketReader.processPresence(ClientSocketR eader.java:49)

at org.jivesoftware.messenger.net.SocketReader.readStream(SocketReader.java:208)

at org.jivesoftware.messenger.net.SocketReader.run(SocketReader.java:111)

at java.lang.Thread.run(Unknown Source)

Caused by: org.jivesoftware.stringprep.StringprepException: Contains prohibited code points.

at org.jivesoftware.stringprep.Stringprep.nodeprep(Stringprep.java:120)

at org.xmpp.packet.JID.init(JID.java:342)

… 16 more

btw… as far as our Active Directory is concerned, I am pointed at a box that is setup as a Global Catalog, but I am hitting the normal LDAP (TCP / 389) port, instead of the GC port. I feel pretty confident that this is ok, because the user manager shows me all the accounts in our Users OU (approx. 300).

Hmmm, from a quick glance, I’‘d say that the hyphan isn’‘t allowed. Please read http://www.faqs.org/rfcs/rfc3454.html for more information as to what’'s a proper JID should contain. The error is being thrown from this code:

if (contains(s, RFC3454.C1_1) ||

contains(s, RFC3454.C1_2) ||

contains(s, NODEPREP_PROHIBIT))

{

// Table C.9 only contains code points > 0xFFFF which Java

// doesn’'t handle

throw new StringprepException(StringprepException.CONTAINS_PROHIBITED);

}

this shouldn’'t be related to ldap.

Noah

I am definitely using LDAP / AD for users. Does this mean that because our domain has a hyphen in it, we will be unable to use any XMPP applications?

FYI, as a sanity check, I configured JM and Exodus to use the local hostname (without the domain / hyphen) and I still get the same issue on the client, with the following error:

2005.08.18 09:41:34 org.jivesoftware.messenger.handler.PresenceUpdateHandler.process(PresenceUpdateH andler.java:130) Internal server error

java.lang.IllegalArgumentException: Illegal JID: group policy creator owners@portal

at org.xmpp.packet.JID.init(JID.java:391)

at org.xmpp.packet.JID.(Roster.java:108)

at org.jivesoftware.messenger.roster.RosterManager.getRoster(RosterManager.java:69 )

at org.jivesoftware.messenger.handler.PresenceUpdateHandler.broadcastUpdate(Presen ceUpdateHandler.java:238)

at org.jivesoftware.messenger.handler.PresenceUpdateHandler.process(PresenceUpdate Handler.java:90)

at org.jivesoftware.messenger.handler.PresenceUpdateHandler.process(PresenceUpdate Handler.java:141)

at org.jivesoftware.messenger.PresenceRouter.handle(PresenceRouter.java:87)

at org.jivesoftware.messenger.PresenceRouter.route(PresenceRouter.java:60)

at org.jivesoftware.messenger.PacketRouter.route(PacketRouter.java:73)

at org.jivesoftware.messenger.net.SocketReader.processPresence(SocketReader.java:3 01)

at org.jivesoftware.messenger.net.ClientSocketReader.processPresence(ClientSocketR eader.java:49)

at org.jivesoftware.messenger.net.SocketReader.readStream(SocketReader.java:208)

at org.jivesoftware.messenger.net.SocketReader.run(SocketReader.java:111)

at java.lang.Thread.run(Unknown Source)

Caused by: org.jivesoftware.stringprep.StringprepException: Contains prohibited code points.

at org.jivesoftware.stringprep.Stringprep.nodeprep(Stringprep.java:120)

at org.xmpp.packet.JID.init(JID.java:342)

… 16 more

java.lang.IllegalArgumentException: Illegal JID:

group policy creator owners@portal

The name “group policy creator owners” is the issue. Do you know where that’'s coming from?

Regards,

Matt

That group is built in to Acitve Directory 2003:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHel p/bd2c00f9-ffd5-4e55-80a2-a425222a7ffc.mspx

Is there any way to hide / ban this ID from getting propogated to JM?

I am getting around this by adding a “searchFilter” to my LDAP settings. Basically, I am trying to get it to search for only objects of type person and whose “DirectoryString” field does not match our service accounts.

I think once I get the filter correct, this will keep the garbage accounts from connected (service accounts should not be logged in anyway).

Thanks for the help!

Check out this message (http://www.jivesoftware.org/forums/click.jspa?searchID=-1&messageID=99341). There is a link to MSDN website that helps construct searchFilters (AD is either not 100% standard or contains extensions, I can’'t remember which it is)

Cheers

That seems to have done it! I spent most of the afternoon banging my head around the search filter until I re-read the LDAP Guide and realized that I was missing the in my filter string.

I am able to log in with both the Pandion and Exodus clients. I will run it through more extensive testing tomorrow when I can get more users to logon.

Thanks for the help guys…