Unprocessed Continuation on LDAP Connections

[rlanhellas]

I'm trying to use LDAP with AKHQ, with the following configs:

micronaut:
  security:
    enabled: true
    ldap:
      default:
         enabled: true
         context:
             server: ldap://myldap.local:389
             managerDn: CN=ldap_kafka,CN=Managed Service Accounts,DC=mycompany,DC=local
             managerPassword: 'bbb'
         search:
          base: "DC=mycompany,DC=local"
          attributes:
            - "sAMAccountName"
          filter: "sAMAccountName={0}"
         groups:
          enabled: true
          subtree: true
          base: "OU=Kafka,OU=Grupos de Segurança TI,OU=Grupos Segurança,DC=mycompany,DC=local"
          filter: "member={0}"

But when trying to login I got the following error:

2023-03-12 08:31:56,968 ERROR r-thread-3 o.a.c.ErrorController      Unprocessed Continuation Reference(s)
javax.naming.PartialResultException: Unprocessed Continuation Reference(s)
        at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3022)
        at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2996)
        at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.getNextBatch(AbstractLdapNamingEnumeration.java:148)
        at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMoreImpl(AbstractLdapNamingEnumeration.java:217)
        at java.naming/com.sun.jndi.ldap.AbstractLdapNamingEnumeration.hasMore(AbstractLdapNamingEnumeration.java:189)
        at io.micronaut.security.ldap.context.DefaultLdapSearchService.createResults(DefaultLdapSearchService.java:68)
        at io.micronaut.security.ldap.context.DefaultLdapSearchService.search(DefaultLdapSearchService.java:56)
        at io.micronaut.security.ldap.context.DefaultLdapSearchService.searchFirst(DefaultLdapSearchService.java:40)
        at io.micronaut.security.ldap.LdapAuthenticationProvider.lambda$authenticate$2(LdapAuthenticationProvider.java:111)
        at reactor.core.publisher.FluxCreate.subscribe(FluxCreate.java:95)
        at reactor.core.publisher.InternalFluxOperator.subscribe(InternalFluxOperator.java:62)
        at reactor.core.publisher.FluxSubscribeOn$SubscribeOnSubscriber.run(FluxSubscribeOn.java:194)
        at io.micronaut.reactive.reactor.instrument.ReactorInstrumentation.lambda$init$0(ReactorInstrumentation.java:62)
        at reactor.core.scheduler.WorkerTask.call(WorkerTask.java:84)
        at reactor.core.scheduler.WorkerTask.call(WorkerTask.java:37)
        at io.micrometer.core.instrument.composite.CompositeTimer.recordCallable(CompositeTimer.java:77)
        at io.micrometer.core.instrument.Timer.lambda$wrap$1(Timer.java:162)
        at io.micronaut.scheduling.instrument.InvocationInstrumenterWrappedCallable.call(InvocationInstrumenterWrappedCallable.java:53)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)

I'm using AKHQ v0.23.0-all.

[tchiotludo]

Based on this response, you need to set Context.REFERRAL to follow.
It's a micronaut configuration as I understand.
Maybe this configuration will works:
micronaut.security.ldap.*.context.properties.REFERRAL to follow

[rlanhellas]

I tried but got same problem:

micronaut:
  security:
    enabled: true
    ldap:
      default:
         enabled: true
         context:
             server: ldap://mycompany.local:389
             managerDn: CN=ldap_kafka,CN=Managed Service Accounts,DC=mycompany,DC=local
             managerPassword: 'bbb'
             properties:
               REFERRAL: follow

[tchiotludo]

not really sure about the syntax, it's a micronaut feature, you should ask them

[rlanhellas]

ok thx @tchiotludo , I'll.

[djeanprost]

Hello @rlanhellas
Did you get any answer somewhere about that topic ?
Thank you

[djeanprost]

I wrote the answer to this question there : micronaut-projects/micronaut-security#1353

[carlosfwrk]

As I answered you in micronaut ticket,
Unless using java.naming.referral: "follow" can resolve your problem, I suggest, if possible, just to change the port and use 3269 instead 389.
In my opinion, if two options resolves your problem ("follow" and 3269) it is better to use 3269 solution because the answer from ldap should be faster.
This link explain the differences and Why You Shouldn’t Use Port 636 to Bind to LDAP Signing