Loading Profile...
Pandion client (v2.5) with Openfire Server (v3.6.4) - Cannot Connect
Can someone explain to me how to connect Pandion to Openfire 3.6.4? I would think it is pretty straight forward, but for some reason it's just not connection. I'm using regular Address and password authentication and requiring TLS (as it is required by the server).
After I type in my login and connect it says "One moment please..." then says I have an invalid login.
For the username I'm using: username@child.domain.com
Thanks!
After I type in my login and connect it says "One moment please..." then says I have an invalid login.
For the username I'm using: username@child.domain.com
Thanks!
I’m baffled
2
people have this question
I have this question, too!
Tell me when someone answers.
The more people who ask this question, the more it gets noticed.
The more people who ask this question, the more it gets noticed.
Create a customer community for your own organization
Plans starting at $19/month
-
Inappropriate?Press F12 to see more information.
-
Inappropriate?I'm guessing this line has something to do with it:
-
Inappropriate?Your Openfire server has been configured to only allow GSSAPI (single sign on for Linux) which is not supported by Pandion. Turn on normal password authentication and it should work fine. As an SSO solution that works with Pandion and Openfire on Windows you can try this plugin for Openfire: http://norman.rasmussen.co.za/dl/sasl...
-
Inappropriate?I have it configured, but I don't think you can force that option. We have Mac clients that cannot support it and they log in without it (using Spark). Do you know how to not require it in Openfire by chance?
-
Inappropriate?My mistake. Earlier I only looked at the top of the XML log you sent. Turns out the server also allows for iq-auth which Pandion should support. Seems like a bug in how Pandion detects authentication methods when both iq-auth and sasl elements are present. I'll get this fixed in Pandion 2.6 asap.
-
Inappropriate?Please try the latest nightly to see if the patch works.
Download:
http://www.pandion.be/nightly
This is the fix it includes:
http://github.com/pandion/pandion/com... -
1 Comment
Add a comment
This answers the question
-
janess i cant install pandion to openfire 3.6.4 and active directoy. Can you help me? -
Inappropriate?Awesome, thanks for the help in finding the problem. Never would have occurred to me otherwise.
It's looking to be a little while longer. We've got a bunch of small things to wrap up like UI cleanup, re-writing the file sending code, setting MIME type and URI handlers, ... -
Inappropriate?I just downloaded the nightly build you linked to because I'm having issues using Pandion with an OpenFire server also. However I'm getting numerous javascript errors in it.
Internet Explorer Script Error, line 139, char 5, error function expected
url: file:///c:/documents and settings/user/local settings/application data/pandion/application/src/connection_settings.html
This is the data from the console:
EVNT: Connecting to host.com
SENT: <?xml version="1.0"?>
SENT: <stream:stream>
RECV: <?xml version="1.0" encoding="UTF-8"?><stream:stream>
RECV: <stream:features><starttls></starttls><mechanisms><mechanism>JIVE-SHAREDSECRET</mechanism><mechanism>PLAIN</mechanism><mechanism>ANONYMOUS</mechanism></mechanisms><compression><method>zlib</method></compression><auth /><register /></stream:features>
SENT: <compress><method>zlib</method></compress>
RECV: <compressed />
SENT: <stream:stream>
RECV: <?xml version="1.0" encoding="UTF-8"?><stream:stream>
RECV: <stream:features><mechanisms><mechanism>JIVE-SHAREDSECRET</mechanism><mechanism>PLAIN</mechanism><mechanism>ANONYMOUS</mechanism></mechanisms><auth /><register /></stream:features>
SENT: <auth>Y2hyaXNtQHJpbXBhdzJyMgBjaHJpc20A</auth>
RECV: <failure><not-authorized /></failure>
SENT: </stream:stream>
EVNT: Disconnected
</stream:stream></stream:stream></stream:stream> -
Inappropriate?I also got this on another machine running XP SP3 w/ IE8.
-
Inappropriate?Try the new build I just uploaded, it should solve that problem.
http://www.pandion.be/nightly
Code fix:
http://github.com/pandion/pandion/com...
Pandion is now compliant with XEP-0170 (Recommended Order of Stream Feature Negotiation) but it seems there is a bug in Openfire 3.6.4 in the negotiation of compression. Pandion can still connect though, it just needs to authenticate twice on the same connection. I've reported this issue on the Openfire development forum. http://www.igniterealtime.org/communi... -
Inappropriate?Sebastiaan your latest build did fix the issues with the javascript errors. However I still can't connect to my OpenFire 3.5.4 with AD support using the address/password fields.
Is it only possible to connect with integrated security?
For integrated security pass through does OpenFire 3.6.4 include the NTLM protocol or do you need to install this addon from http://norman.rasmussen.co.za/dl/sasl...
That's the one thing I couldn't seem to figure out was whether that addon is for all versions of OpenFire to use integrated security or only for older versions of it. -
This reply was removed on 10/07/09.
see the change log -
Inappropriate?Thank you both for testing and giving feedback. It's great to be able to solve problems quickly.
@janess: It seems you are not using the very latest Pandion nightly build. Can you download it again? (Maybe clear browser cache first)
The SASL error is basically saying your password and username are not correct. Did you verify with any other client or older version of Pandion that they work? Since it's a new server its configuration might not yet be correct.
Also, in log captures and screenshots be sure to mask out the base64 encoded plaintext authentication. It contains your username, server, and password.
@Chris: Openfire does not include HTML support by default. You need the plugin to enable Integrated Windows Authentication. You can check in Pandion's console (press F12) which SASL mechanisms are being offered by Openfire to Pandion. If the plugin is working then it should include the mechanisms GSS-SPNEGO or NTLM.
I’m grateful for the feedback
1 Comment Add a comment
This answers the question
-
@Chris: Typo I meant NTLM, not HTML. Too much coding ;)
-
Inappropriate?!!!!!!!!!!!!
Thanks for letting me know about the base64. I did not know that. I did decode the string and it did not contain my password though, only username and fqdn. That's not sooo bad. :) -
Inappropriate?I uninstalled Pandion and reinstalled with latest nightly and was able to connect. However I had to use the FQDN of the actual server instead of the alias we use.
-
Inappropriate?@janess: Is your DNS SRV record set up correctly? If it's publicly accessible, can you tell me the domain name so that I can test it?
-
Inappropriate?Internally we use a cname to connect...that's where pandion gets confused. Externally it's an alias because there isn't an alias for the actual server (as it's internal).
Is there a way to PM the server name? -
Inappropriate?Email or XMPP me: cbas@pandion.im
-
Inappropriate?Is there a problem with the current nightly build?? cant install as I get the "error reading from file" MSI error :(
-
Inappropriate?The MSI packages are fine but maybe your download was corrupted. Clear your browser cache and try again.
-
Inappropriate?i install the plugin but this is the answear in the debug:
any idea????? I must conect with username and password but like to connect via SSO.
And the error say:
You cant conect becauone of this two causes:
1. You have introduced a bad password
2. The account dont exist.
EVNT: Connecting to excce
SENT: <?xml version="1.0"?>
SENT: <stream:stream>
RECV: <?xml version="1.0" encoding="UTF-8"?><stream:stream>
RECV: <stream:features><starttls></starttls><mechanisms><mechanism>NTLM</mechanism><mechanism>PLAIN</mechanism></mechanisms><compression><method>zlib</method></compression><auth /></stream:features>
SENT: <starttls />
RECV: <proceed />
SENT: <stream:stream>
RECV: <?xml version="1.0" encoding="UTF-8"?><stream:stream>
RECV: <stream:features><mechanisms><mechanism>NTLM</mechanism><mechanism>PLAIN</mechanism></mechanisms><compression><method>zlib</method></compression><auth /></stream:features>
SENT: <auth />
RECV: <challenge>=</challenge>
SENT: <response>TlRMTVNTUAABAAAAB7IIogsACwAuAAAABgAGACgAAAAFASgKAAAAD0FBTkdFTENP
VU5UUllDTFVC
</response>
RECV: <challenge>TlRMTVNTUAACAAAAFgAWADgAAAAFgomi2Nzkd3/XHakAAAAAAAAAALAAsABOAAAABQLODgAAAA9DAE8AVQBOAFQAUgBZAEMATABVAEIAAgAWAEMATwBVAE4AVABSAFkAQwBMAFUAQgABAAoARQBYAEMAQwBFAAQAJABjAG8AdQBuAHQAcgB5AGMAbAB1AGIALgBjAG8AbQAuAGMAbwADADAAZQB4AGMAYwBlAC4AYwBvAHUAbgB0AHIAeQBjAGwAdQBiAC4AYwBvAG0ALgBjAG8ABQAkAGMAbwB1AG4AdAByAHkAYwBsAHUAYgAuAGMAbwBtAC4AYwBvAAAAAAA=</challenge>
SENT: <response>TlRMTVNTUAADAAAAGAAYAHYAAAAYABgAjgAAABYAFgBIAAAADAAMAF4AAAAMAAwA
agAAAAAAAACmAAAABYKIogUBKAoAAAAPQwBPAFUATgBUAFIAWQBDAEwAVQBCAGEA
YQBuAGcAZQBsAEEAQQBOAEcARQBMAJ3sur6m3HaPAAAAAAAAAAAAAAAAAAAAAE0Q
DbMJikX4+4De/TKBtyNJNOzqb2lIKw==
</response></stream:stream></stream:stream></stream:stream></stream:stream> -
Inappropriate?The GetSatisfaction forum has a problem with XML logs. I can't see the exact information as your console showed because all namespaces are stripped. Please post it to http://gist.github.com/ and reply here with the gist link.
Also, it seems the last line of the log is invalid XMPP syntax. Did you copy that from the console or type it manually? -
Inappropriate?Copy from the console
-
Inappropriate?git://gist.github.com/219760.git
-
Inappropriate?The NTLM stuff looks fine. I don't understand binary SSPI data but looks like user "aangel" is trying to authenticate with AD domain "COUNTRYCLUB" and the XMPP server address is excce.countryclub.com.co or "countryclub.com.co" ... does any of that make sense to you?
Then for no reason the connection is closed after Pandion sends its authentication response. From the log I cannot see if it's Pandion or Openfire that closed the stream. Can you check if there is any server log from Openfire? -
Inappropriate?The gist is not complete. I can only see up to where Pandion sends its response. What happens after that?
-
Inappropriate?nothing there is an error form like this one. and nothing else happening. Yes that my user try to conecto to excce server of open fire
the log is this:
2009.10.26 09:06:06 User Login Failed. PLAIN authentication failed
2009.10.26 10:26:43 User Login Failed. PLAIN authentication failed
2009.10.26 13:28:07 User Login Failed. PLAIN authentication failed
2009.10.26 13:28:20 User Login Failed. PLAIN authentication failed
2009.10.26 13:28:47 User Login Failed. PLAIN authentication failed
2009.10.26 13:28:51 User Login Failed. PLAIN authentication failed
2009.10.26 14:03:47 User Login Failed. PLAIN authentication failed -
Inappropriate?Hmm, I am not sure what is wrong. Try asking in the Openfire forum.
-
Inappropriate?Have you guys added your domain to the allow lists on Openfire?? Dont forget its NT Domain Name as its NTLM and not FQDN. :)
-
Inappropriate?I think so. Where must i see if i have it correct?
-
Inappropriate?@Dave is there a good tutorial written on configuring Openfire's authentication for this purpose? The topic seems very popular. Maybe a summary on the wiki would help people out.
-
Inappropriate?This document pretty much explains it all for LDAP.
-
Inappropriate?Thanks, bookmarked.
EMPLOYEE
