I am still struggling to get this to work. If I go through %SYS and manually try to start a TLS connection in AIX to my LDAP server I am getting...

s Status=##Class(%SYS.LDAP).SetOption(LD,$$$LDAPOPTXTLSCACERTFILE,"/ensemble/TestClin/mgr/LDAPKeyStore/OSUWMC_CA.pem") - Error <SYNTAX>

Does the certificate need to be in a certain directory for this to work as the examples suggested " /usr/share/ssl/certs/...."?

I was able to track down the error to

s Status=##class(%SYS.LDAP).StartTLSs(LD)
 i Status'=$$$LDAPSUCCESS{
s Status=Status_",ldap_setoption(Certificate) - "_##class(%SYS.LDAP).Err2String(Status)
w Status,!
g Error
  }

-1,ldap_setoption(Certificate) - Can't contact LDAP server

I was able to track down the error to

s Status=##class(%SYS.LDAP).StartTLSs(LD)
 i Status'=$$$LDAPSUCCESS{
s Status=Status_",ldap_setoption(Certificate) - "_##class(%SYS.LDAP).Err2String(Status)
w Status,!
g Error
  }

-1,ldap_setoption(Certificate) - Can't contact LDAP server

That's the part I am unsure of, because it is not logging to the Audit Database. How can I run this and put breakpoints in to verify where it might be getting stuck?

Thanks.

I am now to the point where I am getting Error message: LDAP error: 0 - Success. How can a Success be a Failure?

ZAUTHENTICATE(ServiceName,Namespace,Username,Password,Credentials,Properties) PUBLIC {

#include %occErrors
#include %sySecurity
#include %sySite
#include %syLDAP
#define LDAPServer $Get(^OSUMCLDAP("Server"))

#define WindowsLDAPServer 1

#define WindowsCacheClient 0
#define UseSecureConnection 1
#define UnixCertificateFile $Get(^OSUMCLDAP("LDAPKey"))_"certnew.pem"
#define WindowsBaseDN "dc="_$Get(^OSUMCLDAP("Domain"))_",dc=edu"

#define WindowsFilter "sAMAccountname"
#define WindowsAttributeList $lb("displayName","department","mail")
s $zt="Error"
 
 s Status = 0

 i Password="" {
s Status= $SYSTEM.Status.Error($$$InvalidUsernameOrPassword)
g Error
 }
 i $$$WindowsLDAPServer{
s AdminDN=$Get(^OSUMCLDAP("User"))
s AdminPW=$Get(^OSUMCLDAP("Pass"))
 }

 #;The following line sets up the internal LDAP structures.
 i $$$ISWINDOWS,$$$UseSecureConnection {
s LD=##Class(%SYS.LDAP).Init($$$LDAPServer,636)
 } else {
s LD=##Class(%SYS.LDAP).Init($$$LDAPServer)
 }
 i LD=0 {
s Status=##Class(%SYS.LDAP).GetLastError()
s Status="Init error: "_Status_" - "_##Class(%SYS.LDAP).Err2String(Status)
g Error
 }
 s Status=##Class(%SYS.LDAP).SetOption(LD,$$$LDAPOPTXTLSCACERTFILE,$$$UnixCertificateFile)
 i Status'=$$$LDAPSUCCESS{
s Status ="SetOption error: "_Status_" - "_##Class(%SYS.LDAP).Err2String(Status)
g Error
 } 
 s Status=##class(%SYS.LDAP).StartTLSs(LD)
 i Status'=$$$LDAPSUCCESS{
s Status=Status_",ldap_setoption(Certificate) - "_##class(%SYS.LDAP).Err2String(Status)
g Error
  }
 
 s Status=##Class(%SYS.LDAP).SimpleBinds(LD,AdminDN,AdminPW)
 i Status'=$$$LDAPSUCCESS 
  {
s Status = Status_", ldap_Simple_Bind(AdminDN) - "_##Class(%SYS.LDAP).Err2String(Status)
#;w !,Status
g Error
  }

 i $$$WindowsLDAPServer {
s Filter=$$$WindowsFilter_"="_Username
 }
 i $$$WindowsLDAPServer {
s AttributeList=$$$WindowsAttributeList

 } 
 i $$$WindowsLDAPServer {
s BaseDN=$$$WindowsBaseDN

 } 
 
 s SearchScope=$$$LDAPSCOPESUBTREE
 s Timeout=30
 
 s SizeLimit=1
 
 s Status=##Class(%SYS.LDAP).SearchExts(LD,BaseDN,SearchScope,Filter,AttributeList,0,"","",Timeout,"",.SearchResult)
 i Status'=$$$LDAPSUCCESS {

i Status=$$$XLDAPFILTERERROR {
s Status="1,User "_Username_" does not exist"
w !,Status
} else {
s Status=Status_",ldap_Search_Ext - "_##Class(%SYS.LDAP).Err2String(Status)
}
g Error
 }

 s NumEntries=##Class(%SYS.LDAP).CountEntries(LD,SearchResult)
 i NumEntries=-1 {
 s Status=##Class(%SYS.LDAP).GetError(LD)
 s Status=Status_",ldap_Count_Entries - "_##Class(%SYS.LDAP).Err2String(Status)
 g Error
 }
i NumEntries=0 {
s Status="1,User "_Username_" does not exist"
  g Error
 }
 
 i NumEntries>1 {
s Status="1,LDAP Filter is not unique"
  g Error
 }
 
 s CurrentEntry=##Class(%SYS.LDAP).FirstEntry(LD,SearchResult)
 i CurrentEntry=0 {
s Status=##Class(%SYS.LDAP).GetError(LD)
s Status=Status_",ldap_FirstEntry - "_##Class(%SYS.LDAP).Err2String(Status)
g Error
 }
 
 s DN=##Class(%SYS.LDAP).GetDN(LD,CurrentEntry) 
 i Password="" {
s Status="1,ldap_Simple_Bind("_DN_") - password cannot be null"
g Error
 }
 
 s Status=##Class(%SYS.LDAP).SimpleBinds(LD,DN,Password)
 i Status'=$$$LDAPSUCCESS {
s Status=Status_",ldap_Simple_Bind("_DN_") - "_##Class(%SYS.LDAP).Err2String(Status)
g Error
 }

 s Attribute=##Class(%SYS.LDAP).FirstAttribute(LD,CurrentEntry,.Ptr)

 while (Attribute'="") {
   s Values=##Class(%SYS.LDAP).GetValuesLen(LD,CurrentEntry,Attribute)
   #;Values:"_Values
   s Properties("Attributes",Attribute)=Values
  s Attribute=##Class(%SYS.LDAP).NextAttribute(LD,CurrentEntry,.Ptr)
 }
 s Properties("Username")=Username
 s Properties("FullName")=$li(Properties("Attributes","displayName"))
 k Properties("Attributes","displayName")
 s Properties("Comment")=$li(Properties("Attributes","department"))
 k Properties("Attributes","department")
 s Properties("EmailAddress")=$li(Properties("Attributes","mail"))
 k Properties("Attributes","mail")
 
 i $d(SearchResult) d ##Class(%SYS.LDAP).MsgFree(SearchResult)
 
 s GroupFilter="(&(objectClass=group)(member:1.2.840.113556.1.4.1941:="_DN_"))"
 s GroupAttributes=""
 s Status=##Class(%SYS.LDAP).SearchExts(LD,BaseDN,$$$LDAPSCOPESUBTREE,GroupFilter,GroupAttributes,0,"","",10,0,.GroupSearchResult)
 #;GroupSearch Status: "_Status
 i Status'=$$$LDAPSUCCESS {
w !,"SearchExts error: "_Status_" - "_##Class(%SYS.LDAP).Err2String(Status)
g Error
 }
 s GroupNumEntries=##Class(%SYS.LDAP).CountEntries(LD,GroupSearchResult)
 i GroupNumEntries=-1 {
s Status=##Class(%SYS.LDAP).GetError(LD)
s Status=##Class(%SYS.LDAP).Err2String(Status)
g Error
 }
w !
 i GroupNumEntries=0 {
w !,"No nested groups for "_Username_" found"
g Done
 }
 i GroupNumEntries>0 {
 }
 
 s GroupCurrentEntry=##Class(%SYS.LDAP).FirstEntry(LD,GroupSearchResult)
 i GroupCurrentEntry=0 {
s Status=##Class(%SYS.LDAP).GetError(LD)
w !,"FirstEntry error: "_Status_" - "_##Class(%SYS.LDAP).Err2String(Status)
g Error
 }
 s Groups=""
 While (GroupCurrentEntry'=0) {
s GroupDN=##Class(%SYS.LDAP).GetDN(LD,GroupCurrentEntry)
i GroupDN="" {
s Status=##Class(%SYS.LDAP).GetError(LD)
w !,"GetDN Group error: "_Status_" - "_##Class(%SYS.LDAP).Err2String(Status)
g Error
}
s CN=$p(GroupDN,",",1)
s AD=$p(CN,"=",2)
s AD=$zcvt(AD,"L")
s exists=''$d(^|"%SYS"|SYS("Security","RolesD",AD))
i exists{
s Properties("Roles") = AD

}


  s GroupCurrentEntry=##Class(%SYS.LDAP).NextEntry(LD,GroupCurrentEntry)
 }
Done
i +$d(LD) d ##Class(%SYS.LDAP).UnBinds(LD)
 #;w !,"SystemOK "_$SYSTEM.Status.OK()
 q $SYSTEM.Status.OK()
Error s $zt=""
 i $d(SearchResult) d ##Class(%SYS.LDAP).MsgFree(SearchResult)
 i $d(GroupSearchResult) d ##Class(%SYS.LDAP).MsgFree(GroupSearchResult)
 i +$d(LD) s Status=##class(%SYS.LDAP).UnBinds(LD)
 i $ze'=""{
 q $SYSTEM.Status.Error($$$CacheError,$ze)
 } else{  
  q $SYSTEM.Status.Error($$$GeneralError,"LDAP error: "_Status_" - "_##Class(%SYS.LDAP).Err2String(Status))
 }
}
 

Haven't tried that. Wasn't sure if it was going to make me do the Authentication before I connect to the external database, or while connecting to the external database.

Maybe I am making a mountain out of a mole hill.

When I look at the message in Message viewer it is showing 06CL as FT1:16.4.2

Just adding a bump to see if anyone has a way to have the system users bypass the delegated sign on without having to hard code the system.

THanks

Scott

Using the Ensemble Scheduler we ran into issues when we had multiple schedules running at the same time, and notice it pausing the whole environment just to refresh. That's why we went down this route.

It looks like this particular Inbound.SQL.Adapter service that caused the issue had a data lock on the database which caused more issues. So I am wondering if the data lock caused EnsConfigItem() to get in a hung status.

Thanks not the exact answer that I was looking for but I think I can make it work somehow.

Can I still add code in Business Studio and it maintain integrity to be able to still open in the BPL editor?

I added the following in my while loop, but then the BPL hung.

<assign property='..%Process.%SessionId' value='""'/>

Within the BPL editor how do you set a Property in Code?

Never mind I figured it out.

Instead of storing it at the Credentials level, I have created a Global to store the LDAP server information. However when I am calling $Get(^OSUMCLDAP(Server)) nothing is being returned. Am I not calling it appropriately? Do I need to add an include statement somewhere to make sure it includes the globals?

#define LDAPServer $Get(^OSUMCLDAP(Server))

 i $$$WindowsLDAPServer{
s AdminDN=$Get(^OSUMCLDAP(User))
s AdminPW=$Get(^OSUMCLDAP(Pass))
 }

Thanks

Scott

Sorry I am learning AD/LDAP as I go. I talked with the "powers that be" and they did confirm that I do not see a separate username and password to BIND to LDAP, and that I can use the UserName. So I will make that switch in the code above.

Thanks everyone.