topic Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo in ArcGIS Enterprise Questions

LDAP Authentication Err: Failed to compute the privilege for the user. socket closed

WillWhite1 — Fri, 08 Mar 2013 12:23:24 GMT

Hi All

I'm wondering if anyone has thoughts on an issue I am having with ArcGIS Server 10.1 SP1.

I am managing users via an LDAP server. If I am accessing mapservices or indeed Manager/Admin Directory from a browser, following after a period of inactivity (2 hours I think) I am unable to re-authenticate. I get a message saying that the user doesn't have permission to access. I need to clear the browser cache, or re-open the browser/clear cache in order to be able to re-authenticate.

In the server logs I am getting:

"Failed to compute the privilege for the user '<user>'. <ldapserver>:<port>; socket closed"

I dont think there are any firewalls between my ArcGIS Server and the LDAP server.

I am using a webadaptor, with web authentication.

Any thoughts on how to either extend this time out or remove it all together?

Thanks in advance

Will

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

BubbaHey — Fri, 08 Mar 2013 19:12:53 GMT

Does the username contain a comma or other non-standard character? IF so, there is a bug on this, remove the character

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

WillWhite1 — Tue, 12 Mar 2013 11:57:17 GMT

Does the username contain a comma or other non-standard character? IF so, there is a bug on this, remove the character

Thanks for your suggestion: It contains a couple of hyphens: ie a bit like this "abcde-f-ghi". Is this considered a non-standard charater?

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

BubbaHey — Wed, 13 Mar 2013 17:04:06 GMT

That should be fine. Did you find a resolution?

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

JustinRodriguez — Wed, 13 Mar 2013 18:05:07 GMT

I think this is just saying that the user isn't found. First, does windows authentication work at the GIS Tier? Thanks-

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

WillWhite1 — Thu, 14 Mar 2013 16:00:43 GMT

I think this is just saying that the user isn't found. First, does windows authentication work at the GIS Tier? Thanks-

Thanks for your comments. I've not tried GIS Tier Authentication - would this model support Windows Authentication?

I'm investigating increasing the TCP timeout to see if this helps.

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

JustinRodriguez — Thu, 14 Mar 2013 16:05:59 GMT

Hello again,
No GIS Tier does not support the Windows Authentication, but you can use Windows to Authenticate. It would be a way to tell if the issue is on the server side or the web tier side. Thanks-

Justin

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

BubbaHey — Tue, 02 Apr 2013 13:50:08 GMT

I agree with Justin, try GIS. The only advantage (really) with Web Tier is single sign-on. Problem is it limits you, and I've seen problems publishing using Web tier.

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

NathanSommers — Wed, 17 Jul 2013 13:58:33 GMT

Good Morning,

I too have this same issue and I was wondering if you have found a solution to this problem. In my instance I have found that the user group the user is a member of has lost all privileges for a specific service. Once I go into ArcGIS Manager and restore the permissions for that user group all is well. I do not however have any idea as to why the permissions get removed in the first place. Any thoughts would be greatly appreciated.

Thanks,
Ian

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

JamesCameron1 — Wed, 14 Aug 2013 01:43:09 GMT

I too am having this issue.....

We have a large AD with a large number of groups.... I wonder if it is a Kerberos token size issue......

This issue sound kind of like it http://support.esri.com/en/bugs/nimbus/TklNMDg2ODA3

Apart from I am using 10.2 so it should be resolved....

Had the same issue on upgrade and fresh install (on a new OS).....

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

DrewDowling — Wed, 14 Aug 2013 19:30:47 GMT

Started getting a similar error yesterday but we are using AD authentication not LDAP.

The arcserver install has been running fine for about 2 months then suddenly yesterday users could not log in. Problem lasted about 2 hours and then resolved itself. I checked the logs and found this error repeated for every failed login:
Failed to validate user credentials for the user 'xxxx'. <ip address of server>:389; socket closed.

Happened again this morning but is running fine now.

Anybody have any ideas?

Arcserver 10.1 SP1 on windows server 2008

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

harleypowers_parks — Tue, 20 Aug 2013 14:16:27 GMT

I was using a service account, this can get locked during configuration and produces same result. But it was working, so it maybe how much time it takes which I've also seen. However, when ldap is working secure services are not accessible thru web adaptor. Even in an http or https environment in 10.2. This is broken in 10.2, and works in 10.1. But 10.2 supports a mixed private/secure environment using 2 web adaptors. Which is why I'm trying to upgrade.
I'm considering using the custom config using java. I had some success using the windows domain...

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

DamianSlee — Thu, 29 Aug 2013 00:42:37 GMT

BTW, you can get public + Windows SSO with 2 web adapters working in 10.1 server. It is only a limitation of the Manager. If you go to the admin rest services page (what the manager uses), go to security for the folder or service that you want to make public, then add the "esriEveryone" text as the principle. Then that service/folder will be public. Essentially the issue with 10.1 mixed security is not that it doesn't support it, it is in the 10.1 Manager the Public tick box is greyed out.

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

MuryadiOey — Wed, 09 Oct 2013 13:37:58 GMT

I had similar situation with this when suddenly my application didn't work properly, after troubleshot, I found the error which made me think something was not right with a server that served as LDAP server. Re-run security connection from Server Manger fixed my issue. http://myarcgisserver.wordpress.com/2013/10/05/ldap-authentication-err-failed-to-compute-the-privilege-for-the-user/

Thanks!

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

CharlieYe1 — Thu, 24 Oct 2013 16:18:19 GMT

I am having the same problem, but with Active Directory and version 10.2.

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

DanielBaternik — Wed, 30 Oct 2013 08:40:12 GMT

We are having the same issue.

ArcGIS Server 10.2
- SSL (OTB self-signed)
- Windows Domain for Users / Roles
- Web Tier Security

Web Adaptor
-Windows Authentication (NTLM as Provider, but also tried negotiate).

The result is my user's role's are not being respected. They can't access services that they have been given access to. The problem persists when i use SSL and when i don't.

This is clearly a serious product issue and my client is very frustrated.

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

StephanieSnider — Tue, 04 Feb 2014 17:10:45 GMT

We are having this issue as well. We are using ArcGIS Server 10.2 with Web Tier authentication using Windows Authentication through the web adaptor. Map services are running. I can connect to the rest services site and see services through the GIS Server. I can connect to the rest services site through the web adaptor but no services are available. It seems the web adaptor is loosing connecting to the Active Directory. The ArcGIS Server services seems fine. We have tried, restarting IIS and restarting the ArcGIS Server services. Neither work. Right now, our users have to login to access services when they shouldn't have to (using single sign on).

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

CharlieYe1 — Fri, 27 Jun 2014 14:05:33 GMT

Did this problem ever get resolved? We are using 10.2.2 and having the same problem with web tier windows authentication. It is definitely a show stopper.

We are having this issue as well. We are using ArcGIS Server 10.2 with Web Tier authentication using Windows Authentication through the web adaptor. Map services are running. I can connect to the rest services site and see services through the GIS Server. I can connect to the rest services site through the web adaptor but no services are available. It seems the web adaptor is loosing connecting to the Active Directory. The ArcGIS Server services seems fine. We have tried, restarting IIS and restarting the ArcGIS Server services. Neither work. Right now, our users have to login to access services when they shouldn't have to (using single sign on).

Re: LDAP Authentication Err: Failed to compute the privilege for the user. socket clo

DrewDowling — Fri, 27 Jun 2014 14:46:26 GMT

Did this problem ever get resolved? We are using 10.2.2 and having the same problem with web tier windows authentication. It is definitely a show stopper.

In our case we were getting this error but with server tier authentication. Our problem was that the account that was entered to connect to and query AD was getting its password locked every 2 months per ITs security policy. We changed this account to not have its password expire and reran the security setup functionallity in ArcServer manager and the problem hasn't reappeared.