WSO2 Intergrator 6.6.0 active directory login

Question

My environment : Centos 7.8 server , installed via yum : wso2is-5.10.0-1.el7.x86_64 , wso2ei-6.6.0-1.el7.x86_64 I want to configure authentication through my Active Directory , I read "Configuring Secondary User Stores" and "Configuring a Read-Write Active Directory User Store" , I want to do this way, so I added a "User Stores" in Home --> Configure --> User Stores Then I restart wso2ei-6.6.0-integrator and wso2is-5.10.0 services . I can see my AD users in Home --> Users But when I try to view user profile I get error "System Error Occurred" , "Error while loading user profile metadata" wso2error.log

TID: [-1234] [2020-10-07 11:18:21,148] ERROR {org.wso2.carbon.identity.user.profile.ui.client.UserProfileCient} - org.wso2.carbon.identity.user.profile.stub.UserProfileMgtServiceUserProfileExceptionException: UserProfileMgtServiceUserProfileExceptionException

I still can login at "https://esb.mydomain.com:9443/carbon/" with username/pass admin/admin , but I can't login with my AD user "mydomain.com/jack.chuong" , I get these errors : wso2carbon.log

TID: [-1234] [] [2020-10-07 11:23:16,821]  WARN {org.wso2.carbon.core.services.util.CarbonAuthenticationUtil} - Login failed. Unauthorized login attempt 'mydomain.com/jack.chuong[-1234]' at [2020-10-07 11:23:16,821+0700]

wso2error.log

TID: [-1234] [2020-10-07 11:21:02,404]  WARN {org.wso2.carbon.core.services.util.CarbonAuthenticationUtil} - Login failed. Unauthorized login attempt 'mydomain.com/jack.chuong[-1234]' at [2020-10-07 11:21:02,404+0700]

audit.log

TID: [-1234] [2020-10-07 11:21:48,968]  WARN {AUDIT_LOG} - Initiator=wso2.system.user Action=Authentication Target=mydomain.COM/jack.chuong Data=null Outcome=Failure Error={"Error Message":"Un-expected error while authenticating","Error Code":"31001"}
TID: [-1234] [2020-10-07 11:21:48,969]  WARN {AUDIT_LOG} - Login failed. Unauthorized login attempt 'mydomain.com/jack.chuong[-1234]' at [2020-10-07 11:21:48,968+0700]

Answer 1

问题解决了，AD用户被分配到没有任何权限（包括登录）的默认互联网角色，所以我必须创建新角色并分配权限。