Deployment with docker-compose: authentication with LPAP does not work

I have deployed scoold with docker-compose and it seems up and running: I can sign up, got verification link via email and login.

Now I am trying to get LDAP authentication working but got stuck.

(1) I have tested that connection to ldap works with ldapsearch:

ldapsearch -H ldap://192.168.30.10:7389 \
-x -D "uid=scoold,cn=users,dc=xyz,dc=com" \
-b "dc=xyz,dc=com" \
-w PASSWORD \
'(uid=abc)'

(2) my LDAP config in scoold-application.conf is:

para.security.ldap.server_url = "ldap://192.168.30.10:7389/"
para.security.ldap.base_dn = "dc=xyz,dc=com"
para.security.ldap.bind_dn = "uid=scoold,cn=users,dc=xyz,dc=com"
para.security.ldap.bind_pass = "PASSWORD"
para.security.ldap.user_search_base = "cn=users,dc=xyz,dc=com"
para.security.ldap.user_search_filter = "(uid={0})"
#para.security.ldap.user_dn_pattern = "uid={0}"
para.security.ldap.password_attribute = "userPassword"

(3) I enabled debugging by having this line in scoold.env: JAVA_OPTS=-Dconfig.file=/scoold/application.conf -Dlogging.level.com.erudika.para.client=DEBUG

(4) when docker-compose started, the following info was in log:

security.ldap.bind_dn=uid=scoold,cn=users,dc=xyz,dc=com
security.ldap.admins_group_node=
security.ldap.password_attribute=userPassword
security.ldap.server_url=ldap://192.168.30.10:7389
security.ldap.bind_pass=PASSWORD
security.ldap.base_dn=dc=xyz,dc=com
security.ldap.active_directory_domain=
security.ldap.user_dn_pattern=uid={0}
security.ldap.mods_group_node=
security.ldap.user_search_filter=(uid={0})
security.ldap.user_search_base=cn=users,dc=xyz,dc=com
security.ldap.username_as_name=false

(5) when abc user tried to login, I got in log:

scoold_1  | 2020-07-28 22:48:30 [DEBUG] POST /jwt_auth, entity: Entity{entity={provider=ldap, appid=app:scoold, token=abc:ABC_PASS}, variant=Variant[mediaType=application/json, language=null, encoding=null], annotations=[]}
para_1    | 2020-07-28 22:48:30 [WARN ] Failed to authenticate user with LDAP server: [LDAP: error code 32 - No Such Object]; nested exception is javax.naming.NameNotFoundException: [LDAP: error code 32 - No Such Object]; remaining name 'cn=users,dc=xyz,dc=com'
para_1    | 2020-07-28 22:48:30 [INFO ] Failed to authenticate 'abc' with LDAP server: LDAP user not found.
scoold_1  | 2020-07-28 22:48:31 [ERROR] 400 - Failed to authenticate user with 'ldap'. Check if user is active.

I cannot think of any other reason than the user with DN uid=scoold,cn=users,dc=xyz,dc=com cannot connect to the LDAP server. Therefore I have checked many many times the login credentials and I am sure it’s correct.

Any hint what else I could try to troubleshoot this problem?

[hth2]

I finally got it working after countless trial-and-errors. Here is a summary for reference:

• install method: docker-compose, erudikaltd/scoold:1.39.3, erudikaltd/para:v1.37.0

• ldap server: openldap-2.4.45 on UCS (which is based on debian)

• users have DNs as uid=abc,cn=users,dc=xyz,dc=com

• Java options in scoold.env: JAVA_TOOL_OPTIONS=-Dconfig.file=/scoold/application.conf -Dlogging.level.com.erudika.para.client=DEBUG

• Java options in para.env (thanks to this post ) JAVA_TOOL_OPTIONS=-Dconfig.file=/para/application.conf -Dloader.path=lib -Dlogging.level.org.springframework.ldap=DEBUG -Dlogging.level.org.springframework.security=DEBUG

• enable debugging on ldap server by having in slapd.conf (which helped me to see the requests from scoold): loglevel any

• final ldap config:

para.security.ldap.server_url = "ldap://192.168.30.10:7389"
para.security.ldap.base_dn = "cn=users,dc=xyz,dc=com"
para.security.ldap.user_search_filter = "uid={0}"

[hth2]

I tried the suggested config, unfortunately it made no difference.

I also tried the following:

• use JAVA_TOOL_OPTIONS instead of JAVA_OPTS as suggested here
• try both with and without quote

With quote I get a lot of errors in log, and scoold doesn’t seem up, so probably without quote is correct

JAVA_TOOL_OPTIONS seems to be picked up by both para & scoold:

para_1    | Picked up JAVA_TOOL_OPTIONS: -Dconfig.file=/para/application.conf -Dloader.path=lib -Dlogging.level.org.springframework.ldap=DEBUG
scoold_1  | Picked up JAVA_TOOL_OPTIONS: -Dconfig.file=/scoold/application.conf -Dlogging.level.com.erudika.para.client=DEBUG

however the login still fails with same messages as before.