Deployment with docker-compose: authentication with LPAP does not work
See original GitHub issueI have deployed scoold with docker-compose and it seems up and running: I can sign up, got verification link via email and login.
Now I am trying to get LDAP authentication working but got stuck.
(1) I have tested that connection to ldap works with ldapsearch:
ldapsearch -H ldap://192.168.30.10:7389 \
-x -D "uid=scoold,cn=users,dc=xyz,dc=com" \
-b "dc=xyz,dc=com" \
-w PASSWORD \
'(uid=abc)'
(2) my LDAP config in scoold-application.conf is:
para.security.ldap.server_url = "ldap://192.168.30.10:7389/"
para.security.ldap.base_dn = "dc=xyz,dc=com"
para.security.ldap.bind_dn = "uid=scoold,cn=users,dc=xyz,dc=com"
para.security.ldap.bind_pass = "PASSWORD"
para.security.ldap.user_search_base = "cn=users,dc=xyz,dc=com"
para.security.ldap.user_search_filter = "(uid={0})"
#para.security.ldap.user_dn_pattern = "uid={0}"
para.security.ldap.password_attribute = "userPassword"
(3) I enabled debugging by having this line in scoold.env:
JAVA_OPTS=-Dconfig.file=/scoold/application.conf -Dlogging.level.com.erudika.para.client=DEBUG
(4) when docker-compose started, the following info was in log:
security.ldap.bind_dn=uid=scoold,cn=users,dc=xyz,dc=com
security.ldap.admins_group_node=
security.ldap.password_attribute=userPassword
security.ldap.server_url=ldap://192.168.30.10:7389
security.ldap.bind_pass=PASSWORD
security.ldap.base_dn=dc=xyz,dc=com
security.ldap.active_directory_domain=
security.ldap.user_dn_pattern=uid={0}
security.ldap.mods_group_node=
security.ldap.user_search_filter=(uid={0})
security.ldap.user_search_base=cn=users,dc=xyz,dc=com
security.ldap.username_as_name=false
(5) when abc user tried to login, I got in log:
scoold_1 | 2020-07-28 22:48:30 [DEBUG] POST /jwt_auth, entity: Entity{entity={provider=ldap, appid=app:scoold, token=abc:ABC_PASS}, variant=Variant[mediaType=application/json, language=null, encoding=null], annotations=[]}
para_1 | 2020-07-28 22:48:30 [WARN ] Failed to authenticate user with LDAP server: [LDAP: error code 32 - No Such Object]; nested exception is javax.naming.NameNotFoundException: [LDAP: error code 32 - No Such Object]; remaining name 'cn=users,dc=xyz,dc=com'
para_1 | 2020-07-28 22:48:30 [INFO ] Failed to authenticate 'abc' with LDAP server: LDAP user not found.
scoold_1 | 2020-07-28 22:48:31 [ERROR] 400 - Failed to authenticate user with 'ldap'. Check if user is active.
I cannot think of any other reason than the user with DN uid=scoold,cn=users,dc=xyz,dc=com cannot connect to the LDAP server. Therefore I have checked many many times the login credentials and I am sure it’s correct.
Any hint what else I could try to troubleshoot this problem?
Issue Analytics
- State:
- Created 3 years ago
- Comments:7 (3 by maintainers)
I finally got it working after countless trial-and-errors. Here is a summary for reference:
install method: docker-compose, erudikaltd/scoold:1.39.3, erudikaltd/para:v1.37.0
ldap server: openldap-2.4.45 on UCS (which is based on debian)
users have DNs as uid=abc,cn=users,dc=xyz,dc=com
Java options in scoold.env:
JAVA_TOOL_OPTIONS=-Dconfig.file=/scoold/application.conf -Dlogging.level.com.erudika.para.client=DEBUG
Java options in para.env (thanks to this post )
JAVA_TOOL_OPTIONS=-Dconfig.file=/para/application.conf -Dloader.path=lib -Dlogging.level.org.springframework.ldap=DEBUG -Dlogging.level.org.springframework.security=DEBUG
enable debugging on ldap server by having in slapd.conf (which helped me to see the requests from scoold):
loglevel any
final ldap config:
I tried the suggested config, unfortunately it made no difference.
I also tried the following:
With quote I get a lot of errors in log, and scoold doesn’t seem up, so probably without quote is correct
JAVA_TOOL_OPTIONS seems to be picked up by both para & scoold:
however the login still fails with same messages as before.