LDAP: Unable to find users in LDAP in base cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ subtree

[nikolaussuess]

Hi,

I have an issue with the LDAP authentication: The login to the server works, but no users are found. See:

root@...:/etc/slurm-web# /usr/libexec/slurm-web/slurm-web-ldap-check --log-flags ALL --debug-flags ALL
INFO ⸬ Running slurm-web-ldap-check
WARNING ⸬ Unable to find users in LDAP in base cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ subtree
No user found in LDAP directory.

But ldapsearch works fine:

ldapsearch -LLL -H ldap://HOSTNAME -Z -D "cn=ADMINUSER,cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ" -b "cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ" -W "(|(department=GROUP)(memberof=CN=GROUP,CN=Users,DC=i,DC=cs,DC=XXX,DC=YYY,DC=ZZZ))" displayName

One difference/potential issue that I found is, that the users are organized in a CN=users instead of an OU, and groups are sub-containers of that CN=users (e.g., cn=mygroup,cn=users,...).

Relevant part of gateway.ini:

[authentication]
enabled=yes

[ldap]
uri=ldap://HOSTNAME
user_base=cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ
group_base=cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ
group_name_attribute=cn
starttls=True
bind_dn=cn=adminaccount,cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ
bind_password=...

Can you perhaps give me a hint what I am doing wrong, or is this a bug?

Thank you very much in advance!

[rezib]

Hello @nikolaussuess

I converted your issue into a discussion in Q&A section as it is more a question than an actual bug, at least for the moment.

Do you know the class of users and groups objects in this LDAP directory? Are they posixAccount and posixGroups respectively?

I have an issue with the LDAP authentication: The login to the server works, but no users are found. See:

root@...:/etc/slurm-web# /usr/libexec/slurm-web/slurm-web-ldap-check --log-flags ALL --debug-flags ALL
INFO ⸬ Running slurm-web-ldap-check
WARNING ⸬ Unable to find users in LDAP in base cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ subtree
No user found in LDAP directory.

You can add --debug to this command to get more output, including the actual LDAP requests sent to the directory. This may help you to understand the path of slurm-web-ldap-check logic and figure out what is going wrong.

One difference/potential issue that I found is, that the users are organized in a CN=users instead of an OU, and groups are sub-containers of that CN=users (e.g., cn=mygroup,cn=users,...).

It should be OK with cn=users.

[nikolaussuess]

Thank you very very much!

You were right, the following options worked for me:

[ldap]
uri=ldap://HOSTNAME
user_base=cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ
group_base=cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ
group_name_attribute=cn
user_class=organizationalPerson
group_object_classes=group
user_name_attribute=cn
starttls=True
bind_dn=cn=ADMINUSER,cn=users,dc=i,dc=cs,dc=XXX,dc=YYY,dc=ZZZ
bind_password=...

Just one remark:
The user_name_attribute=uid exists on our LDAP server, and it seems that it is only missing for the administrator user (and exists for all other users). However, when I use user_name_attribute=uid, then I get the following error:
MainThread: [ERROR] slurmweb.apps.ldap LDAP error: Unable to extract user uid from user entries
I suggest to ignore such users (with a warning) instead of failing for all users. However, setting user_name_attribute=cn works fine.

[rezib]

Thank you very very much!

You were right, the following options worked for me:
[…]

🥳

Just one remark: The user_name_attribute=uid exists on our LDAP server, and it seems that it is only missing for the administrator user (and exists for all other users). However, when I use user_name_attribute=uid, then I get the following error: MainThread: [ERROR] slurmweb.apps.ldap LDAP error: Unable to extract user uid from user entries I suggest to ignore such users (with a warning) instead of failing for all users. However, setting user_name_attribute=cn works fine.

That's definitely a good suggestion, I just opened #360 to fix this.