search

ltb-project / openldap-deb

Debian packages for OpenLDAP
http://ltb-project.org/wiki/documentation/openldap-deb
GNU General Public License v3.0
14 stars 13 forks source link

conflict with remote ldap system user and group during openldap deb install #34

Closed zach3821 closed 5 years ago

zach3821 commented 5 years ago

When I go to install openldap-ltb after following the instructions here, https://ltb-project.org/documentation/openldap-deb#apt_repository , I get this output:

Setting up openldap-ltb (2.4.47.1) ... addgroup: The group 'ldap' already exists as a system group. Exiting. adduser: The user 'ldap' already exists, but is not a system user. Exiting. dpkg: error processing package openldap-ltb (--configure): installed openldap-ltb package post-installation script subprocess returned error exit status 1 Processing triggers for libc-bin (2.27-3ubuntu1) ... Errors were encountered while processing: openldap-ltb E: Sub-process /usr/bin/dpkg returned an error code (1)

I tried this on the server I am trying to set this up on as well as a fresh server and got the same issue. On Ubuntu Buster. I see that the errors involve the user/group ldap, but I have no idea why this is causing and issue. Thank you for you help.

Sorry for the wrong placement.

coudot commented 5 years ago

The command in postinstallation is:

# Create user and group
addgroup --system ${LDAPGROUP} || echo "group ${LDAPGROUP} already exists"
grep -q -E "^ldap:" /etc/passwd || adduser --system --no-create-home --home /usr/local/openldap --ingroup ${LDAPGROUP} ${LDAPUSER}

Can you test this:

grep -q -E "^ldap:" /etc/passwd || echo "test"
zach3821 commented 5 years ago

That command returns: test

coudot commented 5 years ago

Ok, so it seems you already have an ldap user on the system, but it is not stored in /etc/passwd file.

Do you have other LDAP packages on the same system?

What is the result of this command:

id ldap
zach3821 commented 5 years ago

uid=1435001154(ldap) gid=1435000513(domain users) groups=1435000513(domain users) Hmmm, so that would be from the Active Directory group domain users.

On the fresh server I get uid=111(ldap) gid=117(ldap) groups=117(ldap) Which would just be a local user.

I get the same error on both.

coudot commented 5 years ago

You server may be linked to AD or LDAP server for system authentication. You can't have a user named "ldap" in this directory.

@davidcoutadeur maybe the test must be changed to avoid this error.

zach3821 commented 5 years ago

It is indeed. So I need to change the username in AD to something that is not ldap?

davidcoutadeur commented 5 years ago

Not so simple... @coudot we could change the test, but what could we do then? Don't know if the system ldap account and the AD ldap account could coexist...

davidcoutadeur commented 5 years ago

@zach3821 @coudot: actually, I think we could change the test and make the external accounts be used.

Note: if the user ldap can not be retrieved due to network reasons, it may lead to a misfunction of LDAP server... The administrator should be advised.

davidcoutadeur commented 5 years ago

Note to myself: the test in RPM package is aready done with getent command, no need to create a new issue for rpm package

davidcoutadeur commented 5 years ago

Done in https://github.com/ltb-project/openldap-deb/releases/tag/v2.4.48