Error when inviting non-LDAP users: Activation token has expired

[andreas-bulling]

Hi,

I've successfully installed your overleaf-LDAP version but ran into a problem with inviting external (non-LDAP) users.

Opening the personal link works but once I enter a random password (I guess this is what I should be doing and that internally this sets the password initially given that as an external users I don't have a password yet at this point) I see the below error message.

Any ideas - should this work?

I can see the external user in the database btw and the user also has a hashed password associated with him - so this part seems to work. But how does the external user learn about their password?

[smhaller]

had to revert the changes in AuthenticationManager.js - for me it works again.

[andreas-bulling]

what do you mean?

[andreas-bulling]

the pull request definitely fixed the mentioned problem for me at the time - I used debug output and the object was not the id already but the whole user object. Please check.

This current issue is different I believe (not sure why you closed it?!)

[smhaller]

I checked:

• setUserPasswordInV2 is invoked from Line 176 setUserPassword();
• setUserPassword() is invoked from Line 189: explicitly with ._id: AuthenticationManager.setUserPassword(user._id, password, callback)

additionally:

• I recreated a test setup:
  • I could not see the whole user obejct - just the id.
  • If I try to reproduce this error above: add an external new user via email - On setting a password: I get exactly your error iff in AuthenticationManager.js: _id: ObjectId(userId._id.toString()) - the error disappears when _id: ObjectId(userId.toString())

-> Hence i closed the Issue.

But i'll reopen it:

• Can you try to disable check rounds?
• You can also send me some logs directly - or i can invite you to my test setup.

[smhaller]

One additional thing:

• an external user can't use an email address where the front part of the email (email minus the @somefqdn) equals a ldap uid

[smhaller]

More Info: I managed to reproduce the issue(s): They are introduced with sharelatex 2.4 It does not happen with sharelatex up to 2.3.1 - I have to further investigate the changes... For the moment i would put 2.3.1 as version in the Dockerfile

[andreas-bulling]

I identified two other issues (maybe related?):

1) We can't share projects among each other. Adding users works but the project doesn't show up in the list of projects.

2) Sharing by link doesn't work either because users have to be "activated". I checked the database but couldn't find any such flag...

[smhaller]

This should be fixed with the latest update. Now everything should work as described for sharelatex > 2.3.1 and at least sharelatex <= 2.5.2

@andreas-bulling: please can you check if the update works also on your instance - if it does i would close the issue

[andreas-bulling]

will do. Did you see my other two issues I identified? Might they be related?

[smhaller]

Yes i saw them. Both of them don't appear for my test-setup (with the current version of the auth module).

[andreas-bulling]

There are still some let's encrypt leftovers in the Dockerfile - is this intended?

[andreas-bulling]

OK, a few issues:

1) the documentation reads sharelaatex=NUMINSTANCES. -> This should be sharelatex

2) when I use the docker-compose command I receive the error ERROR: Number of containers for service "sharelatex" is not a number -> should be $NUMINSTANCES

3) Then I receive the error ERROR: Network web declared as external, but could not be found. Please create the network manually usingdocker network create weband try again. -> should be added to the documentation

4) when I fix that I see the following ``Starting traefik ... error

ERROR: for traefik Cannot start service traefik: driver failed programming external connectivity on endpoint traefik (d6b47d1a5e5359a44087f204a438097d556610105be042ce6dbdaad17af961c0): Error starting userland proxy: listen tcp 0.0.0.0:443: bind: address already in use

ERROR: for traefik Cannot start service traefik: driver failed programming external connectivity on endpoint traefik (d6b47d1a5e5359a44087f204a438097d556610105be042ce6dbdaad17af961c0): Error starting userland proxy: listen tcp 0.0.0.0:443: bind: address already in use ERROR: Encountered errors while bringing up the project. ``

-> this is because I have nginx running on that port as a frontend. I used to have a ports: - 127.0.0.1:4242:80 in the sharelatex specification before. Can this still be used and how can I continue to use nginx as a frontend?

[smhaller]

0.) Yes the letsencrypt part should be correct because traefik uses letsencrypt as well 1+2.) yes mistakes in README.md should be of course $NUMINSTANCES and sharelatex. 3.) yes i'll add that to the readme 4.-*) Yes nginx can still easily be used: in the docker-compose config: either just use the old docker-compose file or adapt the new one:

• comment the traefik part
• in the sharelatex part: add port: - 443:443
• in ldap-overleaf-sl/nginx/sharelatex.conf: uncommet to use the configuration which configures nginx for https

[andreas-bulling]

Yes, that's what I also figured out, i.e. simply not use traefik.

Do you happen to know how to get emails working out of Docker? This also doesn't seem to work in my case (postfix running on localhost, using a smarthost)

[smhaller]

hm, i use an external smtp server:

SHARELATEX_EMAIL_FROM_ADDRESS: "noreply@${MYDOMAIN}"
SHARELATEX_EMAIL_SMTP_HOST: smtp.${MYDOMAIN}
SHARELATEX_EMAIL_SMTP_PORT: 587
SHARELATEX_EMAIL_SMTP_SECURE: 'false'
SHARELATEX_EMAIL_SMTP_USER: 
SHARELATEX_EMAIL_SMTP_PASS: 
SHARELATEX_EMAIL_SMTP_TLS_REJECT_UNAUTH: true
SHARELATEX_EMAIL_SMTP_IGNORE_TLS: false

You could use a docker container like: https://github.com/appwrite/docker-smtp or https://hub.docker.com/r/bytemark/smtp/ Or an external mailhost (maybe better because the chances that the emails might not appear in the users spam folder are higher ...)

Edit: I didn't read the part in the brackets...

[smhaller]

can you send from localhost? via. e.g. mail? what is the output of

netstat -tulpn | grep :25

[andreas-bulling]

yes, this works fine

tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 407455/master

[smhaller]

I am available for a short online conf @ https://xxx.xxx

[andreas-bulling]

thanks a lot for the offer, highly appreciated - I will be in video conferences until 4pm. If that still works that would be great. if not maybe at a different time?

[smhaller]

4pm is fine. I'll be online.