Closed Jan-Blaha closed 2 years ago
Does your LDAP server have any logs you can check to see if it's attempting to authenticate? Your configuration looks fine to me. Unfortunately, Spring's LDAP framework is notoriously hard to debug, as the actual authentication is all handled inside the library and it logs very little information regardless of whether it succeeds or fails...
I suspect that it is trying to connect to your LDAP server but either failing to authenticate as the BINDDN or it is authenticating but failing to find a user that matches the given user name; then it tries to look up the user in its internal users table, which only has the admin user in it, and it prints out that exception when it fails.
The first thing I would do is check to make sure that you can connect to your LDAP server from the machine that is running the BagDB and test that your search criteria are correct. If you are trying to log in as test_user
, then install the ldap-utils
package and try running ldapsearch
with these parameters, based on what you provided in your example config:
ldapsearch -D 'cn=binddn,dc=example,dc=com' -w '${LDAP_BIND_PASSWORD}' -h ldap.example.com:389 -b 'cn=user,dc=example,dc=com' uid=test_user
If it works, you'll see the LDAP entry for that user; otherwise, it will probably print ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
.
For reference, if you want to experiment with the source code, the configuration is all handled inside the com.github.swrirobotics.config.SecurityConfig
class; it gets all of the configuration values and uses them to create an instance of Spring's BindAuthenticator
, which handles all of the actual communication with the LDAP server.
I tested the server accessibility with ldapsearch before and it worked fine. But based on your suggestion, I further tried some traffic analysis and the BagDB really unsuccessfully tries to authenticate with the ldap server and fails only after the fallback to the local user table. So there is something wrong with the settings I'm using.. I have no idea what, given that it works in other applications, but the problem seems to be elsewhere, so I'm closing this. Thank you for your time!
Ok, no problem. Let me know if you have any other issues!
Hey,
I wanted to set up your nice tool for managing data in our lab, but i was just unable to figure out, how to tie this to our LDAP server. Even digging quite deep in the sources did not get me an answer, so I'm writing this to ask for help.
I build my own docker-compose.yml file to meet my needs and set all the variables and everything. It is based on the https://swri-robotics.github.io/bag-database/installation/docker/with-webviz set up, but i already have an ldap server and a reverse proxy set up elsewhere.
Now, for some reason, when I then try to login (/ldap_login) using a user only in ldap (default BagDB admin works fine), I get the following exception
which i basically read as "there is no such user in the database", but what I don't understand is, why there is no effort to connect to the ldap. I can try to fix the connection parameters all day long, but if the application is not even trying to query the ldap I'm not getting anywhere.
The docker-compose file i have (with replaced details):
So could you please tell me what am I doing wrong? I don't even know what to look for anymore.