search

sympa-community / sympa

Sympa, Mailing List Management Software
https://www.sympa.community/sympa
GNU General Public License v2.0
249 stars 98 forks source link

Ldap auth not working #1723

Closed quenenni closed 1 year ago

quenenni commented 1 year ago

Version

Debian: 12.1 (new install) Sympa 6.2.70

Installation method

Deb package

Expected behavior

We have several Sympa instances working nicely. On this new one, we would like to connect to our Ldap server, but whatever I'm trying, not once I saw a connection attempt from Sympa to our Ldap server. I tried lots of configurations found on the net and the official doc from Sympa without luck.

Actual behavior

If I try to connect with a mail that exists in our Ldap, I have the error :

wwsympa[40440]: info main::do_login(test.test92@xxxx.school) [robot listes.xxxx.school] [session 45640241505289] [client 213.211.YYY.YYY]
wwsympa[40440]: err main::#1557 > main::do_login#3155 > Sympa::WWW::Auth::check_auth#62 > Sympa::WWW::Auth::authentication#214 Incorrect password for user test.test92@xxxx.school
wwsympa[40440]: notice main::do_login() Authentication failed

If I try to connect with an Uid instead of a mail, I have this error:

wwsympa[40439]: info main::do_login(e99992) [robot listes.xxxx.school] [session 45640241505289] [client 213.211.YYY.YYY]
wwsympa[40439]: err main::#1557 > main::do_login#3155 > Sympa::WWW::Auth::check_auth#86 Incorrect LDAP password
wwsympa[40439]: notice main::do_login() Authentication failed

This is the only time I see something about Ldap in the sympa logs, but in the case of an Uid, it shouldn't use LDAP as the "regexp" value doesn't include the Uid format.

And not one connection since my first try to the ldap server

It's like Sympa doesn't take into account our Ldap configuration

Additional information

Here is my auth.conf file:

ldap
  regexp                      xxxx\.school
  host                        ldap.xxxx.school:23389
  timeout                     30
  suffix                      ou=people,dc=xxxx,dc=school
  get_dn_by_uid_filter        (&(uid=[sender])(active=TRUE))
  get_dn_by_email_filter      (&(|(mail=[sender])(mailinitial=[sender]))(active=TRUE))
  email_attribute             mail
  alternative_email_attribute mailinitial
  scope                       sub
  use_tls                     starttls
  bind_dn                     uid=sympa,ou=services,dc=xxxx,dc=school
  bind_password            SECRET

user_table
  negative_regexp xxxx\.school

Whatever configuration I tried, I never saw a connection attempt from Sympa in the Ldap server logs.

When using ldapsearch or the /usr/share/sympa/bin/sympa_test_ldap.pl script from sympa, it works well in both case and I can see the connection in our Ldap server logs.

Here you can find the logs when starting Sympa:

bulk[78731]: info main:: Configuration file read, default log level 5
bulk[78731]: notice Sympa::Process::daemonize() Starting bulk daemon, PID 78746
bounced.pl: info main:: Configuration file read, default log level 5
bounced[78745]: notice main:: Bounced 6.2.70 Started
bulk[78746]: notice main:: Bulk 6.2.70 Started
task_manager[78733]: info main:: Configuration file read, default log level 5
task_manager[78733]: notice Sympa::Process::daemonize() Starting task_manager daemon, PID 78748
archived.pl: info main:: Configuration file read, default log level 5
archived[78747]: debug2 Conf::get_robots_list() Retrieving the list of robots on the server
task_manager[78733]: notice main:: Task_Manager 6.2.70 Started
sympa_msg[78734]: info main::_load() Configuration file read, default log level 5
sympa_msg[78734]: debug3 Conf::get_parameters_group() Getting parameters for group "Database related"
sympa_msg[78734]: debug2 Sympa::Database::new(Sympa::Database, mysql)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.eval_bouncers.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.eval_bouncers.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug2 Sympa::Task::_parse(Sympa::Task <date=1695992388;label=ACTION;model=eval_bouncers;context=*>, ...)
sympa_msg[78734]: debug3 Sympa::Database::connect(Sympa::DatabaseDriver::MySQL <db_host=localhost;db_name=sympa;db_port=3306;db_user=sympa>)
task_manager[78733]: debug2 Sympa::Task::_chk_line(title.gettext daily evaluation of bouncing users, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(/ACTION, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(eval_bouncers (), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(eval_bouncers, 4, ARRAY)
task_manager[78733]: debug2 Sympa::Task::_chk_line(next(execution_date + 1d, ACTION), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(next, 5, ARRAY)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.expire_bounce.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.expire_bounce.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug2 Sympa::Task::_parse(Sympa::Task <date=1695992388;label=ACTION;model=expire_bounce;context=*>, ...)
sympa_msg[78734]: debug2 Sympa::Database::connect() Connected to Database Sympa::DatabaseDriver::MySQL <db_host=localhost;db_name=sympa;db_port=3306;db_user=sympa>
task_manager[78733]: debug2 Sympa::Task::_chk_line(title.gettext expire of bounces older than 10 days before message distribution, )
sympa_msg[78734]: debug3 Conf::load() File /etc/sympa/sympa/sympa.conf has changed since the last cache. Loading file
task_manager[78733]: debug2 Sympa::Task::_chk_line(, )
sympa_msg[78734]: debug3 Sympa::search_fullpath(*, nrcpt_by_domain.conf, )
sympa_msg[78734]: debug3 Sympa::get_search_path(*, , )
sympa_msg[78734]: debug3 Sympa::search_fullpath() Name: nrcpt_by_domain.conf; file /usr/share/sympa/default/nrcpt_by_domain.conf
sympa_msg[78734]: debug3 Sympa::search_fullpath(*, crawlers_detection.conf, )
sympa_msg[78734]: debug3 Sympa::get_search_path(*, , )
sympa_msg[78734]: debug3 Sympa::search_fullpath() Name: crawlers_detection.conf; file /usr/share/sympa/default/crawlers_detection.conf
sympa_msg[78734]: debug3 Sympa::search_fullpath(*, trusted_applications.conf, )
sympa_msg[78734]: debug3 Sympa::get_search_path(*, , )
sympa_msg[78734]: debug3 Conf::_load_auth(, )
sympa_msg[78734]: debug3 Sympa::search_fullpath(*, auth.conf, )
sympa_msg[78734]: debug3 Sympa::get_search_path(*, , )
sympa_msg[78734]: debug3 Sympa::search_fullpath() Name: auth.conf; file /etc/sympa/auth.conf
sympa_msg[78734]: debug2 Conf::get_robots_list() Retrieving the list of robots on the server
archived[78747]: notice main:: Archived 6.2.70 Started
task_manager[78733]: debug2 Sympa::Task::_chk_line(/ACTION, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(expire_bounce (10), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(expire_bounce, 4, ARRAY)
task_manager[78733]: debug2 Sympa::Task::_chk_line(next (execution_date + 1d, ACTION), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(next, 5, ARRAY)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.purge_logs_table.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.purge_logs_table.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug2 Sympa::Task::_parse(Sympa::Task <date=1695992388;label=ACTION;model=purge_logs_table;context=*>, ...)
task_manager[78733]: debug2 Sympa::Task::_chk_line(title.gettext daily deletion of outdated logs, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(/ACTION, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(purge_logs_table (), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(purge_logs_table, 4, ARRAY)
task_manager[78733]: debug2 Sympa::Task::_chk_line(next (execution_date+1d, ACTION), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(next, 5, ARRAY)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.purge_one_time_ticket_table.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.purge_one_time_ticket_table.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug2 Sympa::Task::_parse(Sympa::Task <date=1695992388;label=ACTION;model=purge_one_time_ticket_table;context=*>, ...)
task_manager[78733]: debug2 Sympa::Task::_chk_line(title.gettext daily deletion of outdated tickets, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(/ACTION, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(purge_one_time_ticket_table (), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(purge_one_time_ticket_table, 4, ARRAY)
task_manager[78733]: debug2 Sympa::Task::_chk_line(next (execution_date+1d, ACTION), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(next, 5, ARRAY)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.purge_session_table.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.purge_session_table.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug2 Sympa::Task::_parse(Sympa::Task <date=1695992388;label=ACTION;model=purge_session_table;context=*>, ...)
task_manager[78733]: debug2 Sympa::Task::_chk_line(title.gettext daily termination of outdated sessions, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(/ACTION, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(purge_session_table (), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(purge_session_table, 4, ARRAY)
task_manager[78733]: debug2 Sympa::Task::_chk_line(next (execution_date+1d, ACTION), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(next, 5, ARRAY)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.purge_spools.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.purge_spools.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug2 Sympa::Task::_parse(Sympa::Task <date=1695992388;label=ACTION;model=purge_spools;context=*>, ...)
task_manager[78733]: debug2 Sympa::Task::_chk_line(title.gettext daily deletion of unuseful items from any spool, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(/ACTION, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(purge_spools (), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(purge_spools, 4, ARRAY)
task_manager[78733]: debug2 Sympa::Task::_chk_line(next (execution_date+1d, ACTION), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(next, 5, ARRAY)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992389.ACTION.purge_tables.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992389.ACTION.purge_tables.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug2 Sympa::Task::_parse(Sympa::Task <date=1695992389;label=ACTION;model=purge_tables;context=*>, ...)
task_manager[78733]: debug2 Sympa::Task::_chk_line(title.gettext daily deletion of unuseful items from table, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(/ACTION, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(purge_tables (), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(purge_tables, 4, ARRAY)
task_manager[78733]: debug2 Sympa::Task::_chk_line(next (execution_date+1d, ACTION), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(next, 5, ARRAY)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1696251189.ACTION.process_bouncers.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1696251189.ACTION.process_bouncers.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug2 Sympa::Task::_parse(Sympa::Task <date=1696251189;label=ACTION;model=process_bouncers;context=*>, ...)
task_manager[78733]: debug2 Sympa::Task::_chk_line(title.gettext automatic management of bouncing users, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(/ACTION, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(process_bouncers (), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(process_bouncers, 4, ARRAY)
task_manager[78733]: debug2 Sympa::Task::_chk_line(next(execution_date + 1w, ACTION), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(next, 5, ARRAY)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1696423886.ACTION.purge_orphan_bounces.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1696423886.ACTION.purge_orphan_bounces.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug2 Sympa::Task::_parse(Sympa::Task <date=1696423886;label=ACTION;model=purge_orphan_bounces;context=*>, ...)
task_manager[78733]: debug2 Sympa::Task::_chk_line(title.gettext monthly deletion of bounces for unsubscribed addresses, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(/ACTION, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(purge_orphan_bounces (), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(purge_orphan_bounces, 4, ARRAY)
task_manager[78733]: debug2 Sympa::Task::_chk_line(next(execution_date + 1m, ACTION), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(next, 5, ARRAY)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1696423886.ACTION.purge_user_table.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1696423886.ACTION.purge_user_table.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug2 Sympa::Task::_parse(Sympa::Task <date=1696423886;label=ACTION;model=purge_user_table;context=*>, ...)
task_manager[78733]: debug2 Sympa::Task::_chk_line(title.gettext monthly purge of orphan entries in user table, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(/ACTION, )
task_manager[78733]: debug2 Sympa::Task::_chk_line(purge_user_table (), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(purge_user_table, 4, ARRAY)
task_manager[78733]: debug2 Sympa::Task::_chk_line(next (execution_date + 1m, ACTION), )
task_manager[78733]: debug2 Sympa::Task::_chk_cmd(next, 5, ARRAY)
task_manager[78733]: debug2 Sympa::List::get_robots()
task_manager[78733]: debug2 Sympa::List::get_lists(listes.xxxx.school, )
task_manager[78733]: debug3 Conf::get_parameters_group() Getting parameters for group "Database related"
task_manager[78733]: debug2 Sympa::Database::new(Sympa::Database, mysql)
task_manager[78733]: debug3 Sympa::Database::connect(Sympa::DatabaseDriver::MySQL <db_host=localhost;db_name=sympa;db_port=3306;db_user=sympa>)
sympa_msg[78734]: notice Sympa::Process::daemonize() Starting sympa/msg daemon, PID 78749
task_manager[78733]: debug2 Sympa::Database::connect() Connected to Database Sympa::DatabaseDriver::MySQL <db_host=localhost;db_name=sympa;db_port=3306;db_user=sympa>
task_manager[78733]: debug3 Sympa::List::get_lists() filter ;
task_manager[78733]: debug3 Sympa::List::get_lists() order ; name_list
task_manager[78733]: debug3 Sympa::List::new(coucou, listes.xxxx.school, skip_name_check)
task_manager[78733]: debug3 Sympa::List::load(Sympa::List <>, coucou, listes.xxxx.school, ...)
task_manager[78733]: debug3 Sympa::List::_load_list_config_file(Sympa::List <coucou@listes.xxxx.school>)
sympa_msg[78749]: notice main:: Sympa/msg 6.2.70 Started
task_manager[78733]: debug2 Sympa::Robot::load_topics(listes.xxxx.school)
task_manager[78733]: debug3 Sympa::search_fullpath(listes.xxxx.school, topics.conf, )
task_manager[78733]: debug3 Sympa::get_search_path(listes.xxxx.school, , )
task_manager[78733]: debug3 Sympa::search_fullpath() Name: topics.conf; file /etc/sympa/topics.conf
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, subject, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, visibility, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, topics, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, send, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, reception, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, reception, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, visibility, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, custom_subject, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, subscribe, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, unsubscribe, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, invite, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, review, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, process_archive, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, mail_access, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, web_access, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, quota, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, clean_delay_queuemod, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, date_epoch, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, date, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, email, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, email, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, date_epoch, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, status, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, serial, %s, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, max_list_members, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, remind_task, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, dkim_signature_apply_on, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, verp_rate, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, action, notify_bouncers, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, rate, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, notification, owner, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, web_archive_spam_protection, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, remind, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, msg_topic_keywords_apply_on, subject, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, welcome_return_path, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, warn_rate, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, halt_rate, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, mail_apply_on, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, web_apply_on, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, reject_mail_from_automates_feature, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, priority, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, footer_type, mime, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, archive_crypted_msg, original, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, retention_period, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, delivery_status_notification, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, tracking, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, message_disposition_notification, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, lang, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, info, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, remove_outgoing_headers, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, sql_fetch_timeout, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, ttl, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, spam_protection, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, digest_max_size, 25, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, d_edit, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, quota, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, d_read, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, arc_private_key_path, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, arc_signer_domain, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, arc_selector, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, host, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, pictures_feature, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, cookie, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, apply, respect, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, value, sender, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, inclusion_notification_feature, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, access, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, quota, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, mode, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, other_email, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, domain_regex, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, phrase, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, personalization_feature, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, remove_headers, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, rfc2369_header_fields, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, max_size, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, user_data_source, include2, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, rate, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, action, remove_bouncers, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, notification, owner, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, del, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, profile, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, visibility, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, reception, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, add, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, loop_prevention_regex, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, reply_to, sender, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, visibility, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, reception, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, owner_domain, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, remind_return_path, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, owner_domain_min, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, distribution_ttl, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, arc_feature, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, header_list, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, signer_domain, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, private_key_path, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, selector, HASH, HASH)
task_manager[78733]: debug3 Sympa::List::_load_list_param(Sympa::List <coucou@listes.xxxx.school>, msg_topic_tagging, optional, HASH)
task_manager[78733]: debug2 Sympa::List::_load_edit_list_conf(Sympa::List <coucou@listes.xxxx.school>)
task_manager[78733]: debug3 Sympa::search_fullpath(Sympa::List <coucou@listes.xxxx.school>, edit_list.conf, )
task_manager[78733]: debug3 Sympa::get_search_path(Sympa::List <coucou@listes.xxxx.school>, , )
task_manager[78733]: debug3 Sympa::search_fullpath() Name: edit_list.conf; file /usr/share/sympa/default/edit_list.conf
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.eval_bouncers.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.eval_bouncers.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.expire_bounce.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.expire_bounce.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.purge_logs_table.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.purge_logs_table.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.purge_one_time_ticket_table.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.purge_one_time_ticket_table.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.purge_session_table.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.purge_session_table.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992388.ACTION.purge_spools.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992388.ACTION.purge_spools.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1695992389.ACTION.purge_tables.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1695992389.ACTION.purge_tables.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1696251189.ACTION.process_bouncers.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1696251189.ACTION.process_bouncers.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1696423886.ACTION.purge_orphan_bounces.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1696423886.ACTION.purge_orphan_bounces.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata(/var/spool/sympa/task, 1696423886.ACTION.purge_user_table.sympa@listes.xxxx.school, qr<(?^:\A(\d+)[.](\w*)[.](\w+)[.](?:([^\s\@]*)\@([\w\.\-*]*)|_global)\z)>)
task_manager[78733]: debug3 Sympa::Spool::unmarshal_metadata() messagekey=1696423886.ACTION.purge_user_table.sympa@listes.xxxx.school, context=listes.xxxx.school, priority=1

Nothing about Ldap in the starting logs. I feel that's already saying something.

I searched if I had to install specific things in order to have Ldap working, but from what I gather, I'd say no.

Any idea what I'm missing?

ikedas commented 1 year ago

Hi @quenenni ,

When using ldapsearch or the /usr/share/sympa/bin/sympa_test_ldap.pl script from sympa, it works well in both case and I can see the connection in our Ldap server logs.

How have you invoked sympa_test_ldap.pl ? Please show us full of the command line options you specified.

quenenni commented 1 year ago

Hello @ikedas,

Thanks for your time.

Here is the command and the result /usr/share/sympa/bin/sympa_test_ldap.pl --filter="(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))" --host=ldap.xxxx.school --suffix=ou=people,dc=xxxx,dc=school --bind_dn=uid=moodle,ou=services,dc=xxxx,dc=school --port=23389 --scope=sub --use_tls=starttls

host=ldap.xxxx.school suffix=ou=people,dc=xxxx,dc=school filter=(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))
#uid=E99992,ou=people,dc=xxxx,dc=school
Total : 1
ikedas commented 1 year ago
  1. You seem executing sympa_test_ldap.pl without --bind_password so that no attributes of the entry are retrieved. Please try again with this option.
  2. Sympa actually executes LDAP search operations twice. First, it binds as bind_dn to retrieve the entry for the user trying login. Second, it binds as the DN of retrieved entry. So if you successfully retrieved the entry on 1., try additionally: sympa_test_ldap.pl --bind_dn=[user's DN] --bind_password=[user's password] --host=... --port=... --scope=sub --use_tls=starttls and check if the binding is successful.

Also, if possible, please check the log of LDAP server.

quenenni commented 1 year ago
  1. It asks me for a password when not having the bind_password param on the command line. But I did it also with bind_password as param and have the same result.

/usr/share/sympa/bin/sympa_test_ldap.pl --filter="(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))" --host=ldap.xxxx.school --suffix=ou=people,dc=xxxx,dc=school --bind_dn=uid=moodle,ou=services,dc=xxxx,dc=school --bind_password=xxxxxxxxxx --port=23389 --scope=sub --use_tls=startt

host=ldap.xxxx.school suffix=ou=people,dc=xxxx,dc=school filter=(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))
#uid=E99992,ou=people,dc=xxxx,dc=school
Total : 1
  1. /usr/share/sympa/bin/sympa_test_ldap.pl --filter="(active=TRUE)" --host=ldap.xxxx.school --suffix=ou=people,dc=xxxx,dc=school --bind_dn=uid=E99992,ou=people,dc=xxxx,dc=school --bind_password=xxxxxxxxxx --port=23389 --scope=sub --use_tls=startt

I had to put the --filter arg, without it, the script returns an error.

The script returns this error:

host=ldap.xxxx.school suffix=ou=people,dc=xxxx,dc=school filter=(active=TRUE)
err Sympa::DatabaseDriver::LDAP::do_operation() Unable to perform LDAP operation: No such object
Search  impossible: (32) No such object

I tried also with --suffix="uid=E99992,ou=people,dc=xxxx,dc=school" and it works:

host=ldap.xxxx.school suffix=uid=E99992,ou=people,dc=xxxx,dc=school filter=(active=TRUE)
#uid=E99992,ou=people,dc=xxxx,dc=school
Total : 1

The same with LdapSearch. ldapsearch -x -H ldap://ldap.xxxx.school:23389 -D uid=E99992,ou=people,dc=xxxx,dc=school -W -b "ou=people,dc=xxxx,dc=school" -s sub "(mail=test.test92@xxxx.school)"

search: 2
result: 32 No such object

While this command is successful. ldapsearch -x -H ldap://ldap.xxxx.school:23389 -D uid=E99992,ou=people,dc=xxxx,dc=school -W -b "uid=E99992,ou=people,dc=xxxx,dc=school"

And that's because of the user rights on the ´ou=people,dc=xxxx,dc=school` branch.

User can't search that branch but they can see their own ldap entry in that branch.

Is it only working if users can search the ´ou=people,dc=xxxx,dc=school´ branch?

ikedas commented 1 year ago

(Deleted)

ikedas commented 1 year ago

I was slightly mistaken. Below is the corrected reply.

  1. It asks me for a password when not having the bind_password param on the command line. But I did it also with bind_password as param and have the same result.

/usr/share/sympa/bin/sympa_test_ldap.pl --filter="(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))" --host=ldap.xxxx.school --suffix=ou=people,dc=xxxx,dc=school --bind_dn=uid=moodle,ou=services,dc=xxxx,dc=school --bind_password=xxxxxxxxxx --port=23389 --scope=sub --use_tls=startt

host=ldap.xxxx.school suffix=ou=people,dc=xxxx,dc=school filter=(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))
#uid=E99992,ou=people,dc=xxxx,dc=school
Total : 1

The result of this search operation is used as the user's attribute (e-mail address). Therefore, it is necessary that the bind_dn is allowed to get the entry (at least the attribute specified by email_attribute) by the ACL of the LDAP server.

  1. /usr/share/sympa/bin/sympa_test_ldap.pl --filter="(active=TRUE)" --host=ldap.xxxx.school --suffix=ou=people,dc=xxxx,dc=school --bind_dn=uid=E99992,ou=people,dc=xxxx,dc=school --bind_password=xxxxxxxxxx --port=23389 --scope=sub --use_tls=startt

I had to put the --filter arg, without it, the script returns an error.

The script returns this error:

host=ldap.xxxx.school suffix=ou=people,dc=xxxx,dc=school filter=(active=TRUE)
err Sympa::DatabaseDriver::LDAP::do_operation() Unable to perform LDAP operation: No such object
Search  impossible: (32) No such object

I tried also with --suffix="uid=E99992,ou=people,dc=xxxx,dc=school" and it works:

host=ldap.xxxx.school suffix=uid=E99992,ou=people,dc=xxxx,dc=school filter=(active=TRUE)
#uid=E99992,ou=people,dc=xxxx,dc=school
Total : 1

The same with LdapSearch. ldapsearch -x -H ldap://ldap.xxxx.school:23389 -D uid=E99992,ou=people,dc=xxxx,dc=school -W -b "ou=people,dc=xxxx,dc=school" -s sub "(mail=test.test92@xxxx.school)"

search: 2
result: 32 No such object

While this command is successful. ldapsearch -x -H ldap://ldap.xxxx.school:23389 -D uid=E99992,ou=people,dc=xxxx,dc=school -W -b "uid=E99992,ou=people,dc=xxxx,dc=school"

And that's because of the user rights on the ´ou=people,dc=xxxx,dc=school` branch.

User can't search that branch but they can see their own ldap entry in that branch.

Is it only working if users can search the ´ou=people,dc=xxxx,dc=school´ branch?

Actually, this second connection only performs the bind operation and not the search operation. According to your results, the bind operation is successful, so there is no problem on the second connection.

quenenni commented 1 year ago

Thanks for the info.

So the problem is elsewhere..

Shouldn't I see something about ldap connection in the startup logs (as show in the first post)? Even if I misconfigured my Ldap parameters, shouldn't I see something in the logs?

And the fact that the Ldap server logs doesn't show anything when starting Sympa is also strange, no?

ikedas commented 1 year ago

Sympa does not connect to the LDAP server when it starts up, nor does it stay connected all the time. As explained above, it connects and disconnects twice when authentication is requested.

quenenni commented 1 year ago

But when I try to log with an existing user, I should see an attempt in the ldap server logs.

Actual behavior

If I try to connect with a mail that exists in our Ldap, I have the error :

wwsympa[40440]: info main::do_login(test.test92@xxxx.school) [robot listes.xxxx.school] [session 45640241505289] [client 213.211.YYY.YYY]
wwsympa[40440]: err main::#1557 > main::do_login#3155 > Sympa::WWW::Auth::check_auth#62 > Sympa::WWW::Auth::authentication#214 Incorrect password for user test.test92@xxxx.school
wwsympa[40440]: notice main::do_login() Authentication failed

And nothing happens in the ldap server logs.

ikedas commented 1 year ago

Please read my psts, The search operation in the first LDAP connection should return the attributes, however it does not,

quenenni commented 1 year ago

Sorry, I thought you didn't read well my post :)

So I understand that this answer from the ldap_test script is not good despite saying it found a result:

/usr/share/sympa/bin/sympa_test_ldap.pl --filter="(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))" --host=ldap.xxxx.school --suffix=ou=people,dc=xxxx,dc=school --bind_dn=uid=moodle,ou=services,dc=xxxx,dc=school --port=23389 --scope=sub --use_tls=starttls

host=ldap.xxxx.school suffix=ou=people,dc=xxxx,dc=school filter=(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))
#uid=E99992,ou=people,dc=xxxx,dc=school
Total : 1

For me that was a good answer saying it found 1 user with that filter with the "bind user". But you're saying the result should show several attributes and their value in the result? Something like:

host=ldap.xxxx.school suffix=ou=people,dc=xxxx,dc=school filter=(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))
#uid=E99992,ou=people,dc=xxxx,dc=school
mail=xxx@yyy.zz
Total : 1

Sorry if it's not that, but I still don't understand what I should have as an answer and why nothing appears in the ldap server logs, not even a connection attempt, when I try to login with a ldap user.

ikedas commented 1 year ago

Sorry, I thought you didn't read well my post :)

So I understand that this answer from the ldap_test script is not good despite saying it found a result:

/usr/share/sympa/bin/sympa_test_ldap.pl --filter="(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))" --host=ldap.xxxx.school --suffix=ou=people,dc=xxxx,dc=school --bind_dn=uid=moodle,ou=services,dc=xxxx,dc=school --port=23389 --scope=sub --use_tls=starttls

host=ldap.xxxx.school suffix=ou=people,dc=xxxx,dc=school filter=(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))
#uid=E99992,ou=people,dc=xxxx,dc=school
Total : 1

For me that was a good answer saying it found 1 user with that filter with the "bind user". But you're saying the result should show several attributes and their value in the result? Something like:

host=ldap.xxxx.school suffix=ou=people,dc=xxxx,dc=school filter=(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))
#uid=E99992,ou=people,dc=xxxx,dc=school
mail=xxx@yyy.zz
Total : 1

Yes.

Sorry if it's not that, but I still don't understand what I should have as an answer and why nothing appears in the ldap server logs, not even a connection attempt, when I try to login with a ldap user.

About the feature of the LDAP server, please ask the administrator of that server.

quenenni commented 1 year ago

Thanks for the info.

About the feature of the LDAP server, please ask the administrator of that server.

I am the administrator of the Ldap server. Our Ldap server is working with Nextcloud / Mailcow / Gitea / Moodle / Peertube and Mattermost. We tried to add Sympa, but not possible at the moment.

The fact the a sympa_test_ldap.pl or ldapsearch command is working and we can see the connection in the Ldap server logs, but nothing appears in the Ldap logs when trying to connect in Sympa with a user from the Ldap database seems to show the problem is not my Ldap server.

I searched all I could on the net, saw sympa ldap examples, check a hundred time my config and tried different options, but not once trying to connect to Sympa showed a line in the Ldap server.

If the problem is the user rights on the branch "ou=people,dc=xxxx,dc=school", it still doens't explain why the first connection with the bind_user "uid=moodle,ou=services,dc=xxxx,dc=school" is not working either as that user has the necessary rights on that branch.

So, at this point, I'm still not sure if I have a config problem (bigger probability) or if Sympa has a problem.

I'm going to debug the script sympa_test_ldap.pl and try to see if I can understand why it doesn't get the attributes in the result.

quenenni commented 1 year ago

I found I forgot to use the '--attrs' param in the sympa_test_ldap.pl command and that's why no attributes where shown despite having a successfull connection.

/usr/share/sympa/bin/sympa_test_ldap.pl --filter="(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))" --host=ldap.xxxx.school --suffix=ou=people,dc=xxxx,dc=school --bind_dn=uid=moodle,ou=services,dc=xxxx,dc=school --bind_password=xxxxxxxxxx --port=23389 --scope=sub --use_tls=startt --attrs=uid,mail,mailinitial

host=ldap.xxxx.school suffix=ou=people,dc=xxxx,dc=school filter=(&(|(mail=test.test92@xxxx.school)(mailinitial=test.test92@xxxx.school))(active=TRUE))
#uid=E99992,ou=people,dc=xxxx,dc=school
        uid => E99992
        mailinitial => test.test92@xxxx.school
        mail => test.test92@xxxx.school
Total : 1

The same when binding with a normal user.

/usr/share/sympa/bin/sympa_test_ldap.pl --filter="(active=TRUE)" --host=ldap.xxxx.school --suffix=uid=E99992,ou=people,dc=xxxx,dc=school --bind_dn=uid=E99992,ou=people,dc=xxxx,dc=school --bind_password=secret --port=23389 --scope=sub --use_tls=startt --attrs=uid,mail,mailinitial

host=ldap.xxxx.school suffix=uid=E99992,ou=people,dc=xxxx,dc=school filter=(active=TRUE)
#uid=E99992,ou=people,dc=xxxx,dc=school
        uid => E99992
        mail => test.test92@xxxx.school
        mailinitial => test.test92@xxxx.school
Total : 1
quenenni commented 1 year ago

I think I found the problem.

When trying to connect with a user, I found this in the sympa logs:

debug2 Sympa::Database::new(Sympa::Database, LDAP)
2023-10-13T15:45:00.373311+02:00 listes wwsympa[906]: debug3 Sympa::Database::connect(Sympa::DatabaseDriver::LDAP <bind_dn=uid=moodle,ou=services,dc=xxxx,dc=school;host=ldap://192.168.6.101:389;ssl_version=tlsv1_2;timeout=30;use_tls=starttls>)
2023-10-13T15:45:03.425041+02:00 listes wwsympa[906]: err main::#1557 > main::do_login#3094 > main::is_ldap_user#3775 > Sympa::Database::connect#153 > (eval)#153 > Sympa::DatabaseDriver::LDAP::_connect#125 Unable to connect to the LDAP server ldap://192.168.6.101:389: No route to host
2023-10-13T15:45:03.425585+02:00 listes wwsympa[906]: err main::#1557 > main::do_login#3094 > main::is_ldap_user#3775 > Sympa::Database::connect#157 Can't connect to Database Sympa::DatabaseDriver::LDAP <bind_dn=uid=moodle,ou=services,dc=xxxx,dc=school;host=ldap://192.168.6.101:389;ssl_version=tlsv1_2;timeout=30;use_tls=starttls>:
2023-10-13T15:45:03.425856+02:00 listes wwsympa[906]: err main::#1557 > main::do_login#3094 > main::is_ldap_user#3777 Unable to connect to the LDAP server "192.168.6.101:389"

In my auth.conf file, I have this option:

  host                        ldap.xxxx.school:23389

So the ldap://192.168.6.101:389 is wrong.

I tried to find where Sympa could have this address but couldn't find it. This address was an address used at the beginning but changed to ldap.xxx.school:23389 for a while.

I restarted every Sympa service, but no change

systemctl restart sympa-task_manager
systemctl restart sympasoap
systemctl restart sympa-bulk
systemctl restart sympa-bounced
systemctl restart sympa-archived
systemctl restart sympa

Any idea why Sympa is not using the host option from auth.conf ?

ikedas commented 1 year ago

How about grep-ing all the files under /etc/sympa ?

ikedas commented 1 year ago

Why don't you restart wwsympa and HTTP server?

quenenni commented 1 year ago

I found the problem last Friday and you're 100% right.

The problem I had is that a systemctl restart sympa doesn't refresh the config file and thus doesn't take into account the modifications. It was the systemctl restart wwsympa that fixed my auth.conf problem.

And that's why I became crazy because nothing was logical.

The same for options added into sympa.conf.

I added log_level and by just restarting sympa, several sub services were still using ther old value of log_level.

I feel that's something that could be improved

Either have sympa.service refreshing the config options on restart/reload or have somethiong like a sympa_all.service that restart/reload all services / sub services.

But the way it's done now brings confusion.

Thanks again for your help. Much appreciated.