https://github.com/lldap/lldap logo
Powered by
Martin | Leveland Studios - How Can I get if us...
# troubleshooting
t
I have exact group name that I want to test for user who's trying to login. Basic login works, but I can't restrict him for a group.
This is what I use:
Copy code
<Location />
  AuthType Basic
  AuthName "Enter LDAP credentials"
  
  AuthBasicProvider ldap
  AuthLDAPGroupAttribute member
  AuthLDAPSubGroupClass group
  AuthLDAPGroupAttributeIsDN On
  AuthLDAPURL "ldap://localhost:3890/dc=example,dc=com??sub?(objectClass=person)"
  AuthLDAPBindDN "cn=admin,ou=people,dc=example,dc=com"
  AuthLDAPBindPassword ...
  
  Require ldap-group cn=my-ldap-group,ou=groups,dc=example,DC=com
</Location>
Without group it works perfectly as intended. Problem is when I try to test him for a group. It completely ignores it and it seems like Require ldap-group does only check if group exists in the database.
n
Well, I don't know much about httpd. I would double check the group DN, and if that's correct, I can't take a look at the LLDAP verbose logs if you want
But if httpd is not issuing LDAP queries, you'll have to ask that project
t
I found out in apache some errors and ldap is returning some "no such object" and "didn't match with attr member"
Though LLDAP verbose has no log for that.
n
Then it'd be useful to have a look at the LLDAP logs
t
Well thing is, there are no logs for that even I have verbose 😄
n
(did you make sure that the DC part is okay?)
t
Yes, now I'm really careful about that
n
We have logs for every query we receive: maybe it doesn't show any error, but it's logged as a query and response
t
It's failing on testing group membership
But LLDAP logs produce nothing.
n
Can I see the LLDAP logs for getting the user?
t
Yep, one sec
n
(the groups can be returned along with the user, so testing the membership can happen without a separate query)
t
It doesn't produce any log
n
Then it's not getting the user from LLDAP
No log = no query
t
That's weird actually
Isn't it getting from normal ldap instead?
n
What do you mean, normal LDAP?
t
IDK, maybe something else running next to LLDAP?
n
LLDAP is the server, but it speaks LDAP
Check the params you give you httpd and their logs
Do they log anything about the LDAP request? Do they have verbose logs?
t
Yes they do
ID's match, they are correct.
If i put there member or uniquemember instead of memberUid, it is always true doesn't matter whether user is in group or not.
n
(it's not something silly like "cn=test" vs "uid=test", is it?)
t
uid=test is username
n
Oh, memberUid is something different
t
and cn=my-ldap-group
dc=example
n
If I'm not mistaken, that's a UUID
Or it's not returned
t
Should be, but it looks like that attribute is not found.
n
Right, we support entryUuid as an attribute, but there's no memberUid
t
Oki, will try entryUuid
n
No, that's different
That'll give you the UUID of the current entry
It's not about groups
If the query is centered on the user (which it seems to be), you want memberOf
t
Maybe modify this URL?
Copy code
AuthLDAPURL "ldap://localhost:3890/dc=example,dc=com??sub?(objectClass=person)"
n
Sure, you can add in the filter memberOf=cn=... In there
Then you don't need the groups section
t
Yes filter is in ()
n
(the common syntax is 
(&(filter1)(filter2))
But you'll probably have to escape the "&"
since it's in a URL
t
Okaaay, will try that, that might be the exact problem. 😄 Let me try
(memberof=CN=YourGroup,OU=Users,DC=YourDomain,DC=com))
Do I need also Ou,dc,dc again?
n
Ou groups
But yes
t
Hmm, it returns true
Okay it seems that Apache needs to verify it 😦
LLDAP has still no log though
I just hope it doesn't need apache module for lldap :/ Otherwise my trying is useless.
n
I'm still skeptical that lldap has no logs: if you restart LLDAP, then try to log in via httpd then you stop LLDAP, can you send all the logs you get?
If you're worried about privacy, you can send me the logs privately
PreviousNext
Powered by