https://github.com/lldap/lldap logo
Powered by
ishan jain - Hi, I am upgrading from lldap 0.4....
# troubleshooting
i
Hi, I am upgrading from lldap 0.4.3 to 0.5. Before upgrading, I had a common email for 
admin
account and the account 
ishan
. I changed admin account email to a different one. This was all done on lldap 0.4.3 then I upgraded to lldap 0.5 and now, none of the users can login. lldap logs are at the pastebin here, https://paste.debian.net/plain/1297725
Copy code
Nov 10 03:32:00 lldap lldap[401]: 2023-11-09T22:02:00.050355694+00:00  ERROR       │     │  ┕━ :rotating_light: [error]:  | error: Authentication protocol error for `Protocol error: `This error results from an error during password verification
n
That's not good. I haven't had anyone so far with problems after updating to 0.5, so let's have a look
One thing I see is that in your logs, the ldap-editor logs in successfully
So it seems the private key is still okay, and checking passwords works
Have you changed your password recently?
i
No, I have not changed password for any user
n
What if you create a new user ? Is the password working?
i
Checking
n
Ah, can you login as admin actually? Or do you have an admin session still logged in?
i
Yes! A new user works or I can modify password of an existing user and then login with the new password. (new password can be the same as the old password)
n
Also, can you log in through the web interface?
i
I was not able to login to it after upgrading so I had to roll it all back (the ldap container and db) Then on second try, I logged in on 0.4.3 and that session continued after upgrading to 0.5
n
Did you change/reset the ldap-editor password?
i
I did, It was not working before resetting password
n
Ah, that explains why it's working
Hmmm
How do you set the private key? Is it a file, a seed?
Do you have a single container or a HA setup?
i
It's a seed
ldap is a single container
n
And you didn't change the seed, right?
i
Full config looks like this, https://paste.debian.net/1297727/ I had set 
key_seed
.
I didn't change seed
n
That's weird
There's nothing special about the admin
Do you still have the 0.4.3 DB?
i
I can roll back to it, Don't have a separate copy to test side by side
n
Could you compare the dump of a user for which you didn't change the password?
i
Sure, let me try this out
n
(I doubt it's the case, but there could be a problem in the schema upgrade queries for PG)
i
I am using postgresql 15.2 as the database
n
And this is a user where you cannot log in after 0.5?
But you can with 0.4.3
i
Yess, This was the admin user. I can login now on 0.4.3 and couldn't login on 0.5
n
And you're logging in with the admin username
i
Yes
n
Can you log in with the web interface?
Directly with LLDAP I mean
i
I can not login to lldap's web interface as admin user. please see this
n
Ah yeah, sorry
Just making sure
I'm still trying to understand where the issue comes from
Feeling the edges of the problem
I'm guessing that a password that long is in a password manager?
i
Correct
n
So there's no typo possible
i
yep
n
If you start LLDAP in verbose mode (for both versions) it prints the config that it read
Including the environment variables and everything
Can you confirm that both show that there's a seed? (Something like key_seed: Some(*))
i
This is weird, with 0.4.3 I don't see 
key_seed
any where https://paste.debian.net/plain/1297729
n
Ah! We're on to something 🙂
i
I set 
key_seed
in config.toml, 
LLDAP_KEY_SEED
is empty
n
Maybe the seed was implemented after 0.4
i
Can I put contents of 
key_seed
in a file, point 
key_file
to it? Is the private key and seed the same thing or some thing different
Looks like it might be different
n
Hmm, it should be possible to get the key generated by a seed to go from seed to file
But in your case, you want to go from file to seed
That's not possible
You have a private key in the file
If you remove the seed from the config, you'll be able to log in
With 0.5
i
I see a 
server_key
file in the folder. I guess it's this file it is referring to. I'll upgrade to 0.5, comment 
key_seed
config and uncomment 
key_file
n
Maybe I should put a warning on startup: if I see a file with a valid private key and the config contains a key seed, warn about migration issues. Do you think you could open an issue for that?
i
And it works perfectly! I can login on the lldap dashboard and I can login in other apps. Thank you!
n
(in your case, the key_file defaulted to server_key, that's why it created that file)
i
Sure!
PreviousNext
Powered by