https://github.com/lldap/lldap logo
Powered by
alessandro.txt - Hi, I've been trying to log in...
# troubleshooting
a
Hi, I've been trying to log in to lldap for more than an hour now. Whatever I do, I get the message
Copy code
Invalid username or password
. I've tried setting the password in the docker compose file, changing user and password in the config file, using the supposed defaults... nothing. I'm going crazy. The only info I get from debug logs is this:
Copy code
2023-11-16T04:08:16.349608024+00:00  DEBUG    HTTP request [ 11.0ms | 25.99% / 100.00% ] method: "POST" | uri: "/auth/opaque/login/start"
2023-11-16T04:08:16.352401631+00:00  DEBUG    ┝━ opaque_login_start [ 8.14ms | 0.28% / 74.01% ]
2023-11-16T04:08:16.352429215+00:00  DEBUG    │  ┕━ login_start [ 8.11ms | 13.14% / 73.73% ]
2023-11-16T04:08:16.352446476+00:00  DEBUG    │     ┕━ get_password_file_for_user [ 6.66ms | 60.59% ] user_id: UserId("admin")
2023-11-16T04:08:16.361195198+00:00  DEBUG    ┕━ 🐛 [debug]:  | status_code: 200
f
What's the exact ldap command you are running?
Or is this the webui?
a
It's the webui, I just want to login for the first time
f
okay, I don't know as much about that side, so I'll leave it for the more experienced people to answer 🙂
n
Hey, let's get to the bottom of this
First things first: when you start LLDAP in verbose mode, you see the config printed at the top. Can you see some changes from the defaults that you set?
I.e. if you change the base DN for instance, do you see it printed there?
(this is to make sure we're modifying the right file)
a
Oh, I didn't notice it printing the config. Yes, base DN is set correctly to the one I changed in the config file
n
Good
Alright, next up: how do you set the private key? With a file (the default ) or with a seed?
If you don't know, it's with a file
a
Uhm, I didn't set anything manually there
The file path is set in the config, but I didn't change anything there
n
Okay. Did you set up persistence for the /data folder?
a
Yes
n
Can you check that there's a server_key file there?
a
The file's there, but I can't access it through my server's GUI, I'll check in the terminal
n
Don't try to print it
If it's there that's enough for me
a
okay
n
Alright, next up: set a username/password in the config for the admin
Then delete the DB and restart LLDAP
(I assume the DB is empty)
a
yes, the db is empty
okay, I'd already set a password, so I can just delete the db? or should I change it to sth else
n
(and just checking, you're using the default SQLite db?)
Yeah, just delete the DB, it'll be recreated
a
Yes, as in I didn't configure anything else or uncomment that in the config
Also, the password goes as a string into the brackets, right? I don't know anything about toml files
n
Yeah, as a string
Like the admin username
a
I just restarted, I'm getting some warnings in the logs now, which I didn't get before
n
There's probably some things about migrating the db
a
yeah
n
And creating the default users and groups
That's expected
a
yeah, I also get the warning that it couldn't find an admin user though
oh perfect, it worked now!
Do you have an idea what caused the issue?
n
Nice!
That's expected, it needs to create it on first startup
Maybe you created the user, then changed the password in the config. That password is only read when initially creating the user
So the user was created with the default password and you couldn't log in
(just a guess)
a
On the first try to login not, but on subsequent tries I did, yeah
But the weird thing is, I tried setting up everything anew multiple times, using different passwords in the docker compose file or config and nothing had worked
n
Huh, then I don't know
a
I had tried deleting all content in the data folder as well, and restarting
n
Apart from things like a quote in the password, maybe?
a
yeah, on the second tries I only generated password strings with letters and numbers
Should I leave a password in the docker-compose file still?
n
It's not going to be read
a
Or can I leave that variable out, as the password is set in the config file?
n
The env overrides the config file, but you can set it in either place
a
Oh, so it prioritizes the existing config? That was something which confused me when setting it up
Maybe it could be added to the documentation 🙂
n
And anyway, that password isn't used anymore, now that the user exists
What do you mean, "the existing config"?
a
Perfect, that's good to know 😄
i meant the config file, as in config in the persisting volume, sorry
n
The environment variables are the priority
(well, technically you can also override them with CLI flags, but yeah)
a
the environment variables in the docker compose??
n
Yep
It goes: CLI flags Env variables Config file Default config
a
Ooohhh okay, sorry I misread on of your messages above
n
You can see the actual configuration used because it gets printed out in the logs in verbose mode
(well, except for the secrets)
a
Okay, so if I wanted to change my admin password I best change it in my docker compose file as well, for when I set up the compose stack up anew?
n
it's either or
If you set it in one place you don't need to set it in the other
Some people like to have their secrets in env variables
Or even in secret files that are pointed by env variables
a
Oh okay. So if I changed my admin user in the Web-UI, I could still override it with the docker-compose file?
I guess I'd best just delete the env variables in docker compose, and just change the values in the config file or web-UI, right?
n
As long as there is an admin (any user with admin rights), it's not going to recreate one
So just do your thing on the web ui, and forget about the config (for the admin)
(the admin username and password are only used on first start, when creating the db)
a
okay, perfect. but I'm fine deleting
Copy code
LLDAP_LDAP_USER_PASS
from the docker-compose file, right? As that might 'reset' the password, if I understand correctly? As I'm not specifying the user the password is for. As I'll probably expose lldap to the internet in some way, I'd rather like to get rid of the default "admin" user
n
Again, that's only used on first start
So you can create another user, grant them admin rights, log in as them, and delete the "admin" user
a
oh okay, I guess this message confused me. Thinking it would always check for Env variables through docker-compose. Sorry
Thank you so much for the support and lldap!!
n
My pleasure!
a
How are you so quick in responding to these issues? That's crazy. Thanks a lot for the help and all the best!
n
I'm up right now because my baby is not sleeping well :p
a
Oh, sorry to hear that... Congratulations on your child! Wish you and your family all the best. Hope you get some sleep at some point 🙂
n
Thanks! It's getting better 🙂
PreviousNext
Powered by