https://github.com/lldap/lldap logo
Powered by
MagicTrevor - I have an issue anytime I restart...
# troubleshooting
n
Hey! I'll need a few more details: what's your lldap version? How do you set the private/server key? A file or a seed? If it's a file, do you persist the folder?
m
I’m using 0.5.0, yes using the file persisted in a data directory mounted to the container.
n
And the DB? SQLite as default?
Can you make sure that the file exists and is not modified? If you change the name in the config, does it get recreated?
m
no using mariadb as the backend (also persisted)
the file was last modified 2023-10-19 so been a month
n
And if the change the file path in the config, it creates a new one?
(trying to see if it actually reads that file)
m
Yeah just changed the name and restarted the container and now I have a new file alongside the old
n
Okay good, you can revert and delete the new file
🤔
And if you do a password reset, can you log in?
(same thing after a restart)
m
like now once I logged out of lldap web ui, it now says admin has an invalid username or password
n
Can you do a password reset?
m
I can't get it to send me any email link
n
Did you configure it for email reset? With SMTP?
And did it ever work?
m
No I normally do resets via Authelia, which won't work due to the password verification issue. Using the same settings in LLDAP for resets and nothing seems to happen (changing the config and restarting the container)
n
Well, that's a different issue, probably some configuration error
m
But before I would still be logged in when this would happen, and if I just changed the password to the same one it should be using "modify password" on the user screen, that would fix it
n
Is it possible that you have the wrong password?
m
Nope, I have it saved in my password manager to make sure I have the right one 😛
n
Good, that's one less source of errors
Hmm, so can you log in at all right now?
m
I cannot
n
What about with other users?
m
They can't either
n
That's strange. When you start LLDAP in verbose mode, you get your config printed at the top. Can you post that and the beginning of the logs?
m
hmm I switched to verbose=true and restarted it, but I don't see anything printed
except that it was loading the config from /data/lldap_config.toml
n
Then it's not reading the config you are changing
Which is why the password reset didn't work, probably
Or you have an env variable setting verbose to false?
m
I tried it again and this time at the top it said Copying the default config to /data/lldap_config.toml... but I am mounting a volume over /data
n
Something wrong with the mount?
It would explain the private key being wrong
m
Might be right... i have the UID/GID env variables set to 1000, but in the container the user that owns /data is lldap, outside of the container the folder that is mounted to /data is owned by 1000
Which would also explain smtp not working too
Looks like root can see the mounted config and private_key, however the lldap user cannot. lldap is id 1000 which matches the mount permissions
Do you know what the directory permissions should be? I got it to see/read the /data directory using chmod 777, which obviously is not ideal.
n
If you get into the container as the lldap user and you "touch" a file, what are the uid/gid from outside?
That should be what's needed
(also check that the lldap process is running as the lldap user)
m
it comes up with my username on the host (1000) which is what I expect and set to -rw-r--r--
the process is running as lldap which has id of 1000
n
Hmm, anything I can do to help? LLDAP doesn't do anything specific with permissions. Although actually, the starter script does
How do you configure the uid in docker?
m
Just setting the environment variables as shown as part of the official image
n
Can you send me your docker compose snippet or similar?
(geez, typing "docker" on a phone by sliding the finger is such a minefield)
m
Copy code
lldap:
    image: lldap/lldap:stable
    ports:
      - "3890:3890"
      - "17170:17170"
    volumes:
      - "/mnt/container-data/lldap/data:/data"
    environment:
      - UID=1000
      - GID=1000
      - LLDAP_JWT_SECRET_FILE=/run/secrets/JWT_SECRET
      - LLDAP_LDAP_USER_PASS_FILE=/run/secrets/LDAP_USER_PASS
      - LLDAP_LDAP_BASE_DN=dc=theallenfamily,dc=cloud
      - LLDAP_DATABASE_URL_FILE=/run/secrets/LDAP_DB_URL
n
Seems innocent enough
And when you start LLDAP, does it always try to copy the default config?
m
No it was always saying it was loading it.
n
And now?
Still the case?
(just checking that since you mentioned it)
m
Yeah now it is actually loading the mounted one as expected and is verbose and all that. Changed from chmod 777 (which originally got it working) to 755 at least and is still reading it.
n
Alright, so if you log into the container as the lldap user and you create a file, that should be the permissions/uid you need
By the way, does logging into LLDAP work now?
m
No, I had to remove the admin from the db so the container would recreate it so I could get back in, then had to modify the passwords for the ones I have saved back to what was expected unfortunately, but if it wasn't loading the expected config/key then it could of been recreating the key each time the container was restarted? (or if it did mount the directory but didn't think it had permissions)?
n
I think if it wasn't reading the config, it wasn't reading the key
And then creating one in memory and failing (?) to write it to a file?
I'm thinking of deprecating the file for new installations
Never had any issue with the seed instead
m
I was thinking of using the seed haha
assuming it can read the config
can the seed be from a docker secret? is it just prepended FILE__LLDAP_KEY_SEED ?
n
Append, but yes
That's the original purpose of the seed actually: make the config stateless and configurable with secrets
LLDAP_KEY_SEED_FILE
m
Sweet, looks like it sees it so I’ll run it this way for a while and see if it’s more stable. Appreciate the help!
n
My pleasure!
PreviousNext
Powered by