https://github.com/lldap/lldap logo
Powered by
Princemurphy - Hey folks. I followed the exampl...
# troubleshooting
p
Hey folks. I followed the example guide for Homeassistant, however i'm getting an error.
Copy code
Auth failed
homeassistant  | 2024-04-14 20:29:25.628 ERROR (MainThread) [homeassistant.auth.providers.command_line] User 'bmurphy88' failed to authenticate, command exited with code 1
Can someone help me get it working? Running Homeassistant in a Docker container.
n
It would help to have the LLDAP verbose logs
p
This is all I'm getting:
Copy code
2024-04-14T22:43:41.343115250+00:00  INFO     ｉ [info]: DB Cleanup Cron started
2024-04-14T22:44:11.385252477+00:00  INFO     LDAP session [ 134µs | 48.94% / 100.00% ]
2024-04-14T22:44:11.385329582+00:00  INFO     ┕━ LDAP request [ 68.6µs | 51.06% ]
2024-04-14T22:44:41.448954929+00:00  INFO     LDAP session [ 134µs | 57.17% / 100.00% ]
2024-04-14T22:44:41.449016868+00:00  INFO     ┕━ LDAP request [ 57.5µs | 42.83% ]
2024-04-14T22:45:11.512504399+00:00  INFO     LDAP session [ 121µs | 51.58% / 100.00% ]
2024-04-14T22:45:11.512551925+00:00  INFO     ┕━ LDAP request [ 58.7µs | 48.42% ]
2024-04-14T22:45:41.582221163+00:00  INFO     LDAP session [ 108µs | 49.23% / 100.00% ]
2024-04-14T22:45:41.582261030+00:00  INFO     ┕━ LDAP request [ 55.0µs | 50.77% ]
2024-04-14T22:46:11.647980397+00:00  INFO     LDAP session [ 103µs | 41.63% / 100.00% ]
2024-04-14T22:46:11.648012025+00:00  INFO     ┕━ LDAP request [ 60.1µs | 58.37% ]
2024-04-14T22:46:41.708995209+00:00  INFO     LDAP session [ 112µs | 46.36% / 100.00% ]
2024-04-14T22:46:41.709032244+00:00  INFO     ┕━ LDAP request [ 60.0µs | 53.64% ]
2024-04-14T22:47:11.794666113+00:00  INFO     LDAP session [ 149µs | 37.53% / 100.00% ]
2024-04-14T22:47:11.794713166+00:00  INFO     ┕━ LDAP request [ 92.8µs | 62.47% ]
2024-04-14T22:47:41.865688114+00:00  INFO     LDAP session [ 111µs | 46.91% / 100.00% ]
2024-04-14T22:47:41.865742191+00:00  INFO     ┕━ LDAP request [ 58.8µs | 53.09% ]
2024-04-14T22:48:11.934192616+00:00  INFO     LDAP session [ 93.3µs | 42.12% / 100.00% ]
2024-04-14T22:48:11.934300722+00:00  INFO     ┕━ LDAP request [ 54.0µs | 57.88% ]
2024-04-14T22:48:41.998917120+00:00  INFO     LDAP session [ 95.9µs | 45.12% / 100.00% ]
2024-04-14T22:48:41.998955282+00:00  INFO     ┕━ LDAP request [ 52.6µs | 54.88% ]
2024-04-14T22:49:12.070128406+00:00  INFO     LDAP session [ 105µs | 46.54% / 100.00% ]
Oops. I didn't have verbose logging enabled. Here's my log:
Copy code
2024-04-14T23:40:13.533103619+00:00  DEBUG       ┝━ 🐛 [debug]:  | response: SearchResultEntry(LdapSearchResultEntry { dn: "", attributes: [LdapPartialAttribute { atype: "objectClass", vals: ["top"] }, LdapPartialAttribute { atype: "vendorName", vals: ["LLDAP"] }, LdapPartialAttribute { atype: "vendorVersion", vals: ["lldap_0.5.0"] }, LdapPartialAttribute { atype: "supportedLDAPVersion", vals: ["3"] }, LdapPartialAttribute { atype: "supportedExtension", vals: ["1.3.6.1.4.1.4203.1.11.1"] }, LdapPartialAttribute { atype: "supportedControl", vals: [] }, LdapPartialAttribute { atype: "supportedFeatures", vals: ["1.3.6.1.4.1.4203.1.5.1"] }, LdapPartialAttribute { atype: "defaultNamingContext", vals: ["dc=lldap,dc=princemurphy,dc=net"] }, LdapPartialAttribute { atype: "namingContexts", vals: ["dc=lldap,dc=princemurphy,dc=net"] }, LdapPartialAttribute { atype: "isGlobalCatalogReady", vals: ["false"] }] })
2024-04-14T23:40:13.533131114+00:00  DEBUG       ┕━ 🐛 [debug]:  | response: SearchResultDone(LdapResult { code: Success, matcheddn: "", message: "", referral: [] })
2024-04-14T23:40:13.534101206+00:00  DEBUG    HTTP request [ 9.01µs | 100.00% ] method: "GET" | uri: "/health"
2024-04-14T23:40:13.534112126+00:00  DEBUG    ┕━ 🐛 [debug]:  | status_code: 200
n
That's not all the log (or you didn't try to log in after starting LLDAP?)
I don't see any log in queries in here
p
How do i post the complete thing here? Text file?
n
Hmm, the logs don't show anything weird: I see the admin logging in, then asking for your details, then logging in as you (to check the password), which succeeds.
That looks like a perfectly normal LLDAP session
The answer probably lies in home assistant
p
That was a sign in to Jellyfin. It appears to not add anything to the logs when I try to sign into HomeAssistant.
n
Ah
I only see a rootDSE request then
Basically asking the metadata of the server
Not trying to log in
What's your HA LDAP config?
p
n
Check the home assistant logs (or the script logs), but are you sure it can reach the LLDAP container? Is it in the same network?
p
Copy code
Logger: homeassistant.auth.providers.command_line
Source: auth/providers/command_line.py:84
First occurred: 6:08:33 AM (2 occurrences)
Last logged: 6:10:45 AM

User 'bmurphy88' failed to authenticate, command exited with code 1
I can sign in with Jellyfin. Jellyfin, lldap, and homeassistant are all on the same container.
Im sorry. all on the same network. not container
n
These logs don't really help. It seems the requests don't even reach LLDAP, so I don't know if I'll be of much help
p
I'll keep tinkering.
n
can you ping lldap from inside the HA container?
(also, maybe use the container name instead of the IP address?)
(it might be just a case of wrong IP address: docker gives different addresses for the same container depending on which network you're looking at)
p
what format do i use? ldap://container_name ?
I can ping lldap via ip:port inside the home assistant container
n
yeah, it should be 
ldap://container_name
, like 
ldap://lldap
p
So the error that home assistant is giving is directly related to the a line in the script.
Homeassistant is returning “Auth failed” message and exiting with code one.
n
Can you print RESPONSE when it fails?
p
n
I mean, modify the script to say 
log "Auth failed: $RESPONSE"
p
I modified the script. Still same message as above. Was I supposed to make changes to the script initially? If so, what? I never touched it.
n
The script should work as is (I think, I haven't written it). However, it's not the most helpful when it comes to errors...
In the logs with the new script, do you see "Auth failed" or "Auth failed: " (meaning that your changes are there but RESPONSE is empty)
p
Says Auth failed: (has the colon, but nothing after)
n
Sigh... That's why I love bash
maybe something like 
RESPONSE=$(curl -f -s -X POST -m "$TIMEOUT" -H "Content-type: application/json" -d '{"username":"'"$username"'","password":"'"$password"'"}' "$SERVER_URL/auth/simple/login" 2>/tmp/curl_err)
and then 
log "Auth failed: $(cat /tmp/curl_err)"
p
Same result. Auth failed:
n
Huh. What about on the line after RESPONSE=, you add 
RES=$?
And you print $RES after auth failed?
p
Not quite sure what you mean. here's what I put
Copy code
RESPONSE=$(curl -f -s -X POST -m "$TIMEOUT" -H "Content-type: application/json">
    log "Auth failed:$RESPONSE"
    exit 1
n
I wanted to get the return code of the curl. Maybe you can also print the curl command before running it, and try running it by hand from the HA container?
Copy code
sh
CMD="curl -f -s -X POST -m \"$TIMEOUT\" -H \"Content-type: application/json\" -d '{\"username\":\"'\"$username\"'\",\"password\":\"'\"$password\"'\"}' \"$SERVER_URL/auth/simple/login\""
log "Running: $CMD"
RESPONSE=$($CMD 2> /tmp/curl_err)
RES=$?
if [[ $RES -ne 0 ]]; then
    log "Auth failed, RES=$RES, OUT=[$RESPONSE], ERR=[$(cat /tmp/curl_err)]"
    exit 1
fi
p
Copy code
Auth failed, RES=2, OUT=[], ERR=[curl: option -m: expected a proper numerical parameter
homeassistant  | curl: try 'curl --help' or 'curl --manual' for more information]
n
And what was the command? The previous log line
p
log "Auth failed, RES=$RES, OUT=[$RESPONSE], ERR=[$(cat /tmp/curl_err)]"
n
No, I mean in the logs there should be the curl command
p
This is all I have
Copy code
homeassistant  | 2024-04-18 11:03:47.929 ERROR (MainThread) [homeassistant.auth.providers.command_line] User 'bmurphy88' failed to authenticate, command exited with code 1
homeassistant  | 2024-04-18 11:03:47.930 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from Murph-Laptop.princemurphy.net (192.168.20.101). Requested URL: '/auth/login_flow/eeead6d9b8636abd358c1bb812752605'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0)
n
The line above "Auth failed: RES=2,...", there should be a "Running: curl -f -s ..."
p
Sorry. I didn't see it initially
Copy code
Running: curl -f -s -X POST -m "3" -H "Content-type: application/json" -d '{"username":"'"redacted"'","password":"'"redacted"'"}' "ldap://192.168.20.7:3890/auth/simple/login"
n
Can you remove the (escaped) double quotes around TIMEOUT?
p
Copy code
homeassistant  | Running: curl -f -s -X POST -m "3" -H "Content-type: application/json" -d '{"username":"'"REDACTED"'","password":"'"REDACTED"'"}' "ldap://192.168.20.7:3890/auth/simple/login"
homeassistant  | Auth failed, RES=2, OUT=[], ERR=[curl: option -m: expected a proper numerical parameter
homeassistant  | curl: try 'curl --help' or 'curl --manual' for more information]
Maybe I should remove the quotes from “3”
n
Right, but the 3 comes from "$TIMEOUT" in the script
Or rather \"$TIMEOUT\" in my version with logging
p
I removed the quotes from $TIMEOUT. The response is the code above
n
Basically we should have a line that starts with
Copy code
homeassistant  | Running: curl -f -s -X POST -m 3
PreviousNext
Powered by