rkj - very beginner question (no ldap experienc...
# troubleshootingr
rkj
09/16/2024, 4:37 PMvery beginner question (no ldap experience) - I've just installed lldap, I can query it, add my user in web UI, very cool, thank you! Now I wanted to add authentication to linux server and I'm terribly lost. I've tried to follow example_configs/pam/README.md, added the config files, I think it does query the ldap (I see the requests in lldap logs), but I don't know how to add is-unix-user attribute. I asked chatgpt, it proposed to use ldapmodify with ldaf, but I guess something is not right with the ldif file it proposed... should I go read about this more or is this a dead end?
I've also just found lldap-cli, which looks much more user friendly, sadly when trying something like this I get error:
Copy code
$ /lldap-cli schema attribute user add is-unix-user integer
ERROR: Unknown type \AttributeType\
Unknown field \addUserAttribute\ on type \Mutation\a
Answer Overflow
09/16/2024, 4:37 PMmessage has been deleted
r
rkj
09/16/2024, 4:47 PMexample from lldap-cli help fails similarly:
Copy code
./lldap-cli schema attribute user add mailAlias string -l -v
ERROR: Unknown type \AttributeType\
Unknown field \addUserAttribute\ on type \Mutation\./lldap-cli group add unix-usern
nitnelave
09/16/2024, 5:07 PMYeah, I guess LLDAP custom attributes were not around when ChatGPT was trained 😄
Any old LDAP tool is unlikely to work: LLDAP was made with user convenience in mind, and the LDAP tools are, by and large, not user-friendly (unless you know a lot about LDAP, but that's not the point of LLDAP)
nitnelave
09/16/2024, 5:07 PMUsually, I would say "use the frontend", but as you have discovered, custom attributes are not well supported.
nitnelave
09/16/2024, 5:08 PMLldap-cli should work, and the command you ran looks fine. I'm not the maintainer of the cli though, so it's probably worth creating an issue on their repo
nitnelave
09/16/2024, 5:09 PMThankfully, there's at least some support in the web UI, so you should be able to create the attribute schemas in the UI
nitnelave
09/16/2024, 5:09 PMYou won't be able to populate them (yet) through the UI, though. Lldap-cli should get you the rest of the way
nitnelave
09/16/2024, 5:11 PMAs for the specific use case, rather than have a "is-unix-user" attribute, you can instead check for the presence of a unix attribute that you set
nitnelave
09/16/2024, 5:11 PMIt wasn't implemented at the time of writing the guide, so it may need a small update
nitnelave
09/16/2024, 5:12 PMEssentially, if you create a "unix-uid" or similar attribute, you can use
(unix-uid=*)nitnelave
09/16/2024, 5:12 PMAssuming you have a recent nightly (a september one)
r
rkj
09/16/2024, 5:12 PMoh, I didn't find the way in UI to add me, let me try again! I think I should be able to figure our the filter
rkj
09/16/2024, 5:13 PMI'm using lldap/lldap:stable
rkj
09/16/2024, 5:13 PMI can try nightly in the evening
rkj
09/16/2024, 5:13 PMthanks a lot for help and working on this awesome project 🙂
n
nitnelave
09/16/2024, 5:13 PMOh, that actually explains everything!
nitnelave
09/16/2024, 5:13 PMCustom attributes are not in stable
r
rkj
09/16/2024, 5:13 PM😄
rkj
09/16/2024, 5:13 PMoh, easy fix then
n
nitnelave
09/16/2024, 5:13 PMSo no need to raise an issue with lldap-cli
r
rkj
09/16/2024, 5:13 PMis it fine to send pull request with documentation update?
n
nitnelave
09/16/2024, 5:14 PM(they're not in stable because of the lack of web UI)
nitnelave
09/16/2024, 5:14 PMDefinitely! That would be appreciated
2 Views