https://github.com/lldap/lldap logo
Powered by
Alex - Hi all, I'm running LLDAP in an Inucs co...
# troubleshooting
a
Hi all, I'm running LLDAP in an Inucs container, on Alpine 3.21. I have it all set up and running. I'm trying to use it to password-authenticate users on a separate container. I have my 
/etc/nslcd.conf
adapted from the sample PAM configuration in the repo, and nscd running on the same box. I'm running 
nslcd -d
in the foreground to see logs. I can query lldap on the seperate container with commands like 
id
and 
getent
, but actually trying to log in keeps giving me "password denied". Even double- and tripple- checking that my password is right. I tried changing passwords to remove all symbols, same thing. Is there something special I have to do to set up passwords?
/etc/nslcd.conf
Copy code
# /etc/nslcd.conf
# nslcd configuration file. See nslcd.conf(5)
# for details.

# The user and group nslcd should run as.
uid nslcd
gid nslcd

# The location at which the LDAP server(s) should be reachable.
uri ldap://10.x.x.x:3890/

# The search base that will be used for all queries.
base dc=auth,dc=example,dc=com

# The LDAP protocol version to use.
#ldap_version 3

# The DN to bind with for normal lookups.
binddn cn=system_nss,ou=people,dc=auth,dc=example,dc=com
bindpw xxpasswordherexx

# The DN used for password modifications by root.
#rootpwmoddn cn=admin,dc=example,dc=com

# SSL options
#ssl off
tls_reqcert demand
tls_cacertfile /etc/cert-ldap.auth.example.com.cert

# The search scope.
#scope sub

reconnect_invalidate passwd group
nss_initgroups_ignoreusers ALLLOCAL

# Do you have users/groups that aren't for linux?  These filters determine which user/group objects are used.
filter passwd (&(objectClass=posixAccount)(uid=*))
filter group (&(objectClass=groupOfUniqueNames)(unix-gid=*))

# This check is done AFTER authentication, in the pam "account" stage.
# Regardless of if they used a LDAP password, or an SSH key, if they're an LDAP user, they have to pass this check.
pam_authz_search (&(objectClass=posixAccount)(unix-uid=*)(uid=$username)(memberOf=cn=ssh-users,ou=groups,dc=auth,dc=example,dc=com))


map passwd uid uid
map passwd uidNumber unix-uid
map passwd gidNumber unix-gid
map passwd gecos uid
map passwd homeDirectory "/home/git"
map passwd loginShell unix-shell

map group gidNumber unix-gid
map group memberUid member

nss_min_uid 1000

pam_password_prohibit_message "Please use the forgot password link on https://lldap.example.com/ to change your password."
n
Just checking, can you log in as that user directly on LLDAP?
a
Yes, I can on the web interface!
/etc/nsswitch.conf
Copy code
# musl itself does not support NSS, however some third-party DNS
# implementations use the nsswitch.conf file to determine what
# policy to follow.
# Editing this file is not recommended.
hosts: files dns
passwd: ldap
group: ldap
shadow: ldap
n
What do you get on the (verbose) LLDAP logs?
(also note: your filter passwd should have 
unix-uid=*
not 
uid=*
)
a
I don't see a verbose option in 
target/release/lldap --help
, is it a config somewhere?
n
--verbose should be there
Otherwise, LLDAP_VERBOSE=true
(and also: your users have the unix-uid attribute, and your groups the unix-gid attribute, right?)
a
I've set a 
unix-uid
attribute on users, and a 
unix-gid
attribute on both users and groups (at the moment), and manually set them to the same thing.
n
Are these the only messages you get when you do su?
It looks like nslcd queried for the user, and found it
But I don't see a login attempt
a
There's a couple at the top about setting up the server and configuration, but yeah, I don't see any more messages when I submit the password.
I figured it's pulling some sort of hash in the query user, no?
n
That's weird
Nope
Not possible, we don't have a hash to give it
FYI, I don't know what's wrong, I've never actually set up nscld myself. But I can tell you that it's not LLDAP refusing the password, it doesn't receive it
a
Alright, woke up today with fresh eyes. The original problem was that su[do] wasn't actually trying to use ldap! It would query ldap for the user but when doing the password check it was checking the local shadow file. After setting that up correctly, I now see something happen in lldap when I enter the password:
Copy code
2025-01-30T20:33:55.494423365+00:00  INFO     LDAP request [ 1.48ms | 0.00% / 100.00% ] session_id: 1d3f58fe-59af-4694-8b63-b897c2944f94
"  DEBUG    ┝━ 🐛 [debug]:  | msg: LdapMsg { msgid: 3, op: SearchRequest(LdapSearchRequest { base: "dc=auth,dc=example,dc=com", scope: Subtree, aliases: Never, sizelimit: 0, timelimit: 0, typesonly: false, filter: And([Equality("objectClass", "shadowAccount"), Equality("uid", "user")]), attrs: ["shadowFlag", "shadowMax", "shadowMin", "shadowLastChange", "uid", "shadowExpire", "shadowInactive", "shadowWarning"] }), ctrl: [] }
"  DEBUG    ┝━ do_search [ 1.48ms | 23.93% / 100.00% ]
"  DEBUG    │  ┝━ 🐛 [debug]:  | request.base: "dc=auth,dc=example,dc=com" | scope: Global
"  DEBUG    │  ┝━ get_user_list [ 410µs | 0.00% / 27.64% ]
"  DEBUG    │  │  ┝━ 🐛 [debug]:  | filters: And([Not(And([])), UserId("user")])
"  DEBUG    │  │  ┕━ list_users [ 410µs | 27.64% ] filters: Some(And([Not(And([])), UserId("user")])) | _get_groups: false
"  DEBUG    │  │     ┕━ 🐛 [debug]:  | return: []
"  DEBUG    │  ┕━ get_groups_list [ 718µs | 0.13% / 48.43% ]
"  DEBUG    │     ┝━ 🐛 [debug]:  | filters: And([Not(And([])), DisplayName("user")])
"  DEBUG    │     ┕━ list_groups [ 716µs | 48.30% ] filters: Some(And([Not(And([])), DisplayName("user")]))
"  DEBUG    │        ┕━ 🐛 [debug]:  | return: []
"  DEBUG    ┕━ 🐛 [debug]:  | response: SearchResultDone(LdapResult { code: Success, matcheddn: "", message: "", referral: [] })
I read this as it's looking for a 
shadowAccount
objectclass on the user (that I don't have set). I can't figure out where to add it in the web UI
n
I think there's a WIP PR that adds the button in the UI, unless it already landed in latest. You can add the class using lldap-cli
PreviousNext
Powered by