https://github.com/lldap/lldap logo
Powered by
paaradiso - i'm trying to get lldap working wit...
# troubleshooting
p
i'm trying to get lldap working with stalwart, but it says "incorrect username or password". more details in the thread
a
message has been deleted
p
oh wait
the bind auth dn had the wrong dc - i fixed that (changed org to com) and now i'm getting "unauthorized"
i'm testing it with a new user in the "mail" group
stalwart and lldap logs don't say anything
here is the text configuration:
Copy code
toml
directory.lldap.attributes.class = "objectClass"
directory.lldap.attributes.description = "displayName"
directory.lldap.attributes.email = "mail"
directory.lldap.attributes.groups = "memberOf"
directory.lldap.attributes.name = "uid"
directory.lldap.attributes.secret-changed = "pwdChangeTime"
directory.lldap.base-dn = "dc=X,dc=com"
directory.lldap.bind.auth.dn = "uid=?,ou=people,dc=X,dc=com"
directory.lldap.bind.auth.enable = true
directory.lldap.bind.auth.search = true
directory.lldap.bind.dn = "uid=stalwart_bind_user,ou=people,dc=X,dc=com"
directory.lldap.bind.secret = ""
directory.lldap.cache.size = 1048576
directory.lldap.cache.ttl.negative = "10m"
directory.lldap.cache.ttl.positive = "1h"
directory.lldap.filter.email = "(&(objectclass=person)(mail=?))"
directory.lldap.filter.name = "(&(objectclass=person)(uid=?))"
directory.lldap.timeout = "30s"
directory.lldap.tls.allow-invalid-certs = true
directory.lldap.tls.enable = false
directory.lldap.type = "ldap"
directory.lldap.url = "ldap://systemd-lldap:3890"
it knows the password is right - entering the wrong password says "invalid username or password" but entering the right password says "unauthorized"
n
Can you enable verbose logging in LLDAP and share the logs of the connection attempt?
p
sure
n
It sounds like it's searching the users and expecting a group, but doesn't get it
p
i also tried this:```toml directory.lldap.attributes.class = "objectClass" directory.lldap.attributes.description = "displayName" directory.lldap.attributes.email = "mail" directory.lldap.attributes.groups = "member" directory.lldap.attributes.name = "uid" directory.lldap.attributes.secret = "dummyStalwartSecret" directory.lldap.base-dn = "dc=X,dc=com" directory.lldap.bind.dn = "uid=stalwart_bind_user,ou=people,dc=X,dc=com" directory.lldap.bind.secret = "" directory.lldap.bind.auth.dn = "uid=?,ou=people,dc=X,dc=com" directory.lldap.bind.auth.enable = true directory.lldap.bind.auth.search = true directory.lldap.filter.email = "(&(|(objectClass=person)(member=cn=mail,ou=groups,dc=X,dc=com))(mail=?))" directory.lldap.filter.name = "(&(|(objectClass=person)(member=cn=mail,ou=groups,dc=X,dc=com))(uid=?))" directory.lldap.cache.size = 1048576 directory.lldap.cache.ttl.negative = "10m" directory.lldap.cache.ttl.positive = "1h" directory.lldap.timeout = "30s" directory.lldap.tls.allow-invalid-certs = true directory.lldap.tls.enable = false directory.lldap.type = "ldap" directory.lldap.url = "ldap://systemd-lldap:3890"```the example config has 
bind.filter.{email,name}
as well as 
filter.{email,name}
but stalwart automatically removed 
bind.filter
so i tried using the 
bind.filter
as the regular 
filter
but it didn't work
here's the lldap log https://srcb.in/GisKYqwpZ6
it doesn't work with 
memberOf
either
e
Copy code
toml
[directory.internal]
store = "db"
type = "internal"

[directory.ldap]
base-dn = "dc=fricloud,dc=dk"
type = "ldap"
url = "ldap://localhost:3890"
[directory.ldap.attributes]
class = "objectClass"
description = "givenName"
email = "membermail"
groups = "memberOf"
name = "uid"
quota = "membermaildiskquota"

[directory.ldap.bind]
dn = "uid=bind_user,ou=people,dc=fricloud,dc=dk"
secret = "%{file:/run/agenix/lldap-bind-user-pass}%"
[directory.ldap.bind.auth]
dn = "cn=?,ou=people,dc=fricloud,dc=dk"
enable = true

[directory.ldap.filter]
email = "(&(|(memberof=cn=base_member,ou=groups,dc=fricloud,dc=dk)(memberof=cn=system_mail,ou=groups,dc=fricloud,dc=dk))(|(membermail=?)))"
name = "(&(|(memberof=cn=base_member,ou=groups,dc=fricloud,dc=dk)(memberof=cn=system_mail,ou=groups,dc=fricloud,dc=dk))(|(uid=?)))"
Is my config with stalwart. Unsure if you can use it for anything.
p
i'll check this out thanks
nix, nice
e
Yeah. Sadly you won't get too much out ef reading the nix files.. Maybe.. Because of the custom ldap functions https://git.fricloud.dk/fricloud/server-configs/src/branch/main/machines/gerd/services/stalwart/stalwart.nix#L34-L77
p
wait
stalwart is creating a user when i attempt to sign in?
but it's still saying unauthorized?
e
You have set 
storage.directory
, right?
p
yes
e
Then I'm all out of ideas 😄 I don't remember it being particular fun to setup. But it seems like the lldap part works, but something might be missing in the stalwart config
p
yeah 😅
e
The entire config is here - https://gist.github.com/eyJhb/45f5ce49a0e1b7aea618367801179fc4 if you want to compare the two
(the final config I should say)
p
thanks, hopefully i can figure this out
this is what stalwart says:``` May 25 18:59:14 containers systemd-stalwart[667487]: 2025-05-25T09:29:14Z ERROR Authentication error (auth.error) listenerId = "http", localPort = 8080, remoteIp = 10.1.1.101, remotePort = 48486, details = Authentication error (auth.error) { details = Account does not contain secrets, causedBy = crates/common/src/auth/oauth/token.rs:239, causedBy = crates/common/src/auth/oauth/token.rs:53 }, causedBy = crates/jmap/src/auth/oauth/token.rs:129 May 25 18:59:14 containers systemd-stalwart[667487]: 2025-05-25T09:29:14Z TRACE HTTP response body (http.response-body) listenerId = "http", localPort = 8080, remoteIp = 10.1.1.101, remotePort = 48486, contents = "{"type":"about:blank","status":401,"title":"Unauthorized","detail":"You have to authenticate first."}", code = 401, size = 101```
i'll figure this out later
it worked :\) i am very dumb
i forgot to create the secret user attribute
thanks for the help
n
😄
e
Stalwart is weird like that :p
PreviousNext
Powered by