https://github.com/lldap/lldap logo
Powered by
Installing LLDAP on Podman
# troubleshooting
c
Hey, I was following the documentation for deploying lldap with podman quadlets, everything was fine until I needed to uncomment those line in the 
lldap.container
for bootstraping
Copy code
Secret=lldap-ldap-user-pass,type=env,target=LLDAP_ADMIN_PASSWORD
Environment=LLDAP_URL=http://localhost:17170
Environment=LLDAP_ADMIN_USERNAME=charlotte
Environment=LLDAP_ADMIN_PASSWORD_FILE=/run/secrets/lldap-ldap-user-pass
Volume=%h/containers/lldap:/bootstrap:ro,Z
The journalctl log isn't very verbose
Copy code
Oct 07 12:10:41 ambassador lldap[1353508]: Error: statfs /root/containers/lldap: no such file or directory
Oct 07 12:10:41 ambassador podman[1353508]: 2025-10-07 12:10:41.126308099 +0200 CEST m=+0.077645171 image pull ef027edd800aa3e441c957f8bd39fa8dd472a1021e74c235e43b7c0b28d119be docker.io/lldap/lldap:stable-debian
Oct 07 12:10:41 ambassador systemd[1]: lldap.service: Main process exited, code=exited, status=125/n/a
Do you have a solution,
a
message has been deleted
c
I guess error 125 could tell us what is the issue, are the error code documented?
k
Volume=%h/containers/lldap:/bootstrap:ro,Z
does /root/containers/lldap exist on the host?
c
Hum non, I assumed it was created by the volume file?
k
It errors on that fact
c
Yea
I'll create an empty folder
k
> Now all that's left to do is the bootstrapping process: that is what the podman quadlet docs say
Prepare your bootstrapping config as for the docker-compose case in ~/containers/lldap.
which is basically this step
c
Ah yes
I skipped a step
Do I need to create a yaml file
k
I don't think you have to do anything docker compose related
Only set the env variables and then run the bootstrap script in the container
I think this should work:
Copy code
bash
$ podman exec -ti lldap bash
# In there, run this:
$ export LLDAP_URL=http://localhost:17170
$ export LLDAP_ADMIN_USERNAME=admin
$ export LLDAP_ADMIN_PASSWORD=changeme
$ export USER_CONFIGS_DIR=/bootstrap/user-configs
$ export GROUP_CONFIGS_DIR=/bootstrap/group-configs
$ export USER_SCHEMAS_DIR=/bootstrap/user-schemas
$ export GROUP_SCHEMAS_DIR=/bootstrap/group-schemas
$ export DO_CLEANUP=false
$ ./bootstrap.sh
I didn't test it but I think it should work
c
Thank you!
I will try this shortly I just have work to do for my mortgage agreement
k
All good, take your time :)
c
Huuuh...
Copy code
root@ff1b1b78ec55:/app# ./bootstrap.sh
parse error: Invalid numeric literal at line 1, column 16
How can the shebang has a numeral
Copy code
$ tac bootstrap.sh
#!/usr/bin/env bash
ah i kno
k
Env expansion?
c
I'm testing something
No it wasn't the port
I don't think it's env expansion I don't see anything problematic
and the pod doesn't have any editing tools
k
ChatGPT says it is caused by jq
c
in one of my vars?
k
I don't think so. Is the port 17170 listening? Maybe it can't reach it and the error response isn't parseable?
c
it answers to a curl
k
Weird
c
I concur
k
The env var is http for you, right?
c
Copy code
$ env
LLDAP_ADMIN_USERNAME=********
LLDAP_LDAP_USER_EMAIL=me@faefox.dev
PWD=/app
LLDAP_LDAP_USER_PASS_FILE=/run/secrets/lldap-ldap-user-pass
container=podman
HOME=/root
GOSU_VERSION=1.17
TERM=xterm
USER=lldap
LLDAP_DATABASE_URL=postgres://lldapuser:lldappass@lldap-db/lldap
GID=1000
LLDAP_URL=http://localhost:17170
USER_CONFIGS_DIR=/bootstrap/user-configs
SHLVL=1
USER_SCHEMAS_DIR=/bootstrap/user-schemas
GROUP_CONFIGS_DIR=/bootstrap/group-configs
LLDAP_KEY_SEED_FILE=/run/secrets/lldap-key-seed
LLDAP_LDAP_BASE_DN=dc=faefox,dc=dev
DO_CLEANUP=false
LLDAP_ADMIN_PASSWORD=********************
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
GROUP_SCHEMAS_DIR=/bootstrap/group-schemas
UID=1000
LLDAP_JWT_SECRET_FILE=/run/secrets/lldap-jwt-secret
_=/usr/bin/env
k
Did you set all configs?
c
I'll do it as soon as possible
I think that is the issue
Ok I have created the file but I have parsing errors, what does the schemas have to look like? Do I need to put every attributes?
k
I'd just follow the docs on that one. What exactly errors the api or the script?
c
It was just errors in the JSON my bad
but the script still throws the same error even with all the file and the right tree
which is weird
k
Hmm. Maybe try to run it with bash -x
c
ok
Authentification error for user Charlotte
k
That is it then I guess
The bootstrap script has to authenticate as well
Did you use the same password?
c
Yeah
but I might have made a typo
how do I remove the user
and recreate it?
k
Otherwise it is weird
I'd just delete the db. Or do it via the api if you have the password
c
Ok I'll stop for now I reset everything I am using the same password everywhere but it fails to auth
k
Weird. Maybe @nitnelave can help later on
c
Ok, thanks
really
n
Shot in the dark, but also best practice: try to use a key seed rather than a key file to encrypt the passwords
Nevermind, you already do
Can you try the steps for "I can't login" here? https://github.com/lldap/lldap/blob/main/docs%2Ffaq.md
c
Ok I solved the issue
it was a dumb issue
n
What was it? ๐Ÿ˜„
c
some password had the 
'
character and some didn't
so I deleted the db and restarted
n
Ah yes, classic!
c
now I have an issue with my groups
k
We have all been there xD
c
Copy code
--- groups ---
jq: error (at <stdin>:0): Cannot index array with string "name"
n
Maybe I should add a warning if a password starts and ends with a quote
(from env)
c
I'd like a working config of the tree because I feel like grasping at straws
n
If you start with --verbose (or any other way to enable verbose logs) you'll see the config as parsed
But I don't know where the jq error is coming from
k
I might be able to set up a podman quadlet setup myself and that might give some insight
c
when I do that
Copy code
82a4c807f2fd:/bootstrap# cat group-configs/config.json | jq
[
  {
    "id": 0,
    "name": "teachers"
  },
  {
    "id": 1,
    "name": "students"
  }
]
it works so
I switched to docker to see if it was the issue tbh
n
Is the group config supposed to be an array?
Or one file per group
c
It throws an error when it's not an array
n
Oh
c
I haven't tried one file per group
n
I'm not super familiar with bootstrap :/
c
Ok it works
It works finally
Ok now I need to navigate the cryptic thing that ldap is
is 
objectClass
the group I created? In jitsi I'm trying to have everyone who has group 
teachers
to be a moderator so I tried this as a filter
Copy code
LDAP_FILTER="(&(uid=%u)(objectClass=teachers))"
(from example_conf)
k
no, class is smth like 
person
or 
group
. Not a specific one.
c
ok
I changed it to
Copy code
LDAP_FILTER="(group~=teachers)"
But idk if it will work because group is an array
k
What do you mean it is an array? A person is in 2 groups at the same time? If so, that is perfectly fine.
c
ok thanks
k
I'd use memberof though.
smth like 
(&(uid=%s)(memberOf=cn=some_group_name,ou=groups,dc=example,dc=com))
c
if I try to login with 
user
it says that the login is incorrect and if I use 
user@example.com
it says 
[...] no-auth-mech
And I don't have logs for jitsi
the docker logs shows that there is a login attempt
k
the 
uid=
prevents you from logging in via email anyways (if you are doing that).
and user incorrect? I have no idea as to why that is
n
It's still on my to-do list to make an "LDAP for dummies" article that explains in simple terms what is a DC, OU, memberOf, and so on
c
It's so confusing
but the SASL doesn't work in the prosody container sooo
n
DC is domain, OU is a folder in which you can put anything, objectClass is (one of) the type of an entry (user or group as he said, but could also be OU)
Users are "memberOf" groups, and groups have "members" for users
c
I looked up a tutorial
what is frustrating is the prosody container fails to connect to the LLDAP instance
n
I found that a lot of them are almost self-referential, where if you understand LDAP it makes perfect sense, otherwise it doesn't help :p
What errors are you getting?
c
authentification failed
n
So it connects fine but you can't log in?
Do you see the log in attempt in LLDAP logs?
c
Yes I see them
I purged the logs, tried to login and
Copy code
2025-10-09T10:18:32.127416409+00:00  INFO     ๏ฝ‰ [info]: LDAP session start: c33b07e7-b208-42ce-8acd-6cc5fda459fa
2025-10-09T10:18:32.127516602+00:00  INFO     LDAP request [ 221ยตs | 100.00% ] session_id: c33b07e7-b208-42ce-8acd-6cc5fda459fa
2025-10-09T10:18:32.128201029+00:00  INFO     ๏ฝ‰ [info]: LDAP session end: c33b07e7-b208-42ce-8acd-6cc5fda459fa
2025-10-09T10:18:36.863137194+00:00  INFO     LDAP request [ 9.21ยตs | 100.00% ] session_id: 9a914407-bd54-4e96-9608-2e38dedcc9a8
2025-10-09T10:18:36.863219348+00:00  INFO     ๏ฝ‰ [info]: LDAP session end: 9a914407-bd54-4e96-9608-2e38dedcc9a8
2025-10-09T10:18:36.863906082+00:00  INFO     ๏ฝ‰ [info]: LDAP session start: fee2b37b-23ec-4696-89ac-601be26792e7
2025-10-09T10:18:36.863975169+00:00  INFO     LDAP request [ 193ยตs | 100.00% ] session_id: fee2b37b-23ec-4696-89ac-601be26792e7
2025-10-09T10:18:36.864889337+00:00  INFO     LDAP request [ 3.71ยตs | 100.00% ] session_id: fee2b37b-23ec-4696-89ac-601be26792e7
2025-10-09T10:18:36.864930433+00:00  INFO     ๏ฝ‰ [info]: LDAP session end: fee2b37b-23ec-4696-89ac-601be26792e7
2025-10-09T10:18:36.865914525+00:00  INFO     ๏ฝ‰ [info]: LDAP session start: cad335f4-62fa-44ac-9013-93a30c5e06ad
2025-10-09T10:18:36.866067225+00:00  INFO     LDAP request [ 140ยตs | 100.00% ] session_id: cad335f4-62fa-44ac-9013-93a30c5e06ad
n
Can you enable verbose logging in LLDAP? It would really help
c
How do I do that?
n
LLDAP_VERBOSE=true
c
Ok
ah I see
Copy code
2025-10-09T10:24:02.379220556+00:00  DEBUG    โ”โ” ๐Ÿ› [debug]:  | msg: LdapMsg { msgid: 1, op: BindRequest(LdapBindRequest { dn: "uid=charlotte,OU=people,DC=tutorat,DC=me", cred: LdapBindCred::Simple }), ctrl: [] }
2025-10-09T10:24:02.379226879+00:00  DEBUG    โ”โ” do_bind [ 307ms | 0.13% / 99.89% ] dn: uid=charlotte,OU=people,DC=tutorat,DC=me
2025-10-09T10:24:02.379246719+00:00  DEBUG    โ”‚  โ”•โ” bind [ 307ms | 0.00% / 99.76% ]
2025-10-09T10:24:02.379301559+00:00  DEBUG    โ”‚     โ”โ” get_password_file_for_user [ 877ยตs | 0.29% ] user_id: "charlotte"
2025-10-09T10:24:02.380468354+00:00  INFO     โ”‚     โ”โ” ๏ฝ‰ [info]: Login attempt for "charlotte"
2025-10-09T10:24:02.380472897+00:00  DEBUG    โ”‚     โ”โ” passwords_match [ 306ms | 99.47% ] username: charlotte
2025-10-09T10:24:02.686234363+00:00  ERROR    โ”‚     โ”‚  โ”•โ” ๐Ÿšจ [error]:  | error: Authentication protocol error for `Protocol error: `This error results from an error during password verification``
2025-10-09T10:24:02.686262573+00:00  ERROR    โ”‚     โ”•โ” ๐Ÿšจ [error]:  | error: Authentication error for user "charlotte"
2
It's a password error but I tried every variation maybe it's the escape characters it doesn't like
n
I assume you can log in on the web UI of LLDAP?
As that user
c
yes
n
Huh, then the error is more on the client side, prosody. I can't really help with that
c
Ok
weirdly when I try the admin password without any fancy things just a passphrase it tell me it doesn't work when it clearly does in the logs
Thanks
I have a LDAP I can play with now
n
And you didn't have to mess around with LDIF!
c
Yeah
I think next thing is adding it to my forgejo
n
Bonne chance!
s
To the fellow traveler washed up on the shore of 
parse error: Invalid numeric literal at line 1, column 16
, might I present the following explanation: I modified bootstrap.sh to announce its functions. This error came from the 
auth()
function. Narrowing it down further, I found the TOKEN line trying to process a separate error as JSON -- Specifically:
Copy code
`Authentication error for user "admin"`
123456789012345
         111111
PreviousNext
Powered by