https://github.com/lldap/lldap logo
Powered by
First login issues
# troubleshooting
v
Hi, I am trying to setup lldap docker image. I was running it a while ago and forgot the admin password. could not retrive it so decided to purge all stull and start again. (docker compose down -v and backup the users.db file and delete it from /data location ) Now i did the whole process again and still can't login to default admin account. Can anyone please help me figure out what's wrong?
a
message has been deleted
v
Here are the logs: first setup logs:
Copy code
lldap  | > Setup permissions..
lldap  | > Starting lldap..
lldap  |
lldap  | Loading configuration from /data/lldap_config.toml
lldap  | WARNING: Unknown environment variable: LLDAP_LLDAP_GID
lldap  | WARNING: Unknown environment variable: LLDAP_LLDAP_UID
lldap  | WARNING: A key_seed was given, we will ignore the key_file and generate one from the seed! Set key_file to an empty string in the config to silence this message.
lldap  | 2025-12-05T07:56:44.685242827+00:00  INFO     set_up_server [ 4.06ms | 100.00% ]
lldap  | 2025-12-05T07:56:44.685257478+00:00  INFO     ┝━ ｉ [info]: Starting LLDAP version 0.6.2
lldap  | 2025-12-05T07:56:44.690481142+00:00  INFO     ┝━ ｉ [info]: Starting the LDAP server on port 3890
lldap  | 2025-12-05T07:56:44.690664764+00:00  INFO     ┕━ ｉ [info]: Starting the API/web server on port 17170
lldap  | 2025-12-05T07:56:44.690755234+00:00  INFO     ｉ [info]: starting 1 workers
lldap  | 2025-12-05T07:56:44.690760405+00:00  INFO     ｉ [info]: Actix runtime found; starting in Actix runtime
lldap  | 2025-12-05T07:56:44.690770136+00:00  INFO     ｉ [info]: starting service: "ldap", workers: 1, listening on: 0.0.0.0:3890
lldap  | 2025-12-05T07:56:44.690775225+00:00  INFO     ｉ [info]: starting service: "http", workers: 1, listening on: 0.0.0.0:17170
lldap  | 2025-12-05T07:56:44.692315734+00:00  INFO     ｉ [info]: DB Cleanup Cron started
lldap  | 2025-12-05T07:57:00.980628759+00:00  INFO     ｉ [info]: OPAQUE login attempt for "admin"
lldap  | 2025-12-05T07:57:01.801458117+00:00  INFO     ｉ [info]: OPAQUE login attempt for "admin"
lldap  | 2025-12-05T07:57:02.002003980+00:00  INFO     ｉ [info]: OPAQUE login attempt for "admin"
lldap  | 2025-12-05T07:57:14.773415424+00:00  INFO     ｉ [info]: LDAP session start: 5692a65f-1e08-4eb9-b441-55bcd8c82c6c
lldap  | 2025-12-05T07:57:14.773551782+00:00  INFO     LDAP request [ 133µs | 100.00% ] session_id: 5692a65f-1e08-4eb9-b441-55bcd8c82c6c
and so on
after commenting the
Copy code
ldap_user_pass = "password"
Copy code
lldap  | > Setup permissions..
lldap  | > Starting lldap..
lldap  |
lldap  | Loading configuration from /data/lldap_config.toml
lldap  | WARNING: Unknown environment variable: LLDAP_LLDAP_GID
lldap  | WARNING: Unknown environment variable: LLDAP_LLDAP_UID
lldap  | WARNING: A key_seed was given, we will ignore the key_file and generate one from the seed! Set key_file to an empty string in the config to silence this message.
lldap  | 2025-12-05T08:01:10.899950574+00:00  INFO     set_up_server [ 4.41ms | 100.00% ]
lldap  | 2025-12-05T08:01:10.899964673+00:00  INFO     ┝━ ｉ [info]: Starting LLDAP version 0.6.2
lldap  | 2025-12-05T08:01:10.905674750+00:00  INFO     ┝━ ｉ [info]: Starting the LDAP server on port 3890
lldap  | 2025-12-05T08:01:10.905851902+00:00  INFO     ┕━ ｉ [info]: Starting the API/web server on port 17170
lldap  | 2025-12-05T08:01:10.905942935+00:00  INFO     ｉ [info]: starting 1 workers
lldap  | 2025-12-05T08:01:10.905947649+00:00  INFO     ｉ [info]: Actix runtime found; starting in Actix runtime
lldap  | 2025-12-05T08:01:10.905956321+00:00  INFO     ｉ [info]: starting service: "ldap", workers: 1, listening on: 0.0.0.0:3890
lldap  | 2025-12-05T08:01:10.905960575+00:00  INFO     ｉ [info]: starting service: "http", workers: 1, listening on: 0.0.0.0:17170
lldap  | 2025-12-05T08:01:10.907530775+00:00  INFO     ｉ [info]: DB Cleanup Cron started
lldap  | 2025-12-05T08:01:21.030143646+00:00  INFO     ｉ [info]: OPAQUE login attempt for "admin"
lldap  | 2025-12-05T08:01:21.697483057+00:00  INFO     ｉ [info]: OPAQUE login attempt for "admin"
lldap  | 2025-12-05T08:01:40.987840251+00:00  INFO     ｉ [info]: LDAP session start: 0ce129b0-48e0-4b1c-9294-28c7f55291bb
lldap  | 2025-12-05T08:01:40.987978581+00:00  INFO     LDAP request [ 119µs | 100.00% ] session_id: 0ce129b0-48e0-4b1c-9294-28c7f55291bb
when I try to use username "admin" and password "password", it says "Invalid username or password" on the web interface on cli: xxxx@docker:~/docker-apps/lldap$ ldapsearch -x -H ldap://192.168.88.111:3890 -D "uid=admin,ou=people,dc=xxxx,dc=xxxx" -w "password" -b "ou=people,dc=xxxxdc=xxxx" "(uid=admin)" ldap_bind: Invalid credentials (49) docker compose:
Copy code
vlalwani@docker:~/docker-apps/lldap$ cat docker-compose.yml
services:
  lldap:
    container_name: lldap
    image: lldap/lldap:stable
    restart: unless-stopped
    ports:
      - "17170:17170"
      - "3890:3890" #only open for debugging
    env_file:
      - container-vars.env
    volumes:
      - ./data:/data
      - ./secrets:/secrets
    labels:
      glance.name: LLDAP
      glance.icon: sh:lldap-light
      glance.url: http://192.168.88.111:17170
      glance.description: LDAP
      glance.hide: "false"

networks:
  default:
    name: iam-network
xxxx@docker:~/docker-apps/lldap$ cat data/lldap_config.toml
Copy code
jwt_secret = "xxxx"
ldap_base_dn = "dc=xxxx,dc=xxxx"
ldap_user_email = "xxxx@xxxx.xxxx"
#ldap_user_pass = "password"
database_url = "sqlite:///data/users.db?mode=rwc"
key_seed = "xxxx"

[smtp_options]
enable_password_reset=true
server="mail.xxxx.xxxx"
port=587
smtp_encryption = "STARTTLS"
user="xxxx@xxxx.xxxx"
password="xxxx"
from="LLDAP Admin <xxxx@xxxx.xxxx>"

[ldaps_options]

[healthcheck_options]
n
The ldap_user_pass is commented in the config is that intentional?
You can also force reset it (I don't remember the exact env variable)
v
Okay so i followed your instructions and did this: added/uncommented these lines to config file:
Copy code
ldap_user_pass = "password"
force_ldap_user_pass_reset = true
This if after running the compose file:
Copy code
lldap  | > Setup permissions..
lldap  | > Starting lldap..
lldap  |
lldap  | Loading configuration from /data/lldap_config.toml
lldap  | WARNING: Unknown environment variable: LLDAP_LLDAP_GID
lldap  | WARNING: Unknown environment variable: LLDAP_LLDAP_UID
lldap  | WARNING: A key_seed was given, we will ignore the key_file and generate one from the seed! Set key_file to an empty string in the config to silence this message.
lldap  | Error: Restart the server without --force-update-private-key or --force-ldap-user-pass-reset to continue.
lldap  | 2025-12-05T08:29:43.778182884+00:00  INFO     set_up_server [ 108ms | 0.00% / 100.00% ]
lldap  | 2025-12-05T08:29:43.778199616+00:00  INFO     ┝━ ｉ [info]: Starting LLDAP version 0.6.2
lldap  | 2025-12-05T08:29:43.786589638+00:00  WARN     ┕━ Forcing admin password reset to the config-provided password [ 108ms | 100.00% ]
lldap  | 2025-12-05T08:29:43.894499416+00:00  INFO        ┕━ ｉ [info]: Successfully (re)set password for "admin"
lldap  | > Setup permissions..
lldap  | > Starting lldap..
lldap  |
lldap  | Loading configuration from /data/lldap_config.toml
lldap  | WARNING: Unknown environment variable: LLDAP_LLDAP_UID
lldap  | WARNING: Unknown environment variable: LLDAP_LLDAP_GID
lldap  | WARNING: A key_seed was given, we will ignore the key_file and generate one from the seed! Set key_file to an empty string in the config to silence this message.
lldap  | Error: Restart the server without --force-update-private-key or --force-ldap-user-pass-reset to continue.
lldap  | 2025-12-05T08:29:44.652060770+00:00  INFO     set_up_server [ 119ms | 0.00% / 100.00% ]
lldap  | 2025-12-05T08:29:44.652077143+00:00  INFO     ┝━ ｉ [info]: Starting LLDAP version 0.6.2
lldap  | 2025-12-05T08:29:44.657227050+00:00  WARN     ┕━ Forcing admin password reset to the config-provided password [ 119ms | 100.00% ]
and the same loop goes on...
so i comment these lines again:
Copy code
ldap_user_pass = "password"
force_ldap_user_pass_reset = true
and restart the compose file This is the latest log with the same error message on web ui:
n
Now you can remove the second option
v
Copy code
lldap  | > Setup permissions..
lldap  | > Starting lldap..
lldap  |
lldap  | Loading configuration from /data/lldap_config.toml
lldap  | WARNING: Unknown environment variable: LLDAP_LLDAP_GID
lldap  | WARNING: Unknown environment variable: LLDAP_LLDAP_UID
lldap  | WARNING: A key_seed was given, we will ignore the key_file and generate one from the seed! Set key_file to an empty string in the config to silence this message.
lldap  | 2025-12-05T08:31:30.970129857+00:00  INFO     set_up_server [ 4.11ms | 100.00% ]
lldap  | 2025-12-05T08:31:30.970145405+00:00  INFO     ┝━ ｉ [info]: Starting LLDAP version 0.6.2
lldap  | 2025-12-05T08:31:30.975432753+00:00  INFO     ┝━ ｉ [info]: Starting the LDAP server on port 3890
lldap  | 2025-12-05T08:31:30.975623902+00:00  INFO     ┕━ ｉ [info]: Starting the API/web server on port 17170
lldap  | 2025-12-05T08:31:30.975689309+00:00  INFO     ｉ [info]: starting 1 workers
lldap  | 2025-12-05T08:31:30.975693467+00:00  INFO     ｉ [info]: Actix runtime found; starting in Actix runtime
lldap  | 2025-12-05T08:31:30.975701518+00:00  INFO     ｉ [info]: starting service: "ldap", workers: 1, listening on: 0.0.0.0:3890
lldap  | 2025-12-05T08:31:30.975705726+00:00  INFO     ｉ [info]: starting service: "http", workers: 1, listening on: 0.0.0.0:17170
lldap  | 2025-12-05T08:31:30.976729426+00:00  INFO     ｉ [info]: DB Cleanup Cron started
lldap  | 2025-12-05T08:31:57.103416140+00:00  INFO     ｉ [info]: OPAQUE login attempt for "admin"
lldap  | 2025-12-05T08:31:59.902883946+00:00  INFO     ｉ [info]: OPAQUE login attempt for "admin"
lldap  | 2025-12-05T08:32:01.076388648+00:00  INFO     ｉ [info]: LDAP session start: dc9e678d-c561-4351-a7cf-fdb00f69b92e
lldap  | 2025-12-05T08:32:01.076503271+00:00  INFO     LDAP request [ 94.0µs | 100.00% ] session_id: dc9e678d-c561-4351-a7cf-fdb00f69b92e
lldap  | 2025-12-05T08:32:01.076711691+00:00  INFO     ｉ [info]: LDAP session end: dc9e678d-c561-4351-a7cf-fdb00f69b92e
n
It reset the password
And give the web UI a try, just to make sure
v
yes i believe it should have as indicated in the log but when i restart the service. I am still left with the same issue,
i have been trying to debug this all morning and i took a pause thinking what am i doing with my life...
i know this is not a weird keyboard issue since i have confirmed what am i typing. no cache issue since it's cleared. i can confrim it's not working with terminal either: xxxx@docker:~/docker-apps/lldap$ ldapsearch -x -H ldap://192.168.88.111:3890 -D "uid=admin,ou=people,dc=xxxx,dc=xxxx" -w "password" -b "ou=people,dc=xxxx,dc=xxxx" "(uid=admin)" ldap_bind: Invalid credentials (49) https://cdn.discordapp.com/attachments/1446417292207587409/1446422129993056336/image.png?ex=6933ed15&is=69329b95&hm=ff54d28fda5e750bc911e2266a11ba99e7c87a604adfca35b58de3b9904060a4&
n
Start in verbose mode and confirm that the config is as you expect. Have you been editing the wrong file?
And you can set key_file to an empty string to see if that makes the warning go away
v
when i edit the file, it does reflect in the container logs so i believe it's the correct one. this is the verbose log. on 2025-12-05T08:57:21 , i try to login. https://cdn.discordapp.com/attachments/1446417292207587409/1446425833471348767/message.txt?ex=6933f087&is=69329f07&hm=9c46d4ff905874e1e084d38bd070a8a37931157d16854a0d81118dbf0a2e645b&
do you mean this
Copy code
key_seed = "xxxx"
n
No, key_file
Set 
key_file=""
v
i have not defined this. do you want me to add this line to the config? Sorry just want to be specific
n
Yes
That will silence the warning about key seed or file
v
okay. i have added the line you have asked and restarted the container. Here are the logs:
n
Well, that's weird, I can't find anything wrong with your config or the logs
v
hmm... i am trouble finding the problem too. Google gemini gave me this table: Failure Mode,Probability,Mechanism,Behavioral Indicators Persistence Zombie,High,The old users.db was not actually deleted; Docker is mounting a volume the user didn't clear.,"The server logs show ""Loading configuration"" but not ""Creating default admin user."" Old passwords might still work." Config Shadow,High,"The LLDAP_LDAP_USER_PASS environment variable is set to a non-default value, overriding password.",User tries password and fails. Inspection of docker-compose.yml reveals a set value. Protocol Mismatch,Medium,"The browser has cached OPAQUE protocol parameters from the previous installation, causing a cryptographic handshake failure.","Login fails in the main browser but works in Incognito/Private mode. Logs show ""OPAQUE login attempt"" followed by immediate termination." Bind DN Misalignment,Low,"The user is attempting to login/bind with a username format (e.g., uid=admin) that does not match the server's cn=admin expectation.","Common in external tools (Portainer, Authentik) but less likely in the native Web UI." i am sure there is no zombie containers. I checked that too
do you think the other issues are A-OK?
okay. i have rebooted my VM as well now. so that's out of the way.
I found the problem! and thanks for helping me troubleshoot. I had a line in my docker compose:
Copy code
volumes:
      - ./secrets:/secrets
and i was thinking the secrets folder is empty since i have stored all variables in config. but i decided to check anyway and voila! i stored a file named "LDAP_USER_PASS". apparently if you define a variable in secrets, it overwrites the one in lldap config file. Maybe that's the default behavior for all docker images? Learned something new today.
now i can sleep with peace
@Answer Overflow mark solution
a
message has been deleted
PreviousNext
Powered by