https://github.com/lldap/lldap logo
Powered by
Has anyone managed to get lldap working with dex? ...
# troubleshooting
i
n
I had a look at their config guide, it seems straightforward enough. The name would be displayName, but otherwise you just have to adapt the user and group base DN, and the rest of the example should be valid
i
I am not really sure what to put on base DN. I'm not familiar with LDAP tbh. Could you guide me to some resources?
Also thanks for the awesome project!
Essentially I can not make any sense of this error
I set`LLDAP_LDAP_BASE_DN='uid=username,ou=people,uid=username,ou=people,dc=example,dc=com'` but now I get this error
n
You can think of LDAP as nested directories. The DN is the (reverse) path to the user or group, so "uid=username,ou=people,DC=example,DC=com" means "the user 
username
in the folder people in the folder example in the folder com"
Or, as a normal file path it would look like 
/com/example/people/username
For users, the base DN is the folder in which they are, so 
ou=people,dc=example,dc=com
For groups, the same with groups instead of people
And the bind DN is the full name of the admin, so 
uid=admin,ou=people,...
Oh, and for the group filter, you want 
(objectClass=groupOfUniqueNames)
i
Ah that makes sense
but I am still not able to configure dex to correctly authenticate with lldap. Could you guide me with that?
n
Sure! What's the current issue?
i
Thanks! Here is my ldap config for dex ( i will change passwords later )
and 
LLDAP_LDAP_BASE_DN:    uid=username,ou=people,uid=username,ou=people,dc=example,dc=com
in my lldap container
For which I get this error
n
The base DN in the container should just be 
dc=example,dc=com
the 
nameAttr
should be 
displayName
(it's not going to be an error, but it's better)
for 
userSearch
, the baseDN should be 
ou=people,dc=example,dc=com
i
is the 
bindDn
correct?
n
it looks correct, though you probably want 
uid=admin,...
with the username of your admin user
(or readonly user)
Is the port correct? By default LLDAP runs on port 3890, unless you changed that to 389
i
yep I changed it
n
(to build your intuition: base DN == root folder. For users, the base DN is the folder in which all the users are. For the container, it's the root folder under which everything is (groups and users)).
i
whats DN?
n
Distinguished Name, it means the fully qualified name with all the 
dc=...
i
ah okay
n
so, absolute path
i
is there any article/resource you have in mind so that I can get basic terminology clear?
n
I plan on writing one 🙂 That's part of the reason that I started LLDAP, the existing documentation is all over the place and confusing
so no, I don't have an easy link :/
i
Yep that would be great!
It now works, though there are network connectivity errors every now and then. not sure whther that is a lldap problem or a docker one.
Would you accept a PR adding a sample dex configuration to the repo?
n
Re: network connectivity: It would be a first, with ldap
Yes, please!
i
Cool will do
Regarding this do you have any idea why this error shows up intermittently?
n
From the dex container, can you ping ignisda-sites--lldap.web ?
(note the 2 dashes)
i
yep I can
n
and the port 389 is open/exposed?
you can also restart LLDAP in verbose mode (either config or env variable) and see if you get interesting logs there
i
yep it is
I think I understand the problem
dokku scedules container to die down in 60 seconds
If i make the requests within that time frame I get that error
atleast that is my theory
yep i think that is it
I can now login and that error is not showing up
PreviousNext
Powered by