Can't login using LDAP #1572

poperigby · 2024-09-17T19:21:35Z

poperigby
Sep 17, 2024

I'm using LLDAP for my LDAP provider, but whenever I try to login with a user besides the admin, I get a 401 error on the webpage, and this output in the Radicale log:

[2024-09-17 12:18:26 -0700] [1479652/Thread-15 (process_request_thread)] [INFO] PROPFIND request for '/' received from 127.0.0.1 (forwarded for '192.168.1.1') using 'Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0'
[2024-09-17 12:18:26 -0700] [1479652/Thread-15 (process_request_thread)] [INFO] Access to '/' denied for anonymous user
[2024-09-17 12:18:26 -0700] [1479652/Thread-15 (process_request_thread)] [INFO] PROPFIND response status for '/' in 0.000 seconds: 401 Unauthorized
[2024-09-17 12:18:26 -0700] [1479652/Thread-16 (process_request_thread)] [INFO] PROPFIND request for '/' received from 127.0.0.1 (forwarded for '192.168.1.1') using 'Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0'
[2024-09-17 12:18:27 -0700] [1479652/Thread-16 (process_request_thread)] [WARNING] Failed login attempt from 127.0.0.1 (forwarded for '192.168.1.1'): 'cassidy'
[2024-09-17 12:18:28 -0700] [1479652/Thread-16 (process_request_thread)] [INFO] PROPFIND response status for '/' in 1.531 seconds: 401 Unauthorized

This is my Radicale configuration:

[auth]
type = ldap
ldap_uri = ldap://localhost:3890
ldap_base = dc=haddock,dc=cc
ldap_reader_dn = uid=radicale,ou=people,dc=haddock,dc=cc
ldap_secret = REDACTED
ldap_filter = (objectClass=person)
lc_username = True

This is my LLDAP configuration:

database_url = "postgresql://lldap@localhost/lldap?host=/run/postgresql"
http_host = "::"
http_port = 17170
http_url = "http://localhost"
ldap_base_dn = "dc=haddock,dc=cc"
ldap_host = "::"
ldap_port = 3890
ldap_user_dn = "admin"
ldap_user_email = "admin@haddock.cc"
verbose = true

This is the output of my LLDAP log when logging in: https://gist.github.com/poperigby/59d7208c23b9a830ed3634bab7b3cfaf

I'm using Radicale from 7fbc0e7

Answered by petervarkoly

Sep 21, 2024

Hi, I've analysed the logs and they show me only that the search was unsuccessfull. In the log of the ldap-server you can see 2024-09-20T17:58:51.522024615+00:00 DEBUG ┝━ 🐛 [debug]: | msg: LdapMsg { msgid: 6, op: SearchRequest(LdapSearchRequest { base: "dc=haddock,dc=cc", scope: Subtree, aliases: Always, sizelimit: 0, timelimit: 0, typesonly: false, f Equality("cn", "cassidy")]), attrs: ["memberOf"] }), ctrl: [] } 2024-09-20T17:58:51.522025385+00:00 DEBUG ┝━ do_search [ 700µs | 0.38% / 1.04% ] 2024-09-20T17:58:51.522693360+00:00 DEBUG │ ┝━ 🐛 [debug]: | request.base: "dc=haddock,dc=cc" | scope: Global 2024-09-20T17:58:51.522695850+00:00 DEBUG │ ┝━ get_user_list [ 214µs | 0.02% / 0.32% ] 20…

View full answer

pbiering · 2024-09-17T19:27:26Z

pbiering
Sep 17, 2024
Collaborator

@petervarkoly : can you further support? Potentially FAQ in Wiki would be helpful?

2 replies

petervarkoly Sep 20, 2024

@poperigby The LDAP filter must contain a python format string with a placeholder for the loginname like:

(&(objectClass=person)(cn={0}))

poperigby Sep 20, 2024
Author

Alright, I changed my filter to use that, but I still can't login 😕

Here's my LLDAP log from trying to login: https://gist.github.com/poperigby/0ade6bfafc73f0ac9a8418b632e831d6

petervarkoly · 2024-09-18T12:08:19Z

petervarkoly
Sep 18, 2024

@PeterBieringer Of course Do you mean this wiki: https://github.com/Kozea/Radicale/wiki ? Dipl. Ing. Péter Varkoly EDV/IT Beratung +49-15257491205 i.A. Cranix-Solutions GmbH Steuernummer: 238/283/00067 Ust-ID: DE257896578

…

________________________________ Von: Peter Bieringer ***@***.***> Gesendet: Dienstag, 17. September 2024 21:27 An: Kozea/Radicale ***@***.***> Cc: Peter Varkoly ***@***.***>; Mention ***@***.***> Betreff: Re: [Kozea/Radicale] Can't login using LDAP (Discussion #1572) @petervarkoly<https://github.com/petervarkoly> : can you further support? Potentially FAQ in Wiki would be helpful? — Reply to this email directly, view it on GitHub<#1572 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAVBKUKMDLMVVCPDBCYBGVTZXB7DHAVCNFSM6AAAAABOMEQNGKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANRXGQZTKNQ>. You are receiving this because you were mentioned.Message ID: ***@***.***>

2 replies

pbiering Sep 18, 2024
Collaborator

Yes

poperigby Sep 20, 2024
Author

Is @petervarkoly intending on updating the wiki with a fix for this? I'm still not sure what to do.

petervarkoly · 2024-09-20T20:19:33Z

petervarkoly
Sep 20, 2024

Please start Radicale in debug mode and send the logs. Dipl.-Ing. Péter Varkoly CRANIX Solutions Am 20.09.2024 um 20:03 schrieb PopeRigby ***@***.***>: Alright, I changed my filter to use that, but I still can't login 😕 Here's my LLDAP log from trying to login: https://gist.github.com/poperigby/0ade6bfafc73f0ac9a8418b632e831d6 — Reply to this email directly, view it on GitHub<#1572 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAVBKUI7BBTYUB354XLDK6TZXRPQVAVCNFSM6AAAAABOMEQNGKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANZQHAYTGNY>. You are receiving this because you were mentioned.Message ID: ***@***.***>

1 reply

poperigby Sep 20, 2024
Author

Sure. Here you go: https://gist.github.com/poperigby/6eded2b1dfe2af41b099cfdd2903c36b

petervarkoly · 2024-09-21T11:25:18Z

petervarkoly
Sep 21, 2024

Hi, I've analysed the logs and they show me only that the search was unsuccessfull. In the log of the ldap-server you can see 2024-09-20T17:58:51.522024615+00:00 DEBUG ┝━ 🐛 [debug]: | msg: LdapMsg { msgid: 6, op: SearchRequest(LdapSearchRequest { base: "dc=haddock,dc=cc", scope: Subtree, aliases: Always, sizelimit: 0, timelimit: 0, typesonly: false, f Equality("cn", "cassidy")]), attrs: ["memberOf"] }), ctrl: [] } 2024-09-20T17:58:51.522025385+00:00 DEBUG ┝━ do_search [ 700µs | 0.38% / 1.04% ] 2024-09-20T17:58:51.522693360+00:00 DEBUG │ ┝━ 🐛 [debug]: | request.base: "dc=haddock,dc=cc" | scope: Global 2024-09-20T17:58:51.522695850+00:00 DEBUG │ ┝━ get_user_list [ 214µs | 0.02% / 0.32% ] 2024-09-20T17:58:51.522701270+00:00 DEBUG │ │ ┝━ 🐛 [debug]: | filters: And([And([]), Equality(DisplayName, "cassidy")]) 2024-09-20T17:58:51.522704970+00:00 DEBUG │ │ ┕━ list_users [ 199µs | 0.30% ] filters: Some(And([And([]), Equality(DisplayName, "cassidy")])) | _get_groups: true 2024-09-20T17:58:51.524512582+00:00 DEBUG │ │ ┕━ 🐛 [debug]: | return: [] The result is empty. That is what the Radicale log say also: [2024-09-20 13:26:09 -0700] [3213105/Thread-2 (process_request_thread)] [DEBUG] _login3 ldap://localhost:3890, uid=radicale,ou=people,dc=haddock,dc=cc [2024-09-20 13:26:09 -0700] [3213105/Thread-2 (process_request_thread)] [DEBUG] _login3 bind as uid=radicale,ou=people,dc=haddock,dc=cc [2024-09-20 13:26:09 -0700] [3213105/Thread-2 (process_request_thread)] [DEBUG] _login3 user 'cassidy' can not be find Is really the "cn" the right attribute to search? Your reader dn has the attribute "uid": "uid=radicale,ou=people,dc=haddock,dc=cc" Dipl. Ing. Péter Varkoly EDV/IT Beratung +49-15257491205 i.A. Cranix-Solutions GmbH Steuernummer: 238/283/00067 Ust-ID: DE257896578

…

________________________________ Von: PopeRigby ***@***.***> Gesendet: Freitag, 20. September 2024 22:27 An: Kozea/Radicale ***@***.***> Cc: Peter Varkoly ***@***.***>; Mention ***@***.***> Betreff: Re: [Kozea/Radicale] Can't login using LDAP (Discussion #1572) Sure. Here you go: https://gist.github.com/poperigby/6eded2b1dfe2af41b099cfdd2903c36b — Reply to this email directly, view it on GitHub<#1572 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAVBKUPZPP43DDH6Y7KC7IDZXSAK5AVCNFSM6AAAAABOMEQNGKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANZQHEZDAMA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

3 replies

poperigby Sep 22, 2024
Author

That totally worked! Here's my final config for future reference:

[auth]
type = ldap
ldap_uri = ldap://localhost:3890
ldap_base = dc=haddock,dc=cc
ldap_reader_dn = uid=radicale,ou=people,dc=haddock,dc=cc
ldap_secret = REDACTED
ldap_filter = (&(objectClass=person)(uid={0}))
lc_username = True

petervarkoly Sep 22, 2024

Thaks for reply. We can close this issue.

pbiering Sep 24, 2024
Collaborator

Wiki updated provided example, @petervarkoly thank you for the Wiki page.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Can't login using LDAP #1572

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 4 comments 8 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Can't login using LDAP #1572

poperigby Sep 17, 2024

Replies: 4 comments · 8 replies

pbiering Sep 17, 2024 Collaborator

petervarkoly Sep 20, 2024

poperigby Sep 20, 2024 Author

petervarkoly Sep 18, 2024

pbiering Sep 18, 2024 Collaborator

poperigby Sep 20, 2024 Author

petervarkoly Sep 20, 2024

poperigby Sep 20, 2024 Author

petervarkoly Sep 21, 2024

poperigby Sep 22, 2024 Author

petervarkoly Sep 22, 2024

pbiering Sep 24, 2024 Collaborator

poperigby
Sep 17, 2024

Replies: 4 comments 8 replies

pbiering
Sep 17, 2024
Collaborator

poperigby Sep 20, 2024
Author

petervarkoly
Sep 18, 2024

pbiering Sep 18, 2024
Collaborator

poperigby Sep 20, 2024
Author

petervarkoly
Sep 20, 2024

poperigby Sep 20, 2024
Author

petervarkoly
Sep 21, 2024

poperigby Sep 22, 2024
Author

pbiering Sep 24, 2024
Collaborator