Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ldap_modify: Error 80 adding TLS certificates and keys #238

Closed
jacksgt opened this Issue Feb 9, 2019 · 0 comments

Comments

Projects
None yet
1 participant
@jacksgt
Copy link
Contributor

jacksgt commented Feb 9, 2019

Hi everyone,

I just had this weird error ldap_modify: Other (e.g., implementation specific) error (80) when Puppet was applying the LDIF to modify the SSL / TLS certificates and keys for OpenLDAP.

Here my initial puppet code:

class profile::openldap (
String $server_name = 'example',
String $tld = 'com',
String $admin_password,
String $ssl_key_path = '/etc/ssl/private/ssl-cert-snakeoil.key',
String $ssl_cert_path = '/etc/ssl/certs/ssl-cert-snakeoil.pem',
) {

class { '::openldap::server':
  provider => 'olc',
  ssl_key => $ssl_key_path,
  ssl_cert => $ssl_cert_path,
}

openldap::server::database { "dc=${server_name},dc=${tld}":
  ensure => present,
  rootdn => "cn=admin,dc=${server_name},dc=${tld}",
  rootpw => $admin_password,
}

The complete error message:

Error: LDIF content:
dn: cn=config
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ssl-cert-snakeoil.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ssl-cert-snakeoil.key
-

Error message: Execution of '/usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/openldap_global_conf20190209-14638-1aj63yj' returned 80: SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
ldap_modify: Other (e.g., implementation specific) error (80)
modifying entry "cn=config"
Error: /Stage[main]/Openldap::Server::Slapdconf/Openldap::Server::Globalconf[TLSCertificate]/Openldap_global_conf[TLSCertificate]/ensure: change from 'absent' to 'present' failed: LDIF content:
dn: cn=config
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ssl-cert-snakeoil.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ssl-cert-snakeoil.key
-

Error message: Execution of '/usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/openldap_global_conf20190209-14638-1aj63yj' returned 80: SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
ldap_modify: Other (e.g., implementation specific) error (80)
modifying entry "cn=config"

After digging around for quite some time I found the issue: slapd was unable to access the files!
Albeit, this is a very bad error message for that.

$ ls -l /etc/ssl/private/ssl-cert-snakeoil.key 
-rw-r----- 1 root ssl-cert 1704 Feb  9 18:00 /etc/ssl/private/ssl-cert-snakeoil.key
$ groups openldap
openldap : openldap

The fix was to add the 'openldap' user (which slapd runs as on Debian) to the 'ssl-cert' group (which has access to the certificates and private keys). Also don't forget to restart your slapd!

Fix in Puppet:

user { 'openldap':
  groups => ['ssl-cert'],
  require => [ Package['ssl-cert'], Package['slapd'] ],
  notify => Service['slapd'],
}

Afterwards Puppet ran just fine:

Notice: /Stage[main]/Openldap::Server::Install/Package[slapd]/ensure: created
Notice: /Stage[main]/Openldap::Server::Config/Shellvar[slapd]/value: value changed ['ldap:/// ldapi:///'] to ['ldap:/// ldapi:/// ']
Notice: /Stage[main]/Openldap::Server::Service/Service[slapd]: Triggered 'refresh' from 1 event
Notice: /Stage[main]/Openldap::Server::Slapdconf/File[/etc/ldap/slapd.d]/mode: mode changed '0755' to '0750'
Notice: /Stage[main]/Openldap::Server::Slapdconf/Openldap::Server::Globalconf[TLSCertificate]/Openldap_global_conf[TLSCertificate]/ensure: created
Notice: /Stage[main]/Openldap::Server::Slapdconf/Openldap::Server::Database[dc=my-domain,dc=com]/Openldap_database[dc=my-domain,dc=com]/ensure: removed
Notice: /Stage[main]/Profile::Openldap/Openldap::Server::Database[dc=example,dc=com]/Openldap_database[dc=example,dc=com]/ensure: created

Just a heads-up in case anyone else stumbles onto this issue.

For reference also posted on my blog: https://blog.cubieserver.de/2019/openldap-implementation-specific-error-80-when-adding-tls-certificate/

@jacksgt jacksgt closed this Feb 9, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.