Problems to authenticate using openldap

[viniciusrsdutra]

Hi everyone!
I'm new to Caravel and made the necessary changes to bind to LDAP. I'm using OpenLDAP.
According to the app log the changes are ok, but users can't login at the front end.
Any help?

Thanks in advance

[dpgaspar]

Can you upgrade flask-appbuilder to version 1.6.1 and run the test again, and send me logs once more?

[viniciusrsdutra]

Hi @dpgaspar!
Thanks for helping!
I did as instructed but I got the same behavior...
Here follows the versions I'm using and the log after updating everything.

[dpgaspar]

Ok, no login failed message, i'll run some tests, could you send me your config.py (AUTH_LDAP* settings).

[dpgaspar]

My tests went fine with OpenLDAP::

2016-05-10 00:49:29,456:DEBUG:flask_appbuilder.security.manager:LDAP indirect bind with: CN=admin,dc=puppetlabs,dc=test
2016-05-10 00:49:29,458:DEBUG:flask_appbuilder.security.manager:LDAP BIND indirect OK
2016-05-10 00:49:29,459:DEBUG:flask_appbuilder.security.manager:LDAP got User [('uid=test,ou=people,dc=puppetlabs,dc=test', {'mail': ['test@example.com'], 'sn': ['User']})]
2016-05-10 00:49:29,459:DEBUG:flask_appbuilder.security.manager:LDAP bind with: uid=test,ou=people,dc=puppetlabs,dc=test XXXXXX
2016-05-10 00:49:29,460:DEBUG:flask_appbuilder.security.manager:LDAP bind OK: uid=test,ou=people,dc=puppetlabs,dc=test
2016-05-10 00:49:29,465:INFO:flask_appbuilder.security.sqla.manager:Updated user test test
2016-05-10 00:49:29,467:INFO:werkzeug:127.0.0.1 - - [10/May/2016 00:49:29] "POST /login/ HTTP/1.1" 302 -
2016-05-10 00:49:29,519:INFO:werkzeug:127.0.0.1 - - [10/May/2016 00:49:29] "GET / HTTP/1.1" 200 -
2016-05-10 00:49:32,594:INFO:werkzeug:127.0.0.1 - - [10/May/2016 00:49:32] "GET /users/list/ HTTP/1.1" 200 -

Looks like f.a.b. was able to catch the user vinicius.dutra@XXXX.XXXX, do you have this user registered on the database with the exact same username ?

[viniciusrsdutra]

@dpgaspar, the user is properly registered on LDAP!
On my log everything seems to to be ok, but on UI don't work at all. Were you able to login on UI with this test user?
Here follows my LDAP config parameters for config.py

[dpgaspar]

Yes, i was able to login on the UI, with test user (you saw on the logs) and other test users like 'dpgaspar'.

Can you try creating a test user without the @ just the . Try to reproduce my test case please.

[viniciusrsdutra]

@dpgaspar Did it, but results were the same. Couldn't log in on UI.

[viniciusrsdutra]

@dpgaspar Does the LDAP have to be configured in a way in particular?
Do you have any clue about it?

[dpgaspar]

I just created a vagrant box using https://github.com/cforcey/vagrant_ubuntu_openldap
No extra config on it....

My config for tests:

AUTH_TYPE = AUTH_LDAP
AUTH_LDAP_SEARCH = 'dc=puppetlabs,dc=test'
AUTH_LDAP_BIND_USER = "CN=admin,dc=puppetlabs,dc=test"
AUTH_LDAP_BIND_PASSWORD = "test"

First of course i've added a test user on F.A.B. The only diference i can see is the AUTH_LDAP_BIND_USER, i'm using CN and your using UID. Change this, make some tests, and send me the logs, can you send something more extended? after GET /login/ HTTP ...

You can use this for tests also:

import ldap

con = ldap.initialize("ldap://ldap-somewhere.com")
con.set_option(ldap.OPT_REFERRALS, 0)
con.bind_s('caravel@yourdomain.local', 'password')

user = con.search_s('dc=domain,dc=local',ldap.SCOPE_SUBTREE, "userPrincipalName=test@yourdomain.local",
                    ['givenName','sn','mail'])

print user[0][0]

[dpgaspar]

Any luck?

[viniciusrsdutra]

Hi @dpgaspar,

Unfortunately I had not! Sorry for responding so late!
Tried several configs and packages but no success at all...
I've noticed that I couldn't install the python-ldap package from pip. The only one that works is the one provided by ubuntu. How's the package configuration on your vagrant environment?
Can this be the thing that is making the difference?

[viniciusrsdutra]

@dpgaspar
Thank you so much for your patience and cooperation on solving this.
Eric Wong gave the tip that made the difference. After enabling AUTH_USER_REGISTRATION property it worked.
Many thanks once again!

[dpgaspar]

Ho! i thought you had registered the user on flask-appbuilder first!

I said that "First of course i've added a test user on F.A.B.".

We were not understanding each other :)

You've got it working, great! I'll close this one.