TestAndApply Error: Permission denied

[fmunteanu]

I'm trying to set LDAP authentication through Rancher 2.3.5 HA UI and I get a TestAndApply Error message. I'm running Rancher on an RKE deployment, on 3 CentOS7 AWS EC2 instances with Selinux disabled. I don't know where I can look for Rancher related error logs. Can you please let me know how can I troubleshoot the issue? Everything else is 100% operational.

[superseb]

Changing log level is described on https://rancher.com/docs/rancher/v2.x/en/troubleshooting/logging/. The configuration is described on https://rancher.com/docs/rancher/v2.x/en/admin-settings/authentication/ad/#prerequisites, did you try using Service Account Username as either NetBIOS or UPN?

[fmunteanu]

@superseb This is the error message I get:

2020/07/10 08:21:48 [DEBUG] Create Token Invoked
2020/07/10 08:21:48 [DEBUG] Now generating Ldap token
2020/07/10 08:21:48 [DEBUG] Now creating Ldap connection
2020/07/10 08:21:49 [DEBUG] Binding username password
2020/07/10 08:21:49 [DEBUG] LDAP Search query: {(sAMAccountName=fmunteanu)}
2020/07/10 08:21:49 [DEBUG] ldap IsType found object of type person
2020/07/10 08:21:49 [DEBUG] ADConstants userMemberAttribute() {memberOf}
2020/07/10 08:21:49 [DEBUG] SearchResult memberOf attribute {[CN=rancher-user,OU=groups,DC=DOMAIN,DC=COM CN=rancher-admin,OU=groups,DC=DOMAIN,DC=COM]}
2020/07/10 08:21:49 [DEBUG] ldap IsType found object of type person
2020/07/10 08:21:49 [DEBUG] AD: Query for pulling user's groups: (&(objectClass=group)(|(distinguishedName=CN=rancher-user,OU=groups,DC=DOMAIN,DC=COM)(distinguishedName=CN=rancher-admin,OU=groups,DC=DOMAIN,DC=COM)))
2020/07/10 08:21:49 [DEBUG] ldap IsType failed to determine if object is type: person
2020/07/10 08:21:49 [DEBUG] ldap IsType found object of type group
2020/07/10 08:21:49 [DEBUG] ldap IsType failed to determine if object is type: person
2020/07/10 08:21:49 [DEBUG] ldap IsType found object of type group
2020/07/10 08:21:49 [ERROR] API error response 500 for POST /v3-public/activeDirectoryProviders/activedirectory?action=login. Cause: can't find unique user for principal activedirectory_user://CN=Floren Munteanu (fmunteanu),OU=All Users,OU=accounts,DC=DOMAIN,DC=COM

Any pointers how to fix this issue is appreciated.

[stale]

This repository uses a bot to automatically label issues which have not had any activity (commit/comment/label) for 60 days. This helps us manage the community issues better. If the issue is still relevant, please add a comment to the issue so the bot can remove the label and we know it is still valid. If it is no longer relevant (or possibly fixed in the latest release), the bot will automatically close the issue in 14 days. Thank you for your contributions.