Unable to sync user data

[pascalgross]

I'm using docker-compose with the following file

version: '2'

services:

  wekandb:
    image: mongo:4.0.3
    container_name: wekan-db
    restart: always
    command: mongod --smallfiles --oplogSize 128
    networks:
      - wekan-network
    expose:
      - 27017
    volumes:
      - wekan-db:/data/db
      - wekan-db-dump:/dump

  wekan:
    image: quay.io/wekan/wekan:meteor-1.8
    container_name: wekan-app
    restart: always
    networks:
      - wekan-network
    ports:
      - 3000:3000
    environment:
      - ROOT_URL=http://aufgaben.ad.mycompany.de
      - PORT=3000
      - MONGO_URL=mongodb://wekandb:27017/wekan
      - MAIL_URL='smtp://exchsrv01.ad.mycompany.de:25/?ignoreTLS=true&tls={rejectUnauthorized:false}'
      - MAIL_FROM='mycompany Aufgaben <aufgaben@mycompany.de>'
      - WITH_API=true
      - BROWSER_POLICY_ENABLED=true
      - TRUSTED_URL=''
      - WEBHOOKS_ATTRIBUTES=''
      - LDAP_ENABLE=true
      - LDAP_PORT=389
      - LDAP_HOST=192.168.0.1
      - LDAP_BASEDN=DC=ad,DC=mycompany,DC=de
      - LDAP_LOGIN_FALLBACK=false
      - LDAP_RECONNECT=true
      - LDAP_TIMEOUT=10000
      - LDAP_IDLE_TIMEOUT=10000
      - LDAP_CONNECT_TIMEOUT=10000
      - LDAP_AUTHENTIFICATION=true
      - LDAP_AUTHENTIFICATION_USERDN=CN=ad-su-intranet01,OU=01_Service_User,DC=ad,DC=mycompany,DC=de
      - LDAP_AUTHENTIFICATION_PASSWORD=XXXXXXXXXXXXXXXX
      - LDAP_LOG_ENABLED=true
      - LDAP_BACKGROUND_SYNC=false
      - LDAP_BACKGROUND_SYNC_INTERVAL='every 1 hour'
      - LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false
      - LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false
      - LDAP_ENCRYPTION=false
      - LDAP_REJECT_UNAUTHORIZED=false
      - LDAP_USER_SEARCH_FILTER=(&(objectCategory=Person)(memberOf:1.2.840.113556.1.4.1941:=CN=Mitarbeiter,OU=11_User_Groups,DC=ad,DC=mycompany,DC=de))
      - LDAP_USER_SEARCH_SCOPE=sub
      - LDAP_USER_SEARCH_FIELD=sAMAccountName
      - LDAP_SEARCH_PAGE_SIZE=0
      - LDAP_SEARCH_SIZE_LIMIT=0
      - LDAP_GROUP_FILTER_ENABLE=false
      - LDAP_GROUP_FILTER_OBJECTCLASS=
      - LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE=
      - LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE=
      - LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT=
      - LDAP_GROUP_FILTER_GROUP_NAME=
      - LDAP_UNIQUE_IDENTIFIER_FIELD=
      - LDAP_UTF8_NAMES_SLUGIFY=true
      - LDAP_USERNAME_FIELD=sAMAccountName
      - LDAP_MERGE_EXISTING_USERS=false
      - LDAP_SYNC_USER_DATA=true
      - LDAP_SYNC_USER_DATA_FIELDMAP={"cn":"name", "mail":"email"}
      - LDAP_SYNC_GROUP_ROLES=''
      - LDAP_DEFAULT_DOMAIN=ardoris.de
    depends_on:
      - wekandb

volumes:
  wekan-db:
    driver: local
  wekan-db-dump:
    driver: local

networks:
  wekan-network:
    driver: bridge

The LDAP login works as expected, but the user data (full name) is not synced.
The log shows the following:

[INFO] Init LDAP login "myusername"
[WARN] Lookup for unset variable: INTERNAL_LOG_LEVEL 
[WARN] Lookup for unset variable: LDAP_USER_ATTRIBUTES 
[INFO] Init setup 
[INFO] Connecting "ldap://192.168.0.1:389"
[DEBUG] connectionOptions{ url: 'ldap://192.168.0.1:389',
  timeout: 10000,
  connectTimeout: 10000,
  idleTimeout: 10000,
  reconnect: true,
  log: 
   Logger {
     domain: null,
     _events: {},
     _eventsCount: 0,
     _maxListeners: undefined,
     _level: 30,
     streams: [ [Object] ],
     serializers: null,
     src: false,
     fields: 
      { name: 'ldapjs',
        component: 'client',
        hostname: '0c3805cde550',
        pid: 1 } } } 
[INFO] LDAP connected 
[INFO] Binding UserDN "CN=ad-su-intranet01,OU=01_Service_User,DC=ad,DC=mycompany,DC=de"
[INFO] Searching user "myusername"
[DEBUG] searchOptions {
  "filter": "(&(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=Mitarbeiter,OU=11_User_Groups,DC=ad,DC=mycompany,DC=de))(sAMAccountName=myusername))",
  "scope": "sub",
  "sizeLimit": 0
}
[DEBUG] BaseDN "DC=ad,DC=mycompany,DC=de"
[INFO] Search result count 1
[INFO] Authenticating "CN=Mustermann\\, Max,OU=00_mobile_User,OU=12_User,DC=ad,DC=mycompany,DC=de"
[INFO] Authenticated "CN=Mustermann\\, Max,OU=00_mobile_User,OU=12_User,DC=ad,DC=mycompany,DC=de"
[DEBUG] Identifying user with: sAMAccountName 
[INFO] Querying user 
[DEBUG] userQuery {
  "services.ldap.id": "702e67726f7373"
}
[INFO] Logging user 
[INFO] Syncing user data 
[DEBUG] user {
  "_id": "JqX9Ceh6NyKdmmohz"
}
[INFO] Idle 
[INFO] Disconecting 
[INFO] Closed 

Am I doing anything wrong or is it a bug?

[svenseeberg]

Syncing usernames is working for me, but syncing e-mail addresses does not work (yet) with the following settings with UCS LDAP. Therefore I think its a configuration issue.

LDAP_ENABLE=true
LDAP_PORT=7636
LDAP_HOST=ucs.example.com
LDAP_BASEDN=cn=users,dc=example,dc=com
LDAP_LOGIN_FALLBACK=true
LDAP_RECONNECT=true (default value)
LDAP_TIMEOUT=10000 (default value)
LDAP_IDLE_TIMEOUT=10000 (default value)
LDAP_CONNECT_TIMEOUT=10000 (default value)
LDAP_AUTHENTIFICATION=true
LDAP_AUTHENTIFICATION_USERDN=uid=wekan,cn=users,dc=example,dc=com
LDAP_AUTHENTIFICATION_PASSWORD=SECRET
LDAP_LOG_ENABLED=true
LDAP_BACKGROUND_SYNC=true
LDAP_BACKGROUND_SYNC_INTERVAL= (default value)
LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=true
LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=true
LDAP_ENCRYPTION=ssl
LDAP_CA_CERT= (default value)
LDAP_REJECT_UNAUTHORIZED=true
LDAP_USER_AUTHENTICATION=true
LDAP_USER_AUTHENTICATION_FIELD=uid (default value)
LDAP_USER_SEARCH_FILTER=(&(memberOf=cn=Domain Users,cn=groups,dc=example,dc=com))
LDAP_USER_SEARCH_SCOPE= (default value)
LDAP_USER_SEARCH_FIELD=uid
LDAP_SEARCH_PAGE_SIZE=0 (default value)
LDAP_SEARCH_SIZE_LIMIT=0 (default value)
LDAP_GROUP_FILTER_ENABLE=false (default value)
LDAP_GROUP_FILTER_OBJECTCLASS= (default value)
LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE= (default value)
LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE= (default value)
LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT= (default value)
LDAP_GROUP_FILTER_GROUP_NAME= (default value)
LDAP_UNIQUE_IDENTIFIER_FIELD= (default value)
LDAP_UTF8_NAMES_SLUGIFY=true (default value)
LDAP_USERNAME_FIELD=uid
LDAP_FULLNAME_FIELD=displayName
LDAP_MERGE_EXISTING_USERS=false (default value)
LDAP_SYNC_USER_DATA=true
LDAP_SYNC_USER_DATA_FIELDMAP={
"mailPrimaryAddress": "email",
uid": "name"
}
LDAP_SYNC_GROUP_ROLES= (default value)
LDAP_DEFAULT_DOMAIN=example.com
LDAP_EMAIL_MATCH_ENABLE=true
LDAP_EMAIL_MATCH_REQUIRE=true
LDAP_EMAIL_MATCH_VERIFIED=true
LDAP_EMAIL_FIELD=mailPrimaryAddress
LDAP_SYNC_ADMIN_STATUS= (default value)
LDAP_SYNC_ADMIN_GROUPS= (default value)

[pascalgross]

are we talking about usernames (logon name) or the user's name (FullName, cn, DisplayName, ...)?
I'm talking about the 'Full Name' displayed if you go to 'Edit Profile'.

What makes you think, that it's a configuration problem when you are unable to sync the mail address?

[svenseeberg]

I was talking about the full name. But I realized that it is being synced during the log in process, but not during the interval sync. Therefore I'm stuck at the same problem you're at.

[pascalgross]

Ah okay, good to know. With my configuration, the full name is not even synced at login.

[svenseeberg]

I'm not really able to find any issues in the configuration so far. I think I need either more detailed debug messages or more documentation. My gut feeling right now is that the association of Wekan users to LDAP users is not working in the sync process. This could be due to wrong configuration parameters or a bug.

*edit: I also see a [INFO] Searching by id "7365656265727376". This looks like a Wekan internal ID to me, as it does not appear anywhere in my LDAP directory. Why should it be used to search for a user?

The id is a parameter for the function in which the log line is created: getUserByIdSync(id, attribute). The function is only called in one place: ldapUser = ldap.getUserByIdSync(user.services.ldap.id, user.services.ldap.idAttribute);. The value for user.services.ldap.id seems to be associated with Unique_Identifier_Field. In my case the field is empty in the config. Changing it to entryUUID does not help. Any advice?

*edit2: This id seems to get longer and longer for each new user created in Wekan. The latest user has an ID with 42 digits.