<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
I've confirmed that the user "rjohnson" can indeed login to other
services via LDAP. However, he can't login to rt.<br>
<br>
Looking closer, here's all the rt.log says about the failed login
attempt:<br>
<blockquote><small><font face="Courier New, Courier, monospace">[Wed
Jan 12 23:21:18 2011] [error]: FAILED LOGIN for rjohnson from
128.114.163.50 (/usr/lib/rt/RT/Interface/Web.pm:424)</font></small><br>
</blockquote>
Where did the original error I reported go? Beats me? Here's what
ldap.log says on the LDAP server:<br>
<small><font face="Courier New, Courier, monospace"><br>
</font></small>
<blockquote><small><font face="Courier New, Courier, monospace">Jan
12 15:21:18 dir1 slapd2.4[2475]: conn=614436 fd=48 ACCEPT from
IP=128.114.163.13:407</font></small><br>
<small><font face="Courier New, Courier, monospace">52
(IP=0.0.0.0:389) </font></small><br>
<small><font face="Courier New, Courier, monospace">Jan 12
15:21:18 dir1 slapd2.4[2475]: conn=614436 op=0 BIND
dn="cn=admin,dc=ucsc,dc=edu" </font></small><br>
<small><font face="Courier New, Courier, monospace">method=128 </font></small><br>
<small><font face="Courier New, Courier, monospace">Jan 12
15:21:18 dir1 slapd2.4[2475]: conn=614436 op=0 BIND
dn="cn=admin,dc=ucsc,dc=edu" </font></small><br>
<small><font face="Courier New, Courier, monospace">mech=SIMPLE
ssf=0 </font></small><br>
<small><font face="Courier New, Courier, monospace">Jan 12
15:21:18 dir1 slapd2.4[2475]: conn=614436 op=0 RESULT tag=97
err=0 text= </font></small><br>
<small><font face="Courier New, Courier, monospace">Jan 12
15:21:18 dir1 slapd2.4[2475]: conn=614436 op=1 SRCH
base="ou=people,dc=ucsc,dc=ed</font></small><br>
<small><font face="Courier New, Courier, monospace">u" scope=2
deref=2 filter="(&(objectClass=person)(uid=rjohnson))" </font></small><br>
<small><font face="Courier New, Courier, monospace">Jan 12
15:21:18 dir1 slapd2.4[2475]: conn=614436 op=1 SRCH
attr=telephoneNumber cn mail </font></small><br>
<small><font face="Courier New, Courier, monospace">uid gecos uid
</font></small><br>
<small><font face="Courier New, Courier, monospace">Jan 12
15:21:18 dir1 slapd2.4[2475]: conn=614436 op=1 SEARCH RESULT
tag=101 err=0 nentri</font></small><br>
<small><font face="Courier New, Courier, monospace">es=1 text= </font></small><br>
<small><font face="Courier New, Courier, monospace">Jan 12
15:21:18 dir1 slapd2.4[2475]: conn=614436 fd=48 closed
(connection lost) </font></small><br>
<small><font face="Courier New, Courier, monospace">Jan 12
15:21:19 dir1 slapd2.4[2475]: conn=614435 op=4 UNBIND </font></small><br>
<small><font face="Courier New, Courier, monospace">Jan 12
15:21:19 dir1 slapd2.4[2475]: conn=614435 fd=39 closed </font></small><br>
</blockquote>
However, when I login as another user, one that has a local rt
login, I get this in the rt.log:<br>
<br>
<blockquote><small><font face="Courier New, Courier, monospace">[Wed
Jan 12 23:31:22 2011] [critical]: Search for
(ou=group,dc=ucsc,dc=edu=uid=wmodes,ou=people,dc=ucsc,dc=edu)
failed: LDAP_INVALID_DN_SYNTAX 34
(/usr/local/rt/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:116)</font></small><br>
<small><font face="Courier New, Courier, monospace">[Wed Jan 12
23:31:22 2011] [error]: AUTH FAILED, Couldn't Load Password
Encryption Package. Error: Can't locate Crypt/MySQL.pm in @INC
(@INC contains: /usr/local/rt/lib
/usr/local/rt/plugins/RT-Extension-ExtractCustomFieldValues/lib
/usr/local/rt/plugins/RT-Authen-ExternalAuth/lib /usr/lib/rt
/usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.8 /usr/lib/perl5/site_perl
/usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.8 /usr/lib/perl5/vendor_perl
/usr/lib64/perl5/5.8.8/x86_64-linux-thread-multi
/usr/lib/perl5/5.8.8 . /etc/httpd) at (eval 4588) line 3,
<DATA> line 440.</font></small><br>
<br>
<small><font face="Courier New, Courier, monospace">Stack:</font></small><br>
<small><font face="Courier New, Courier, monospace"> [(eval
4588):3]</font></small><br>
<small><font face="Courier New, Courier, monospace">
[/usr/local/rt/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:330]</font></small><br>
<small><font face="Courier New, Courier, monospace">
[/usr/local/rt/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth.pm:156]</font></small><br>
<small><font face="Courier New, Courier, monospace">
[/usr/local/rt/plugins/RT-Authen-ExternalAuth/html/Callbacks/ExternalAuth/autohandler/Auth:25]</font></small><br>
<small><font face="Courier New, Courier, monospace">
[/usr/lib/rt/RT/Interface/Web.pm:202]</font></small><br>
<small><font face="Courier New, Courier, monospace">
[/var/rt/html/autohandler:53]
(/usr/local/rt/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/DBI.pm:70)</font></small><br>
<small><font face="Courier New, Courier, monospace">[Wed Jan 12
23:31:22 2011] [error]: My_MySQL AUTH FAILED The encryption
package you gave me ( Crypt::MySQL ) does not support the
encryption method you specified ( password )
(/usr/local/rt/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/DBI.pm:99)</font></small><br>
</blockquote>
<br>
It looks like you are right about the group setting being messed up,
but does that explain the failure of the first login? There may be
multiple things messed up and prove conclusively that two wrongs do
not make a right.<br>
<br>
Wes<br>
<br>
<br>
<br>
<br>
On 1/12/2011 3:05 PM, Kevin Falcone wrote:
<blockquote cite="mid:20110112230529.GP731@jibsheet.com" type="cite">
<pre wrap="">On Wed, Jan 12, 2011 at 03:00:30PM -0800, Wes Modes wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Kevin, you said the error is clear. but it seems less than clear to
me. Especially since I have no problem connecting to ldap with
ldapsearch using the same DN.
Are we stalled out here, then? If this forum can not offer help, any
suggestions where to turn to for help?
In my experience with other software, LDAP is one of the simplest
integrations possible. In total one has to configure maybe three, maybe
four things. The server FQDN, maybe the port, the base DN, and maybe
the root DN. Voila! That's it! LDAP integration.
I have a difficult time believing that RT is so difficult to integrate
with LDAP, that there is so little step-by-step documentation, and that
the user forums offer so little help. This has been a surprisingly
difficult process, but I'd still like to be proved completely wrong.
</pre>
</blockquote>
<pre wrap="">
Wes, plenty of folks have this working and I've set it up more times
than I can count. You've cherry picked an error that tells me that
your LDAP server is rejecting the connection attempt. What do your
LDAP logs say?
As someone observed, your group settings look interestingly wrong, but
since I'm staring at one log line it's kind of hard to tell if this is
the initial bind or a later bind failure.
-kevin
</pre>
<blockquote type="cite">
<pre wrap="">On 1/11/2011 7:43 AM, Kevin Falcone wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On Mon, Jan 10, 2011 at 06:03:37PM -0800, Wes Modes wrote:
</pre>
<blockquote type="cite">
<pre wrap=""> I am using ExternalAuth to connect RT3.8.8 to LDAP.
Detailed documentation seems to be woefully absent, and I've scoured the web and tried the
dozens of conflicting suggestions, so I'm turning to y'all.
Here's the error I get:
[Tue Jan 11 01:41:56 2011] [critical]: RT::Authen::ExternalAuth::LDAP::_GetBoundLdapObj
Can't bind: LDAP_INVALID_DN_SYNTAX 34
(/usr/local/rt/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:467)
</pre>
</blockquote>
<pre wrap="">The error seems clear, something in your username or password isn't
valid DN syntax according to your server.
Try connecting using the ldapsearch command line client.
-kevin
</pre>
<blockquote type="cite">
<pre wrap=""> Here's the LDAP section from my RT_Authen-ExternalAuth.pm
'My_LDAP' => {
## GENERIC SECTION
# The type of service (db/ldap/cookie)
'type' => 'ldap',
# The server hosting the service
'server' => 'dir1.library.ucsc.edu',
## SERVICE-SPECIFIC SECTION
# If you can bind to your LDAP server anonymously you should
# remove the user and pass config lines, otherwise specify them here:
#
# The username RT should use to connect to the LDAP server
'user' => 'cn=admin,dc=ucsc,dc=edu',
# The password RT should use to connect to the LDAP server
'pass' => 'PASSWORD',
#
# The LDAP search base
'base' => 'ou=people,dc=ucsc,dc=edu',
#
# ALL FILTERS MUST BE VALID LDAP FILTERS ENCASED IN PARENTHESES!
# YOU **MUST** SPECIFY A filter AND A d_filter!!
#
# The filter to use to match RT-Users
'filter' => '(objectClass=person)',
# A catch-all example filter: '(objectClass=*)'
#
# The filter that will only match disabled users
'd_filter' => '(objectClass=FooBarBaz)',
# A catch-none example d_filter: '(objectClass=FooBarBaz)'
#
# Should we try to use TLS to encrypt connections?
'tls' => 0,
# SSL Version to provide to Net::SSLeay *if* using SSL
'ssl_version' => 3,
# What other args should I pass to Net::LDAP->new($host,@args)?
'net_ldap_args' => [ version => 3 ],
# Does authentication depend on group membership? What group name?
'group' => 'staff',
# What is the attribute for the group object that determines membership?
'group_attr' => 'ou=group,dc=ucsc,dc=edu',
## RT ATTRIBUTE MATCHING SECTION
# The list of RT attributes that uniquely identify a user
# This example shows what you *can* specify.. I recommend reducing this
# to just the Name and EmailAddress to save encountering problems later.
'attr_match_list' => [ 'Name',
'EmailAddress',
],
# The mapping of RT attributes on to LDAP attributes
'attr_map' => { 'Name' => 'uid',
'EmailAddress' => 'mail',
'RealName' => 'cn',
'ExternalAuthId' => 'uid',
'Gecos' => 'gecos',
'WorkPhone' => 'telephoneNumber',
}
},
What more do you need to know to help me get this working?
Wes
</pre>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
</body>
</html>