Dear all,
I met with an issue when doing the LDAP authentication on the Kylin. My FreeIPA works with Ranger very well, but on Kylin, when binding the DN with the admin, it failed to connect to the LDAP server:
[05/Jul/2017:11:16:32 +0800] ipalockout_preop - [file ipa_lockout.c, line 756]: Failed to retrieve entry "uid=admin,cn=users,cn=accounts,dc=dat...": 32 [05/Jul/2017:11:16:32 +0800] ipalockout_preop - [file ipa_lockout.c, line 756]: Failed to retrieve entry "uid=admin,cn=users,cn=accounts,dc=dat...": 32
Appreciated for any hints. Regards, Wenxing
wenxing zheng via FreeIPA-users wrote:
Dear all,
I met with an issue when doing the LDAP authentication on the Kylin. My FreeIPA works with Ranger very well, but on Kylin, when binding the DN with the admin, it failed to connect to the LDAP server:
[05/Jul/2017:11:16:32 +0800] ipalockout_preop - [file ipa_lockout.c, line 756]: Failed to retrieve entry "uid=admin,cn=users,cn=accounts,dc=dat...": 32 [05/Jul/2017:11:16:32 +0800] ipalockout_preop - [file ipa_lockout.c, line 756]: Failed to retrieve entry "uid=admin,cn=users,cn=accounts,dc=dat...": 32
I don't know what either Kylin or Ranger are. The only advice I can suggest is to ensure the whole DN is correct (the dc= bits). The plugin is just trying to fetch the entry that is doing the BIND. My memory is fuzzy on the ordering of the plugins, it's possible that the bind hasn't been authenticated yet at this point, I'm not sure.
You should be able to test on the command-line which might make this easier:
$ ldapsearch -D uid=admin,cn=users,cn=accounts,dc=example,dc=com -W -b uid=admin,cn=users,cn=accounts,dc=example,dc=com
rob
Thanks to Rob.
We finally got the root cause, it's a bug in the application. Our LDAP URL or DN is too long which triggered a bug in the JDK Properties. Java Properties doesn't allow the value to be longer than 47, and if the length is longer than 47, it will truncate the value and append the "..." at the end.
On Thu, Jul 6, 2017 at 1:33 AM, Rob Crittenden rcritten@redhat.com wrote:
wenxing zheng via FreeIPA-users wrote:
Dear all,
I met with an issue when doing the LDAP authentication on the Kylin. My FreeIPA works with Ranger very well, but on Kylin, when binding the DN with the admin, it failed to connect to the LDAP server:
[05/Jul/2017:11:16:32 +0800] ipalockout_preop - [file ipa_lockout.c, line 756]: Failed to retrieve entry "uid=admin,cn=users,cn=accounts,dc=dat...": 32 [05/Jul/2017:11:16:32 +0800] ipalockout_preop - [file ipa_lockout.c, line 756]: Failed to retrieve entry "uid=admin,cn=users,cn=accounts,dc=dat...": 32
I don't know what either Kylin or Ranger are. The only advice I can suggest is to ensure the whole DN is correct (the dc= bits). The plugin is just trying to fetch the entry that is doing the BIND. My memory is fuzzy on the ordering of the plugins, it's possible that the bind hasn't been authenticated yet at this point, I'm not sure.
You should be able to test on the command-line which might make this easier:
$ ldapsearch -D uid=admin,cn=users,cn=accounts,dc=example,dc=com -W -b uid=admin,cn=users,cn=accounts,dc=example,dc=com
rob
wenxing zheng wrote:
Thanks to Rob.
We finally got the root cause, it's a bug in the application. Our LDAP URL or DN is too long which triggered a bug in the JDK Properties. Java Properties doesn't allow the value to be longer than 47, and if the length is longer than 47, it will truncate the value and append the "..." at the end.
Glad you figured it out. I had assumed the ellipses were you obfuscating the domain name :-)
rob
On Thu, Jul 6, 2017 at 1:33 AM, Rob Crittenden <rcritten@redhat.com mailto:rcritten@redhat.com> wrote:
wenxing zheng via FreeIPA-users wrote: > Dear all, > > I met with an issue when doing the LDAP authentication on the Kylin. My > FreeIPA works with Ranger very well, but on Kylin, when binding the DN > with the admin, it failed to connect to the LDAP server: > > [05/Jul/2017:11:16:32 +0800] ipalockout_preop - [file ipa_lockout.c, > line 756]: Failed to retrieve entry > "uid=admin,cn=users,cn=accounts,dc=dat...": 32 > [05/Jul/2017:11:16:32 +0800] ipalockout_preop - [file ipa_lockout.c, > line 756]: Failed to retrieve entry > "uid=admin,cn=users,cn=accounts,dc=dat...": 32 I don't know what either Kylin or Ranger are. The only advice I can suggest is to ensure the whole DN is correct (the dc= bits). The plugin is just trying to fetch the entry that is doing the BIND. My memory is fuzzy on the ordering of the plugins, it's possible that the bind hasn't been authenticated yet at this point, I'm not sure. You should be able to test on the command-line which might make this easier: $ ldapsearch -D uid=admin,cn=users,cn=accounts,dc=example,dc=com -W -b uid=admin,cn=users,cn=accounts,dc=example,dc=com rob
freeipa-users@lists.fedorahosted.org