Connect to Active Directory Error

Hi, I’m having trouble integrating an Active Directory domain for authentication. I’ve created the user for the authentication, the groups are found, but not the users. I’m getting the following error:

cluster/list-domain-users

Task ID : af7d83f9-20d5-450c-a9a5-db8e5e10faa4

Traceback (most recent call last):
  File "/var/lib/nethserver/cluster/actions/list-domain-users/50list_users", line 33, in <module>
    users = Ldapclient.factory(**domain).list_users(extra_info=True)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/agent/pypkg/agent/ldapclient/ad.py", line 168, in list_users
    expire = (entry['attributes']['userAccountControl'] & 0x10000 == 0) # DONT_EXPIRE_PASSWORD
              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~
TypeError: unsupported operand type(s) for &: 'list' and 'int'

Is this a Netshserver-side issue or an Active Directory-side issue?

Hi,

and welcome to NethServer Community.

if you’re using port 389 or 636 for the external AD user domain, please try to change it to 3268/3269, see also User domains — NS8 documentation

Maybe it’s a permission issue. You could try to connect to the external AD user domain with an Administrator account for testing.

Maybe related:

Thanks for your reply.

I tested with the 2 ports 3268 and 3269, and it’s de same error.

With the administrator account, I’ve this error :

Validation errors: [users.0: locked is required users.1: locked is required users.2: locked is required users.3: locked is required users.4: locked is required users.5: locked is required users.6: locked is required users.7: locked is required users.8: locked is required users.9: locked is required users.10: locked is required users.11: locked is required users.12: locked is required users.13: locked is required users.14: locked is required users.15: locked is required users.16: locked is required users.17: locked is required users.18: locked is required users.19: locked is required users.20: locked is required users.21: locked is required users.22: locked is required users.23: locked is required users.24: locked is required users.25: locked is required users.26: locked is required users.27: locked is required users.28: locked is required users.29: locked is required users.30: locked is required users.31: locked is required users.32: locked is required users.33: locked is required users.34: locked is required users.35: locked is required users.36: locked is required users.37: locked is required users.38: locked is required users.39: locked is required users.40: locked is required users.41: locked is required users.42: locked is required users.43: locked is required users.44: locked is required users.45: locked is required users.46: locked is required users.47: locked is required users.48: locked is required users.49: locked is required users.50: locked is required users.51: locked is required users.52: locked is required users.53: locked is required users.54: locked is required users.55: locked is required users.56: locked is required users.57: locked is required users.58: locked is required users.59: locked is required users.60: locked is required users.61: locked is required users.62: locked is required users.63: locked is required users.64: locked is required users.65: locked is required users.66: locked is required users.67: locked is required users.68: locked is required users.69: locked is required users.70: locked is required users.71: locked is required users.72: locked is required users.73: locked is required users.74: locked is required users.75: locked is required users.76: locked is required users.77: locked is required users.78: locked is required users.79: locked is required users.80: locked is required users.81: locked is required users.82: locked is required users.83: locked is required users.84: locked is required users.85: locked is required users.86: locked is required users.87: locked is required users.88: locked is required users.89: locked is required users.90: locked is required users.91: locked is required users.92: locked is required users.93: locked is required users.94: locked is required users.95: locked is required users.96: locked is required users.97: locked is required users.98: locked is required users.99: locked is required users.100: locked is required users.101: locked is required users.102: locked is required users.103: locked is required users.104: locked is required users.105: locked is required users.106: locked is required users.107: locked is required users.108: locked is required users.109: locked is required users.110: locked is required users.111: locked is required users.112: locked is required users.113: locked is required users.114: locked is required users.115: locked is required users.116: locked is required users.117: locked is required users.118: locked is required users.119: locked is required users.120: locked is required users.121: locked is required users.122: locked is required users.123: locked is required users.124: locked is required users.125: locked is required users.126: locked is required users.127: locked is required users.128: locked is required users.129: locked is required users.130: locked is required users.131: locked is required users.132: locked is required users.133: locked is required users.134: locked is required users.135: locked is required users.136: locked is required users.137: locked is required users.138: locked is required users.139: locked is required users.140: locked is required users.141: locked is required users.142: locked is required users.143: locked is required users.144: locked is required users.145: locked is required users.146: locked is required users.147: locked is required users.148: locked is required users.149: locked is required users.150: locked is required users.151: locked is required users.152: locked is required users.153: locked is required users.154: locked is required users.155: locked is required users.156: locked is required users.157: locked is required users.158: locked is required users.159: locked is required users.160: locked is required users.161: locked is required users.162: locked is required users.163: locked is required users.164: locked is required users.165: locked is required users.166: locked is required users.167: locked is required users.168: locked is required users.169: locked is required users.170: locked is required users.171: locked is required users.172: locked is required users.173: locked is required users.174: locked is required users.175: locked is required users.176: locked is required users.177: locked is required users.178: locked is required users.179: locked is required users.180: locked is required users.181: locked is required users.182: locked is required users.183: locked is required users.184: locked is required users.185: locked is required users.186: locked is required users.187: locked is required users.188: locked is required users.189: locked is required users.190: locked is required users.191: locked is required users.192: locked is required users.193: locked is required users.194: locked is required users.195: locked is required users.196: locked is required users.197: locked is required users.198: locked is required users.199: locked is required users.200: locked is required users.201: locked is required users.202: locked is required users.203: locked is required users.204: locked is required users.205: locked is required users.206: locked is required users.207: locked is required users.208: locked is required users.209: locked is required users.210: locked is required users.211: locked is required users.212: locked is required users.213: locked is required users.214: locked is required users.215: locked is required users.216: locked is required users.217: locked is required users.218: locked is required users.219: locked is required users.220: locked is required users.221: locked is required users.222: locked is required users.223: locked is required users.224: locked is required users.225: locked is required users.226: locked is required users.227: locked is required users.228: locked is required users.229: locked is required users.230: locked is required users.231: locked is required users.232: locked is required users.233: locked is required users.234: locked is required users.235: locked is required users.236: locked is required users.237: locked is required users.238: locked is required users.239: locked is required users.240: locked is required users.241: locked is required users.242: locked is required users.243: locked is required users.244: locked is required users.245: locked is required users.246: locked is required users.247: locked is required users.248: locked is required users.249: locked is required users.250: locked is required users.251: locked is required users.252: locked is required users.253: locked is required users.254: locked is required users.255: locked is required users.256: locked is required users.257: locked is required users.258: locked is required users.259: locked is required users.260: locked is required users.261: locked is required users.262: locked is required users.263: locked is required users.264: locked is required users.265: locked is required users.266: locked is required users.267: locked is required users.268: locked is required users.269: locked is required users.270: locked is required users.271: locked is required users.272: locked is required users.273: locked is required users.274: locked is required]

I saw it too this article without success : https://community.nethserver.org/t/failed-to-migrate-from-7-to-8/22968

From the error it seems that some of the AD users have no or a wrong locked attribute.

Could you try to create a new AD user with admin permissions and use it to connect to the external AD with port 3268/3269?

Which Windows Server version and AD version do you use?

Thanks,

Yes i think it seems to be a wrong attribute because the locked error is for all the users.

I already tested with another admin account and it’s the same error, with the 3268 or 3269 port.

I use Windows Server 2022 and the functional level of the forest and domain are 2016

1 Like

Is it an English Windows Server or some other language?

Could you please share a screenshot of the external AD you configured in the NS8 cluster admin just to check if you entered domain name/netbios name, upn or user name, base dn empty or not etc.

EDIT:

Are there special chars in the usernames or some non-standard naming convention?

It’s a French installation

Here is the configuration :

I have test with or without Base DN and it’s the same thing.

It’s strange because I can see all the groups.

In username no special chars except dot ‘.’, but in Common Name attribute '(cn) we have apostrophe “ ‘ “

1 Like