This is just an information for developpers, i don’t know if there’s a trick that could solve the problem ; anyway i can wait an update.
I updated my NS7.2.1511rc2 server today and openldap got broken. Users are still existing but nextcloud and all other services are unable to work.
Here are the packages updated which broke openldap :
Nov 10 00:01:34 Updated: nethserver-sssd-1.0.8-1.ns7.noarch
Nov 10 00:01:34 Updated: nethserver-directory-3.1.0-1.ns7.noarch
Nov 10 00:01:36 Updated: nethserver-httpd-admin-2.0.4-1.ns7.noarch
Nov 10 00:01:36 Updated: nethserver-release-7-0.5.ns7.noarch
Nov 10 00:01:37 Updated: nethserver-httpd-3.1.1-1.ns7.noarch
By the way, thanks to all developpers who contribute to NS
maybe it is the same problem. Sogo is also installed and it works without problems.
It is not possible to get access to nextcloud as a normal user. When i will do this i received the next error what means the password of the user is incorrect. But it is correct. Hier is the output of the command:
Yes. And now i have the next problem. I cant send mails outside via Sogo. I can open the window to write a new mail. But whne i push the button send, nothing will go on. It looks like frozen and only closing of the window is possible.
dn: olcDatabase={0}config,cn=config
olcAccess: {0}to * by
dn.base=“gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth”
manage by * none
dn: olcDatabase={1}monitor,cn=config
olcAccess: {0}to * by
dn.base=“gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth” read
by dn.base=“cn=Manager,dc=my-domain,dc=com” read by * none
dn: olcDatabase={2}hdb,cn=config
olcAccess:: {0}to attrs=userPassword by
dn.exact=“gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth”
manage by dn.exact=“cn=pam,dc=directory,dc=nh”
peername.path=“/var/run/ldapi” write by
dn.exact=“cn=libuser,dc=directory,dc=nh” peername.ip=“127.0.0.1” write
by anonymous peername.ip=“127.0.0.1” auth by anonymous ssf=71 auth by
self write by * none by dn.exact=“cn=pam,dc=directory,dc=nh”
peername.path=“/var/run/ldapi” write by
dn.exact=“cn=libuser,dc=directory,dc=nh” peername.ip=“127.0.0.1” write
by anonymous auth by self write by * none
olcAccess:: {1}to * by
dn.exact=“gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth”
manage by dn.exact=“cn=pam,dc=directory,dc=nh”
peername.path=“/var/run/ldapi” write by
dn.exact=“cn=libuser,dc=directory,dc=nh” peername.ip=“127.0.0.1” write
by dn.exact=“cn=ldapservice,dc=directory,dc=nh” read by users
peername.ip=“127.0.0.1” read by users ssf=71 read by anonymous read by
none by dn.exact=“cn=pam,dc=directory,dc=nh”
peername.path=“/var/run/ldapi” write by
dn.exact=“cn=libuser,dc=directory,dc=nh” peername.ip=“127.0.0.1” write
by users ssf=71 read by anonymous read by * none
dn: olcDatabase={3}relay,cn=config
olcAccess:: {0}to attrs=userPassword by
dn.exact=“gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth”
manage by dn.exact=“cn=pam,dc=directory,dc=nh”
peername.path=“/var/run/ldapi” write by
dn.exact=“cn=libuser,dc=directory,dc=nh” peername.ip=“127.0.0.1” write
by anonymous peername.ip=“127.0.0.1” auth by anonymous ssf=71 auth by
self write by * none by dn.exact=“cn=pam,dc=directory,dc=nh”
peername.path=“/var/run/ldapi” write by
dn.exact=“cn=libuser,dc=directory,dc=nh” peername.ip=“127.0.0.1” write
by anonymous auth by self write by * none
olcAccess:: {1}to * by
dn.exact=“gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth”
manage by dn.exact=“cn=pam,dc=directory,dc=nh”
peername.path=“/var/run/ldapi” write by
dn.exact=“cn=libuser,dc=directory,dc=nh” peername.ip=“127.0.0.1” write
by dn.exact=“cn=ldapservice,dc=directory,dc=nh” read by users
peername.ip=“127.0.0.1” read by users ssf=71 read by anonymous read by
none by dn.exact=“cn=pam,dc=directory,dc=nh”
peername.path=“/var/run/ldapi” write by
dn.exact=“cn=libuser,dc=directory,dc=nh” peername.ip=“127.0.0.1” write
by users ssf=71 read by anonymous read by * none
I tried these two solutions : this link, first
…and this :
/etc/e-smith/events/actions/nethserver-nextcloud-occ-conf ev
I think the problem is rather different and may be linked with ACLs
because when i try to detect the base DN, i still get an error : “the
base DN could not be automatically detected. Check the informations of
authentification…” which i get from the dashboard Status > Domain accounts
I must say i made two mistakes :
first, as the server as been build recently i didn’t make any backup
yet (too late…) ;
the second one is that i deleted the original OpenLDAP config from
nextcloud and tried to create a new one after the updates broke it. Bad
idea.
So don’t loose too many time dealing with it : i’m responsible if it
can’t be solved.
after fresh install of NS7 RC2 and changing from OpenLDAP to Samba Active Directory everything works good. I have access to Nextcloud and SOGo, can send mails without problems and have also access to the user administration in Nextcloud.
After updating to rc2 I presented the same authentication issue with nextcloud but thank to your tunning, Nextcloud authenticated again. In the same server I am running squid, sogo, ejabberd and nextclound but none of them, except nextcloud, presented authentication issues after updating to rc2. However, remote applications (like Apache and Cacti) configured to use openLDAP authentication from a central nethserver (the same where sogo, ejabberd and nextcloud are in) stopped authenticating. Such remote applications did authenticate before the rc2 update but no longer now.
Confirmed. My latest updates to sssd and directory are broken.
issue 0: nextcloud config does not use NethServer::SSSD. The fix is trivial and @alepalready prepared it.
issue 1: the NethServer::SSSD library returns "BindDN": "cn=ldapservice,dc=dpnet,dc=nethesis,dc=it", but ACLs on slapd are configured by dn.exact="cn=ldapservice,dc=directory,dc=nh" read. The suffix is wrong. Luckily subsequent ACLs grant access anyway and this permits apps to work, as @areguera claims.
issue 2: libuser binds from external hosts; I tried to reproduce the problem without success. Still digging…