Can't login using LDAP

[poperigby]

I'm using LLDAP for my LDAP provider, but whenever I try to login with a user besides the admin, I get a 401 error on the webpage, and this output in the Radicale log:

[2024-09-17 12:18:26 -0700] [1479652/Thread-15 (process_request_thread)] [INFO] PROPFIND request for '/' received from 127.0.0.1 (forwarded for '192.168.1.1') using 'Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0'
[2024-09-17 12:18:26 -0700] [1479652/Thread-15 (process_request_thread)] [INFO] Access to '/' denied for anonymous user
[2024-09-17 12:18:26 -0700] [1479652/Thread-15 (process_request_thread)] [INFO] PROPFIND response status for '/' in 0.000 seconds: 401 Unauthorized
[2024-09-17 12:18:26 -0700] [1479652/Thread-16 (process_request_thread)] [INFO] PROPFIND request for '/' received from 127.0.0.1 (forwarded for '192.168.1.1') using 'Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0'
[2024-09-17 12:18:27 -0700] [1479652/Thread-16 (process_request_thread)] [WARNING] Failed login attempt from 127.0.0.1 (forwarded for '192.168.1.1'): 'cassidy'
[2024-09-17 12:18:28 -0700] [1479652/Thread-16 (process_request_thread)] [INFO] PROPFIND response status for '/' in 1.531 seconds: 401 Unauthorized

This is my Radicale configuration:

[auth]
type = ldap
ldap_uri = ldap://localhost:3890
ldap_base = dc=haddock,dc=cc
ldap_reader_dn = uid=radicale,ou=people,dc=haddock,dc=cc
ldap_secret = REDACTED
ldap_filter = (objectClass=person)
lc_username = True

This is my LLDAP configuration:

database_url = "postgresql://lldap@localhost/lldap?host=/run/postgresql"
http_host = "::"
http_port = 17170
http_url = "http://localhost"
ldap_base_dn = "dc=haddock,dc=cc"
ldap_host = "::"
ldap_port = 3890
ldap_user_dn = "admin"
ldap_user_email = "admin@haddock.cc"
verbose = true

This is the output of my LLDAP log when logging in: https://gist.github.com/poperigby/59d7208c23b9a830ed3634bab7b3cfaf

I'm using Radicale from 7fbc0e7

[pbiering]

@petervarkoly : can you further support? Potentially FAQ in Wiki would be helpful?

[petervarkoly]

@poperigby The LDAP filter must contain a python format string with a placeholder for the loginname like:

(&(objectClass=person)(cn={0}))

[poperigby]

Alright, I changed my filter to use that, but I still can't login 😕

Here's my LLDAP log from trying to login: https://gist.github.com/poperigby/0ade6bfafc73f0ac9a8418b632e831d6

[petervarkoly]

@PeterBieringer Of course Do you mean this wiki: https://github.com/Kozea/Radicale/wiki ? Dipl. Ing. Péter Varkoly EDV/IT Beratung +49-15257491205 i.A. Cranix-Solutions GmbH Steuernummer: 238/283/00067 Ust-ID: DE257896578

…

________________________________ Von: Peter Bieringer ***@***.***> Gesendet: Dienstag, 17. September 2024 21:27 An: Kozea/Radicale ***@***.***> Cc: Peter Varkoly ***@***.***>; Mention ***@***.***> Betreff: Re: [Kozea/Radicale] Can't login using LDAP (Discussion #1572) @petervarkoly<https://github.com/petervarkoly> : can you further support? Potentially FAQ in Wiki would be helpful? — Reply to this email directly, view it on GitHub<#1572 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAVBKUKMDLMVVCPDBCYBGVTZXB7DHAVCNFSM6AAAAABOMEQNGKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANRXGQZTKNQ>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[pbiering]

Yes

[poperigby]

Is @petervarkoly intending on updating the wiki with a fix for this? I'm still not sure what to do.

[petervarkoly]

Please start Radicale in debug mode and send the logs. Dipl.-Ing. Péter Varkoly CRANIX Solutions Am 20.09.2024 um 20:03 schrieb PopeRigby ***@***.***>:  Alright, I changed my filter to use that, but I still can't login 😕 Here's my LLDAP log from trying to login: https://gist.github.com/poperigby/0ade6bfafc73f0ac9a8418b632e831d6 — Reply to this email directly, view it on GitHub<#1572 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAVBKUI7BBTYUB354XLDK6TZXRPQVAVCNFSM6AAAAABOMEQNGKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANZQHAYTGNY>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[poperigby]

Sure. Here you go: https://gist.github.com/poperigby/6eded2b1dfe2af41b099cfdd2903c36b

[petervarkoly]

Hi, I've analysed the logs and they show me only that the search was unsuccessfull. In the log of the ldap-server you can see 2024-09-20T17:58:51.522024615+00:00 DEBUG ┝━ 🐛 [debug]: | msg: LdapMsg { msgid: 6, op: SearchRequest(LdapSearchRequest { base: "dc=haddock,dc=cc", scope: Subtree, aliases: Always, sizelimit: 0, timelimit: 0, typesonly: false, f Equality("cn", "cassidy")]), attrs: ["memberOf"] }), ctrl: [] } 2024-09-20T17:58:51.522025385+00:00 DEBUG ┝━ do_search [ 700µs | 0.38% / 1.04% ] 2024-09-20T17:58:51.522693360+00:00 DEBUG │ ┝━ 🐛 [debug]: | request.base: "dc=haddock,dc=cc" | scope: Global 2024-09-20T17:58:51.522695850+00:00 DEBUG │ ┝━ get_user_list [ 214µs | 0.02% / 0.32% ] 2024-09-20T17:58:51.522701270+00:00 DEBUG │ │ ┝━ 🐛 [debug]: | filters: And([And([]), Equality(DisplayName, "cassidy")]) 2024-09-20T17:58:51.522704970+00:00 DEBUG │ │ ┕━ list_users [ 199µs | 0.30% ] filters: Some(And([And([]), Equality(DisplayName, "cassidy")])) | _get_groups: true 2024-09-20T17:58:51.524512582+00:00 DEBUG │ │ ┕━ 🐛 [debug]: | return: [] The result is empty. That is what the Radicale log say also: [2024-09-20 13:26:09 -0700] [3213105/Thread-2 (process_request_thread)] [DEBUG] _login3 ldap://localhost:3890, uid=radicale,ou=people,dc=haddock,dc=cc [2024-09-20 13:26:09 -0700] [3213105/Thread-2 (process_request_thread)] [DEBUG] _login3 bind as uid=radicale,ou=people,dc=haddock,dc=cc [2024-09-20 13:26:09 -0700] [3213105/Thread-2 (process_request_thread)] [DEBUG] _login3 user 'cassidy' can not be find Is really the "cn" the right attribute to search? Your reader dn has the attribute "uid": "uid=radicale,ou=people,dc=haddock,dc=cc" Dipl. Ing. Péter Varkoly EDV/IT Beratung +49-15257491205 i.A. Cranix-Solutions GmbH Steuernummer: 238/283/00067 Ust-ID: DE257896578

…

________________________________ Von: PopeRigby ***@***.***> Gesendet: Freitag, 20. September 2024 22:27 An: Kozea/Radicale ***@***.***> Cc: Peter Varkoly ***@***.***>; Mention ***@***.***> Betreff: Re: [Kozea/Radicale] Can't login using LDAP (Discussion #1572) Sure. Here you go: https://gist.github.com/poperigby/6eded2b1dfe2af41b099cfdd2903c36b — Reply to this email directly, view it on GitHub<#1572 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAVBKUPZPP43DDH6Y7KC7IDZXSAK5AVCNFSM6AAAAABOMEQNGKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANZQHEZDAMA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[poperigby]

That totally worked! Here's my final config for future reference:

[auth]
type = ldap
ldap_uri = ldap://localhost:3890
ldap_base = dc=haddock,dc=cc
ldap_reader_dn = uid=radicale,ou=people,dc=haddock,dc=cc
ldap_secret = REDACTED
ldap_filter = (&(objectClass=person)(uid={0}))
lc_username = True

[petervarkoly]

Thaks for reply. We can close this issue.

[pbiering]

Wiki updated provided example, @petervarkoly thank you for the Wiki page.