schooltool authentication fails when used with zentyal usercorner

Bug #1279265 reported by Samuli Valavuo on 2014-02-12
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
SchoolTool
High
Douglas Cerna

Bug Description

I have SchoolTool on same machine with Zentyal.
SchoolTool authenticates against Zentyal LDAP.
Everything worked fine until I logged in to Zentyal UserCorner. After that I can't log into SchoolTool at all.

Tried to purge and reinstall SchoolTool -> no success
Tried to purge and reinstall SchoolTool.ldap -> no success
Tried to purge Zentyal UserCorner -> no success

I have no idea what to do next.
Even manager -account doesn't log in.

Zentyal UserCorner uses email address of the user as account name
SchoolTool uses users uid (from LDAP) as account name

/var/log/schooltool/error.log:
--- snip ---
2014-02-12 10:53:49,768 Competing writes/reads at /++vh++http:192.168.101.233:80/koulu/++/@@/schooltool.skin.flourish/flourish.css: database conflict error (oid 0x010a, class BTrees.OOBTree.OOBTree, serial this txn started with 0x03a4bf55d3a2d344 2014-02-12 08:53:49.602196, serial currently committed 0x03a4bf55d3e33c77 2014-02-12 08:53:49.661166)
2014-02-12 10:53:49,769 Competing writes/reads at /++vh++http:192.168.101.233:80/koulu/++/@@/schooltool.skin.flourish/page.css: database conflict error (oid 0x010a, class BTrees.OOBTree.OOBTree, serial this txn started with 0x03a4bf55d3a2d344 2014-02-12 08:53:49.602196, serial currently committed 0x03a4bf55d3e33c77 2014-02-12 08:53:49.661166)
2014-02-12 10:53:49,772 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:49,770 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:49,820 Competing writes/reads at /++vh++http:192.168.101.233:80/koulu/++/@@/schooltool.skin.flourish/flourish.css: database conflict error (oid 0x010a, class BTrees.OOBTree.OOBTree, serial this txn started with 0x03a4bf55d3e33c77 2014-02-12 08:53:49.661166, serial currently committed 0x03a4bf55d4731700 2014-02-12 08:53:49.792868)
2014-02-12 10:53:49,823 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:50,003 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:50,005 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:56,465 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,183 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,268 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,333 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,500 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,519 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,551 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,556 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,623 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,641 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,758 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,769 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,770 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,775 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,811 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,880 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,881 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:58,139 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:58,146 Illegal key value: EBox::UserCorner::Auth_EBox
--- snip ---

Samuli Valavuo (svalavuo) wrote :

This can be closed.
I don't actually know what I did, but now it's working again.
(I removed a lot of software and installed some back).

Changed in schooltool:
status: New → Invalid
Samuli Valavuo (svalavuo) wrote :

I reproduced this bug.
When user logs into Zentyal UserCorner, the whole SchoolTool authentication breaks.
LDAP -accounts doesn't work, but manager -accoutn can't log in either.
Same error as before.

Changed in schooltool:
status: Invalid → New
Samuli Valavuo (svalavuo) wrote :

I removed SchoolTool from that server, then I removed Zentyal UserCorner (apt-get purge). Then I reinstalled SchoolTool (fresh installation) and the same errors happens.
If I try to log in with manager account, SchoolTool gives me error:
"Sinulla ei ole oikeuksia lukea tätä sivua. Paina selaimesi Takaisin-painiketta tai pyydä käyttäjää, jolla on suuremmat käyttöoikeudet, kirjautumaan sisään.".

That's Finnish and is about same as "You don't have right to read this page. Click Back -button of your browser or ask user with greater access rights to log in".

log gives the same error(s) "Illegal key value: EBox::UserCorner::Auth_EBox"

Gediminas Paulauskas (menesis) wrote :

Not sure what happens, and where the "Illegal key value: EBox::UserCorner::Auth_EBox" comes from. Maybe it is the value of some variable in the config file "/etc/ldap.conf"?

To allow you to login and configure LDAP through the web, edit /etc/schooltool/standard/schooltool.conf and add this snippet:

<ldap_authentication>
  allow_web_config no
</ldap_authentication>

This is written in http://book.schooltool.org/ldap.html#advanced-configuration

Samuli Valavuo (svalavuo) wrote :

I removed SchoolTool and all dependencies. Reinstalled SchoolTool without LDAP and the same problem continues.
LDAP authentication worked like charm before I logged into Zentyal UserCorner. After that even removing UserCorner and SchoolTool doesn't help. I try to purge all once again (Zentyal and SchoolTool) and try to install everything again (without UserCorner).

Samuli Valavuo (svalavuo) wrote :

Sorry, I missed that #4.
In setup described in #3, I don't even have schooltool.ldap installed.
So the error came with plain SchoolTool.

I installed my virtual machine from scratch (Ubuntu, Zentyal & SchoolTool) without Zentyal UserCorner.
Everything works now, but now I have new problem: without UserCorner I don't have any way to allow users to change their passwords (in Zentyal LDAP). :(

Samuli Valavuo (svalavuo) wrote :

Does this help?
http://oldtracker.zentyal.org/ticket/3272

I tried to go through schooltool files, but there are so many of them and I don't know where to start...
I don't know how to program with python, I'm php - (t)sql guy so I can't follow how this program works. :)

Tom Hoffman (tom-hoffman) wrote :

Well, it might help. Otherwise I couldn't even start to imagine how Zentyal would break SchoolTool's authorization. We'll look into it.

Yes, SchoolTool is very difficult to follow for everyone, unfortunately.

Changed in schooltool:
status: New → Triaged
importance: Undecided → High
assignee: nobody → Douglas Cerna (replaceafill)
milestone: none → 2.7.0
Samuli Valavuo (svalavuo) wrote :

It seems that it's enough that you install Zentyal UserCorner. That modifies something (can't figure out what).

I tried to take snapshot of my virtual server before installing UserCorner, but even after rastoring to that snapshot, SchoolTool authentication was broken.
I quess that Xenserver doesn't take full disk image, because SchoolTool remained broken.

Gediminas Paulauskas (menesis) wrote :

The bug you referenced in Comment #7 explains what is happening.

The UserCorner sets a cookie with an invalid name, and other applications on the same domain fail to parse the HTTP request.

So reinstall does not help. Clearing browser cookies, or better, deleting a cookie from your server's domain, should solve the issue. You can try another browser or an incognito window, do not go to UserCorner, but straight to SchoolTool.

There is a workaround in that bug, you need to modify one system file.

Samuli Valavuo (svalavuo) wrote :

Ok. UserCorner uses email -address as username and SchoolTool uses uid. That might be the reason as you mentioned.
Could you give the instructions to make that workaround? I could try to use it.

Gediminas Paulauskas (menesis) wrote :

No, if email and username do not match, you have to set "User DN queries" in schooltool ldap configuration accordingly.

The Illegal key error. No it seems the ticket refers to a similar issue, but in a different place.

What version of Zentyal?

Changed in schooltool:
milestone: 2.7.0 → 2.8.0
Changed in schooltool:
milestone: 2.8.2 → none
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.