schooltool authentication fails when used with zentyal usercorner

[Samuli Valavuo]

I have SchoolTool on same machine with Zentyal.
SchoolTool authenticates against Zentyal LDAP.
Everything worked fine until I logged in to Zentyal UserCorner. After that I can't log into SchoolTool at all.

Tried to purge and reinstall SchoolTool -> no success
Tried to purge and reinstall SchoolTool.ldap -> no success
Tried to purge Zentyal UserCorner -> no success

I have no idea what to do next.
Even manager -account doesn't log in.

Zentyal UserCorner uses email address of the user as account name
SchoolTool uses users uid (from LDAP) as account name

/var/log/schooltool/error.log:
--- snip ---
2014-02-12 10:53:49,768 Competing writes/reads at /++vh++http:192.168.101.233:80/koulu/++/@@/schooltool.skin.flourish/flourish.css: database conflict error (oid 0x010a, class BTrees.OOBTree.OOBTree, serial this txn started with 0x03a4bf55d3a2d344 2014-02-12 08:53:49.602196, serial currently committed 0x03a4bf55d3e33c77 2014-02-12 08:53:49.661166)
2014-02-12 10:53:49,769 Competing writes/reads at /++vh++http:192.168.101.233:80/koulu/++/@@/schooltool.skin.flourish/page.css: database conflict error (oid 0x010a, class BTrees.OOBTree.OOBTree, serial this txn started with 0x03a4bf55d3a2d344 2014-02-12 08:53:49.602196, serial currently committed 0x03a4bf55d3e33c77 2014-02-12 08:53:49.661166)
2014-02-12 10:53:49,772 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:49,770 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:49,820 Competing writes/reads at /++vh++http:192.168.101.233:80/koulu/++/@@/schooltool.skin.flourish/flourish.css: database conflict error (oid 0x010a, class BTrees.OOBTree.OOBTree, serial this txn started with 0x03a4bf55d3e33c77 2014-02-12 08:53:49.661166, serial currently committed 0x03a4bf55d4731700 2014-02-12 08:53:49.792868)
2014-02-12 10:53:49,823 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:50,003 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:50,005 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:56,465 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,183 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,268 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,333 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,500 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,519 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,551 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,556 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,623 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,641 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,758 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,769 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,770 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,775 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,811 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,880 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:57,881 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:58,139 Illegal key value: EBox::UserCorner::Auth_EBox
2014-02-12 10:53:58,146 Illegal key value: EBox::UserCorner::Auth_EBox
--- snip ---

[Samuli Valavuo (svalavuo)]

This can be closed.
I don't actually know what I did, but now it's working again.
(I removed a lot of software and installed some back).

[Samuli Valavuo (svalavuo)]

I reproduced this bug.
When user logs into Zentyal UserCorner, the whole SchoolTool authentication breaks.
LDAP -accounts doesn't work, but manager -accoutn can't log in either.
Same error as before.

[Samuli Valavuo (svalavuo)]

I removed SchoolTool from that server, then I removed Zentyal UserCorner (apt-get purge). Then I reinstalled SchoolTool (fresh installation) and the same errors happens.
If I try to log in with manager account, SchoolTool gives me error:
"Sinulla ei ole oikeuksia lukea tätä sivua. Paina selaimesi Takaisin-painiketta tai pyydä käyttäjää, jolla on suuremmat käyttöoikeudet, kirjautumaan sisään.".

That's Finnish and is about same as "You don't have right to read this page. Click Back -button of your browser or ask user with greater access rights to log in".

log gives the same error(s) "Illegal key value: EBox::UserCorner::Auth_EBox"

[Gediminas Paulauskas (menesis)]

Not sure what happens, and where the "Illegal key value: EBox::UserCorner::Auth_EBox" comes from. Maybe it is the value of some variable in the config file "/etc/ldap.conf"?

To allow you to login and configure LDAP through the web, edit /etc/schooltool/standard/schooltool.conf and add this snippet:

<ldap_authentication>
  allow_web_config no
</ldap_authentication>

This is written in http://book.schooltool.org/ldap.html#advanced-configuration

[Samuli Valavuo (svalavuo)]

I removed SchoolTool and all dependencies. Reinstalled SchoolTool without LDAP and the same problem continues.
LDAP authentication worked like charm before I logged into Zentyal UserCorner. After that even removing UserCorner and SchoolTool doesn't help. I try to purge all once again (Zentyal and SchoolTool) and try to install everything again (without UserCorner).

[Samuli Valavuo (svalavuo)]

Sorry, I missed that #4.
In setup described in #3, I don't even have schooltool.ldap installed.
So the error came with plain SchoolTool.

I installed my virtual machine from scratch (Ubuntu, Zentyal & SchoolTool) without Zentyal UserCorner.
Everything works now, but now I have new problem: without UserCorner I don't have any way to allow users to change their passwords (in Zentyal LDAP). :(

[Samuli Valavuo (svalavuo)]

Does this help?
http://oldtracker.zentyal.org/ticket/3272

I tried to go through schooltool files, but there are so many of them and I don't know where to start...
I don't know how to program with python, I'm php - (t)sql guy so I can't follow how this program works. :)

[Tom Hoffman (tom-hoffman)]

Well, it might help. Otherwise I couldn't even start to imagine how Zentyal would break SchoolTool's authorization. We'll look into it.

Yes, SchoolTool is very difficult to follow for everyone, unfortunately.

[Samuli Valavuo (svalavuo)]

It seems that it's enough that you install Zentyal UserCorner. That modifies something (can't figure out what).

I tried to take snapshot of my virtual server before installing UserCorner, but even after rastoring to that snapshot, SchoolTool authentication was broken.
I quess that Xenserver doesn't take full disk image, because SchoolTool remained broken.

[Gediminas Paulauskas (menesis)]

The bug you referenced in Comment #7 explains what is happening.

The UserCorner sets a cookie with an invalid name, and other applications on the same domain fail to parse the HTTP request.

So reinstall does not help. Clearing browser cookies, or better, deleting a cookie from your server's domain, should solve the issue. You can try another browser or an incognito window, do not go to UserCorner, but straight to SchoolTool.

There is a workaround in that bug, you need to modify one system file.

[Samuli Valavuo (svalavuo)]

Ok. UserCorner uses email -address as username and SchoolTool uses uid. That might be the reason as you mentioned.
Could you give the instructions to make that workaround? I could try to use it.

[Gediminas Paulauskas (menesis)]

No, if email and username do not match, you have to set "User DN queries" in schooltool ldap configuration accordingly.

The Illegal key error. No it seems the ticket refers to a similar issue, but in a different place.

What version of Zentyal?