LDAP support auth not working

Bug #1241632 reported by Oliver Mueller
54
This bug affects 10 people
Affects Status Importance Assigned to Milestone
ejabberd
Fix Released
Unknown
ejabberd (Debian)
Fix Released
Unknown
ejabberd (Ubuntu)
Fix Released
Undecided
Unassigned
Trusty
Fix Released
Medium
Unassigned

Bug Description

I updated to ubuntu saucy and after the update, the LDAP auth is not working anymore. I didn't change the configuration and the LDAP itself is running and working for many other services. Only ejabberd is unable to bind.

The following log entries repeat constantly without users trying to access the system.

=INFO REPORT==== 2013-10-18 13:17:31 ===
I(<0.291.0>:eldap:983) : LDAP connection on bohr.teqneers.de:389

=WARNING REPORT==== 2013-10-18 13:17:31 ===
W(<0.288.0>:eldap:931) : LDAP bind failed on bohr.teqneers.de:389
Reason: {undef,[{asn1rt_ber_bin,decode_tag,
                                [<<48,13,2,2,3,49,97,7,10,1,0,4,0,4,0>>],
                                []},
                {eldap,check_tag,1,[{file,"eldap.erl"},{line,911}]},
                {eldap,recvd_wait_bind_response,2,
                       [{file,"eldap.erl"},{line,876}]},
                {eldap,handle_info,3,[{file,"eldap.erl"},{line,571}]},
                {gen_fsm,handle_msg,7,[{file,"gen_fsm.erl"},{line,505}]},
                {proc_lib,init_p_do_apply,3,
                          [{file,"proc_lib.erl"},{line,239}]}]}

=INFO REPORT==== 2013-10-18 13:17:31 ===
I(<0.38.0>:ejabberd_app:89) : ejabberd 2.1.10 is stopped in the node ejabberd@bohr

==> /var/log/ejabberd/erlang.log <==
          supervisor: {local,ejabberd_sup}
             started: [{pid,<0.493.0>},
                       {name,'ejabberd_mod_caps_chat.teqneers.de'},
                       {mfargs,{mod_caps,start_link,["chat.teqneers.de",[]]}},
                       {restart_type,transient},
                       {shutdown,1000},
                       {child_type,worker}]

=PROGRESS REPORT==== 18-Oct-2013::13:10:20 ===
          supervisor: {local,ejabberd_sup}
             started: [{pid,<0.500.0>},
                       {name,'ejabberd_mod_irc_sup_chat.teqneers.de'},
                       {mfargs,
                           {ejabberd_tmp_sup,start_link,
                               ['ejabberd_mod_irc_sup_chat.teqneers.de',
                                mod_irc_connection]}},
                       {restart_type,permanent},
                       {shutdown,infinity},
                       {child_type,supervisor}]

=PROGRESS REPORT==== 18-Oct-2013::13:10:20 ===
          supervisor: {local,ejabberd_sup}
             started: [{pid,<0.501.0>},
                       {name,'ejabberd_mod_irc_chat.teqneers.de'},
                       {mfargs,{mod_irc,start_link,["chat.teqneers.de",[]]}},
                       {restart_type,temporary},
                       {shutdown,1000},
                       {child_type,worker}]

=PROGRESS REPORT==== 18-Oct-2013::13:10:20 ===
          supervisor: {local,ejabberd_sup}
             started: [{pid,<0.506.0>},
                       {name,'ejabberd_mod_muc_sup_chat.teqneers.de'},
                       {mfargs,
                           {ejabberd_tmp_sup,start_link,
                               ['ejabberd_mod_muc_sup_chat.teqneers.de',
                                mod_muc_room]}},
                       {restart_type,permanent},
                       {shutdown,infinity},
                       {child_type,supervisor}]

=PROGRESS REPORT==== 18-Oct-2013::13:10:20 ===
          supervisor: {local,ejabberd_sup}
             started: [{pid,<0.507.0>},
                       {name,'ejabberd_mod_muc_chat.teqneers.de'},
                       {mfargs,
                           {mod_muc,start_link,
                               ["chat.teqneers.de",
                                [{access,muc},
                                 {access_create,muc},
                                 {access_persistent,muc},
                                 {access_admin,muc_admin},
                                 {history_size,5000},
                                 {max_users,500},
                                 {default_room_options,
                                     [{allow_change_subj,false},
                                      {allow_private_messages,true},
                                      {allow_user_invites,false},
                                      {anonymous,false},
                                      {logging,true},
                                      {members_by_default,true},
                                      {persistent,false},
                                      {public,false},
                                      {public_list,false}]}]]}},
                       {restart_type,temporary},
                       {shutdown,1000},
                       {child_type,worker}]

Revision history for this message
Oliver Mueller (oliver-vpr) wrote :

Sorry, forgot my current LDAP conf from ejabberd.conf

%%% ==============
%%% AUTHENTICATION

%%
%% auth_method: Method used to authenticate the users.
%% The default method is the internal.
%% If you want to use a different method,
%% comment this line and enable the correct ones.
%%
%%{auth_method, internal}.

%%
%% Authentication using external script
%% Make sure the script is executable by ejabberd.
%%
%%{auth_method, external}.
%%{extauth_program, "/path/to/authentication/script"}.

%%
%% Authentication using ODBC
%% Remember to setup a database in the next section.
%%
%%{auth_method, odbc}.

%%
%% Authentication using PAM
%%
%%{auth_method, pam}.
%%{pam_service, "pamservicename"}.

%%
%% Authentication using LDAP
%%
{auth_method, ldap}.
%%
%% List of LDAP servers:
{ldap_servers, ["localhost"]}.
%%
%% Encryption of connection to LDAP servers (LDAPS):
{ldap_encrypt, none}.
%%{ldap_encrypt, tls}.
%%
%% Port connect to LDAP server:
{ldap_port, 389}.
%%{ldap_port, 636}.
%%
%% LDAP manager:
%%{ldap_rootdn, "dc=example,dc=com"}.
%%
%% Password to LDAP manager:
%%{ldap_password, ""}.
%%
%% Search base of LDAP directory:
{ldap_base, "ou=group,dc=teqneers,dc=de"}.
%%
%% LDAP attribute that holds user ID:
%%{ldap_uids, [{"mail", "%<email address hidden>"}]}.
{ldap_uids, [{"uid","%u"}]}.
%%
%% LDAP filter:
%%{ldap_filter, "(objectClass=shadowAccount)"}.
{ldap_filter, "(objectClass=shadowAccount)"}.

Revision history for this message
Konstantin Khomoutov (flatworm) wrote :

Looks like you've hit [1] because Saucy has Erlang 16B packaged [2] while Debian Testing (from which this version of ejabberd had supposedly been pulled) has the previous Erlang version packaged, R15B [3] and so the bug is not triggered there.

That's just triaging, I don't know how's best to fix it. Will report back later.

1. https://support.process-one.net/browse/EJAB-1612
2. http://packages.ubuntu.com/saucy/erlang-base
3. http://packages.debian.org/wheezy/erlang-base

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in ejabberd (Ubuntu):
status: New → Confirmed
Revision history for this message
Andrew Snare (ajs-deactivatedaccount) wrote :

The upstream fix was included in ejabberd 2.1.12, and really quite small: https://github.com/processone/ejabberd/commit/2704378d43035474c5f3d8a656b81c7bc28b5ff9

If it proves too difficult to package the newer release, it should be fairly simple to apply the same fix to the 2.1.10 release.

Revision history for this message
Rhonda D'Vine (rhonda) wrote : Re: [Bug 1241632] Re: LDAP support auth not working

* Konstantin Khomoutov <email address hidden> [2013-10-18 17:18:45 CEST]:
> Looks like you've hit [1] because Saucy has Erlang 16B packaged [2]
> while Debian Testing (from which this version of ejabberd had supposedly
> been pulled) has the previous Erlang version packaged, R15B [3] and so
> the bug is not triggered there.

 Well, [3] is wheezy (which is stable now), not testing. So the issue
also affects Debian testing. :)

 Given that 2.1.12 does fix the issue, I plan to update to 2.1.13 in the
next few days in Debian to fix this issue for Debian. For saucy, we
would need to pull in the change to a saucy update given that saucy has
been released already.

 Enjoy,
Rhonda
--
Fühlst du dich mutlos, fass endlich Mut, los |
Fühlst du dich hilflos, geh raus und hilf, los | Wir sind Helden
Fühlst du dich machtlos, geh raus und mach, los | 23.55: Alles auf Anfang
Fühlst du dich haltlos, such Halt und lass los |

Revision history for this message
Konstantin Khomoutov (flatworm) wrote :

Fix committed [1].

While testing the fix I discovered that LDAPS (LDAP over SSL) fails to work. This has been found to be caused by R16 compat issues as well, and unfortunately, this will be harder to fix as the problem is about module name clashes between ejabberd and Erlang. Will file a separate bug report for that.

1. http://git.deb.at/w/pkg/ejabberd.git/commit/566ed3c18c94bb2a28ecd4ee11a76396a346e806

Changed in ejabberd:
status: Unknown → New
Changed in ejabberd (Debian):
status: Unknown → New
Revision history for this message
Deokgon Kim (dgkim) wrote :

Will it be fixed on 13.10 Saucy ?

I have fixed manually.

1. download 2.1.10 source.

2. apply patch on src/eldap.erl

3. compile with following command.
erlc -DSSL40 -I ../ -pz ../ eldapd.erl

4. replace eldap.beam (/usr/lib/ejabberd/ebin/eldap.beam)

Revision history for this message
Karsten Richter (acc+launchpad) wrote :

Fix for Trusty (following dgkim's solution):

1. download https://launchpad.net/ubuntu/trusty/+source/ejabberd/2.1.11-1ubuntu2/+files/ejabberd_2.1.11-1ubuntu2.tar.gz
2. apply flatforms patch on src/eldap.erl
3. Compile the ASN.1 dependency: erlc -bber ELDAPv3.asn
4. Compile eldap.erl: erlc -DSSL40 -I ../ -pz ../ eldap.erl
5. replace eldap.beam in /usr/lib/ejabberd/ebin/

NOTE: also for saucy I'm quite sure it is eldap.erl and not eldapd.erl (typo in dgkims solution).

LDAP auth works again like a charm after that patch (ejabberd 2.1.11 on trusty AMD64)

Revision history for this message
Johan Smits (johan-smits) wrote :

is there a proposed deb available?

Changed in ejabberd (Ubuntu Trusty):
status: New → Confirmed
Revision history for this message
Paul van Tilburg (paulvt) wrote :

For convenience, this patch applies if appended to the quilt patch series on Trusty's ejabberd (i.e. 2.1.11-1ubuntu2).

Source: https://github.com/processone/ejabberd/commit/2704378d43035474c5f3d8a656b81c7bc28b5ff9.

Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "fix-LDAP-support-with-erlang-R16A.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags: added: patch
Revision history for this message
Lionel Porcheron (lionel.porcheron) wrote :

Hi Paul,

Sorry, I did not see your patch. I was preparing a patch. I have just uploaded a fix in Utopic and I'm now preparing an upload for trusty.

Revision history for this message
Lionel Porcheron (lionel.porcheron) wrote :

Stable Realse Update

[IMPACT]

* ejabbard with LDAP authentication enabled.
* user can not authenticate anymore with LDAP backend
* details in upstream bug: https://support.process-one.net/browse/EJAB-1612

[TESTCASE]

Install and ejabbard with LDAP authentication backend.
Without this patch, authentication will fail. With the patch, authentication will work again.

[REGRESSION POTENTIAL]

Minimal, fix is upstream and applied in new ejabberd versions.

This fix was validated on our production (with an ejabbard using LDAP with about 100 accounts).

Revision history for this message
Lionel Porcheron (lionel.porcheron) wrote :

ejabberd_2.1.11-1ubuntu2.1 with the fix have been uploaded to trusty-proposed and is waiting for SRU Team validation.

Revision history for this message
Chris J Arges (arges) wrote : Please test proposed package

Hello Oliver, or anyone else affected,

Accepted ejabberd into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/ejabberd/2.1.11-1ubuntu2.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in ejabberd (Ubuntu Trusty):
status: Confirmed → Fix Committed
tags: added: verification-needed
Changed in ejabberd (Ubuntu Trusty):
importance: Undecided → Medium
Revision history for this message
Johan Smits (johan-smits) wrote :

Tested ejabberd_2.1.11-1ubuntu2.1_amd64.deb from the proposed and it solves the problem.

tags: added: verification-done
removed: verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ejabberd - 2.1.11-1ubuntu3

---------------
ejabberd (2.1.11-1ubuntu3) utopic; urgency=low

  * Fix LDAP authentication (LP: #1241632)
    - debian/patches/fix-erlang-r16b-compat.patch: backport upstream
      fix for Erlang 16b compatibility.
    - upstream reference: https://support.process-one.net/browse/EJAB-1612
  * Add ufw profile (LP: #1254688)
 -- Lionel Porcheron <email address hidden> Mon, 28 Apr 2014 13:27:21 +0200

Changed in ejabberd (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ejabberd - 2.1.11-1ubuntu2.1

---------------
ejabberd (2.1.11-1ubuntu2.1) trusty; urgency=low

  * Fix LDAP authentication (LP: #1241632)
    - debian/patches/fix-erlang-r16b-compat.patch: backport upstream
      fix for Erlang 16b compatibility.
    - upstream reference: https://support.process-one.net/browse/EJAB-1612
 -- Lionel Porcheron <email address hidden> Mon, 28 Apr 2014 12:09:12 +0200

Changed in ejabberd (Ubuntu Trusty):
status: Fix Committed → Fix Released
Revision history for this message
Chris Halse Rogers (raof) wrote : Update Released

The verification of the Stable Release Update for ejabberd has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Changed in ejabberd:
status: New → Confirmed
Changed in ejabberd (Debian):
status: New → Confirmed
Changed in ejabberd:
status: Confirmed → Fix Committed
Changed in ejabberd (Debian):
status: Confirmed → Fix Committed
Changed in ejabberd:
status: Fix Committed → Fix Released
Changed in ejabberd (Debian):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.