LDAP authentication failed - no such object

[MichaelUray]

When I try to login with the user "fd-admin" and the password "admin", then it always ends with the following error:

LDAP-Fehler
LDAP Authentifizierung fehlgeschlagen!Fehler: No such object (während der Arbeit auf LDAP-Server 'ldap://openldap-fusiondirectory-app:389')
Bitte beheben Sie obigen Fehler und laden die Seite neu.

What could cause this issue?

The LDAP server shows the following output at that moment:

openldap-fusiondirectory-app    | 61d0bfba.378de8c0 0x7f2b022ccb38 conn=1045 fd=17 ACCEPT from IP=172.18.0.3:51658 (IP=0.0.0.0:389)
openldap-fusiondirectory-app    | 61d0bfba.379014bb 0x7f2b02acfb38 conn=1045 op=0 BIND dn="cn=admin,dc=uray,dc=lan" method=128
openldap-fusiondirectory-app    | 61d0bfba.379083bd 0x7f2b02acfb38 conn=1045 op=0 BIND dn="cn=admin,dc=uray,dc=lan" mech=SIMPLE bind_ssf=0 ssf=0
openldap-fusiondirectory-app    | 61d0bfba.37915e39 0x7f2b02acfb38 conn=1045 op=0 RESULT tag=97 err=0 qtime=0.000022 etime=0.000119 text=
openldap-fusiondirectory-app    | 61d0bfba.3794985e 0x7f2b022ccb38 conn=1045 op=1 SRCH base="cn=config,ou=fusiondirectory,dc=uray,dc=lan" scope=0 deref=0 filter="(objectClass=*)"
openldap-fusiondirectory-app    | 61d0bfba.3794d912 0x7f2b022ccb38 conn=1045 op=1 SRCH attr=*
openldap-fusiondirectory-app    | 61d0bfba.3795bedc 0x7f2b022ccb38 conn=1045 op=1 SEARCH RESULT tag=101 err=32 qtime=0.000005 etime=0.000100 nentries=0 text=
openldap-fusiondirectory-app    | 61d0bfba.37a123ef 0x7f2b02acfb38 conn=1045 op=2 UNBIND
openldap-fusiondirectory-app    | 61d0bfba.37a29698 0x7f2b02acfb38 conn=1045 fd=17 closed

Is this actually correct, that the search base is cn=config,ou=fusiondirectory,dc=uray?

These are the two docker-compose files which I use:

version: '3.7'
services:

  fusiondirectory-app:
    container_name: fusiondirectory-app
    image: tiredofit/fusiondirectory
    ports:
      - 80:80
    volumes:
    - ./logs:/www/logs
    #- ./custom:/assets/fusiondirectory
    #- ./plugins-custom:/assets/plugins-custom
    environment:

    - CONTAINER_NAME=fusiondirectory-app

    - ENABLE_ARGONAUT=FALSE
    - PLUGIN_AUDIT=TRUE
    - PLUGIN_DSA=TRUE
    - PLUGIN_LDAPDUMP=TRUE
    - PLUGIN_LDAPMANAGER=TRUE
    - PLUGIN_MAIL=TRUE
    - PLUGIN_PERSONAL=TRUE
    - PLUGIN_PPOLICY=TRUE
    - PLUGIN_SSH=TRUE
    - PLUGIN_SUDO=TRUE
    - PLUGIN_WEBSERVICE=TRUE

    - LDAP1_HOST=openldap-fusiondirectory-app
    - LDAP1_BASE_DN=dc=uray,dc=lan
    - LDAP1_ADMIN_DN=cn=admin,dc=uray,dc=lan
    - LDAP1_ADMIN_PASS=admin
    - LDAP1_PORT=389
    - LDAP1_NAME=Production

    networks:
    - services
    restart: always

networks:
  services:
    external: true

version: '3.7'
services:

  openldap-fusiondirectory-app:
    hostname: dk2.uray.lan
    image: tiredofit/openldap-fusiondirectory
    container_name: openldap-fusiondirectory-app
    ports:
      - 389:389
      - 636:636
    volumes:
      - ./backup:/data/backup
      - ./data:/var/lib/openldap
      - ./config:/etc/openldap/slapd.d
      - ./certs:/certs
    environment:
      - HOSTNAME=dk2.uray.lan
      - LOG_LEVEL=256
      - DOMAIN=uray.lan
      - BASE_DN=dc=uray,dc=lan
      - ADMIN_PASS=admin
      - CONFIG_PASS=config

      - FUSIONDIRECTORY_ADMIN_USER=fd-admin
      - FUSIONDIRECTORY_ADMIN_PASS=admin
      - ORGANIZATION=Example Organization

      - ENABLE_READONLY_USER=FALSE
      - READONLY_USER_USER=reader
      - READONLY_USER_PASS=reader

      - ENABLE_TLS=TRUE
      - TLS_CRT_FILENAME=cert.pem
      - TLS_KEY_FILENAME=key.pem
      - TLS_ENFORCE=FALSE
      - TLS_CIPHER_SUITE=ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:-DHE-DSS:-RSA:!aNULL:!MD5:!DSS:!SHA
      - TLS_VERIFY_CLIENT=never
      - SSL_HELPER_PREFIX=ldap

      - ENABLE_REPLICATION=FALSE
      - REPLICATION_CONFIG_SYNCPROV=binddn="cn=admin,cn=config" bindmethod=simple credentials="admin" searchbase="cn=config" type=refreshAndPersist retry="60 +" timeout=1
      - REPLICATION_DB_SYNCPROV=binddn="cn=admin,dc=uray,dc=lan" bindmethod=simple credentials="admin" searchbase="dc=uray,dc=lan" type=refreshAndPersist interval=00:00:00:10 retry="60 +" timeout=1
      - REPLICATION_HOSTS=ldap://ldap1.example.com ldap://ldap2.example.com ldap://ldap3.example.com
      - REMOVE_CONFIG_AFTER_SETUP=FALSE

      - ENABLE_BACKUP=TRUE
      - BACKUP_INTERVAL=0400
      - BACKUP_RETENTION=10080

      - ENABLE_ZABBIX=TRUE
      - ZABBIX_HOSTNAME=openldap-fusiondirectory-app

    networks:
      - services
    restart: always

networks:
  services:
    external: TRUE

This is the LDIF file from the running LDAP server which gets queried.
uray.lan.ldif.txt

[MichaelUray]

I just re-created the openldap-fusiondirectory docker container and I noticed that there is an error when creating the dn="cn=config,ou=fusiondirectory,dc=uray,dc=lan" entry.
Is maybe this causing the issue?

openldap-fusiondirectory-app    | 61d0e576.240fe273 0x7faed5aefb38 conn=1017 op=8 ADD dn="cn=config,ou=fusiondirectory,dc=uray,dc=lan"
openldap-fusiondirectory-app    | 61d0e576.2412e5e0 0x7faed5aefb38 conn=1017 op=8 RESULT tag=105 err=19 qtime=0.000006 etime=0.000218 text=fdHttpAuthActivated: attribute is obsolete

[traverseda]

Trying to get this running for the first time, and while I have them both in one docker container I seem to be having the same issue

[fl0schi]

Same as @traverseda.
Trying to get it running in the same stack, and like @MichaelUray already mentioned it looks like this object is not created during the initial bootstrap.

Any ideas how to fix, without manually adding and try'n'error?

[Yumash]

Faced the same with no image tag specified

Fixed with exact declaration of tag:

image: tiredofit/openldap-fusiondirectory:2.6-1.4-latest

image: tiredofit/fusiondirectory:1.4-latest

So seems that "latest" versions are not ready for use but only for experiments/testing/whatever - or the "latest" versions of images are not compatible

[fl0schi]

@Yumash same over here. I also had no image tag specified.
After specifying the tags it looks different, but unfortunately the tiredofit/fusiondirectory won't come up successfully.
So for me your hint is 50% correct.
With 1.4-latest tag I get this error message

2023-07-19.17:09:37 [ERROR] ** [fusiondirectory] No 'Server Name' Entered! - Set '$LDAP01_NAME'

Without it works fine.
Maybe you can share your environment variables with me, so I can compare to mine?
Never the less, it works for me with tiredofit/openldap-fusiondirectory:2.6-1.4-latest and tiredofit/fusiondirectory (no tag / latest tag).

Thanks for your hint!

[tedr56]

The Ldap envs has change recently to use double digit.
That's what your error is saying.
You have to declare $LDAP01_NAME instead of $LDAP1_NAME. And so on for other variables.

[fl0schi]

@tedr56 true!
Missed that, finally it's working with the tags and updated env vars to double digit.