[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Output differs when searching via translucent proxy

Le 2016-01-14 18:10, M. P. a écrit :

Hello all,

We have an installation of openldap like this: master <- slave <-
translucent proxy. All the installation is on debian Jessie 8.2 with
slapd version 2.4.40+dfsg-1+deb8u1.

When searching/binding with ldapsearch everything seems ok. I mean I
have the results I expect.

We have an application called CAS to authenticate users on web
appplications and there is where things start to be strange. When
configuring CAS to communicate with the slave, there is no problem,
users can authenticate without issue. But when CAS is configured to
communicate with the translucent proxy, there is not possible for
users to be authenticated.

I looked a different places, changed different parameters playing with
ldap protocol, search reference responses, automatic referral chasing,
... but can't make it work.

In the logs I have this:

ldapsearch request: the output is ok

from client to translucent proxy:
slapd[8845]: conn=1019 fd=13 ACCEPT from IP=10.93.64.180:57730 (IP=0.0.0.0:389) 
slapd[8845]: conn=1019 op=0 BIND
dn="uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com" method=128
slapd[8845]: conn=1019 op=0 BIND
dn="uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com" mech=SIMPLE ssf=0
slapd[8845]: conn=1019 op=0 RESULT tag=97 err=0 text=
slapd[8845]: conn=1019 op=1 SRCH base="ou=people,dc=domain,dc=com"
scope=2 deref=3 filter="(uid=myuser)"
slapd[8845]: conn=1019 op=1 SRCH attr=1.1
slapd[8845]: conn=1019 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= 
slapd[8845]: conn=1019 op=2 UNBIND
slapd[8845]: conn=1019 fd=13 closed

from tranlucent proxy to slave:
slapd[6491]: conn=1759 fd=25 ACCEPT from IP=10.93.64.207:37513 (IP=0.0.0.0:389) 
slapd[6491]: conn=1759 op=0 [IP=10.93.64.180
USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] BIND
dn="uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com" method=128
slapd[6491]: conn=1759 op=0 [IP=10.93.64.180
USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] BIND
dn="uid=cas-auth,ou=SI,ou=Access,dc=domain,dc=com" mech=SIMPLE ssf=0
slapd[6491]: conn=1759 op=0 [IP=10.93.64.180
USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] RESULT tag=97
err=0 text=
slapd[6491]: conn=1759 op=1 [IP=10.93.64.180
USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] SRCH
base="ou=people,dc=domain,dc=com" scope=2 deref=3
filter="(uid=myuser)"
slapd[6491]: conn=1759 op=1 [IP=10.93.64.180
USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] SRCH attr=* +
slapd[6491]: conn=1759 op=1 [IP=10.93.64.180
USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] SEARCH RESULT
tag=101 err=0 nentries=1 text=
slapd[6491]: conn=1759 op=2 UNBIND
slapd[6491]: conn=1759 fd=25 closed


CAS request: I don't have the output I expect

from client to translucent proxy:
slapd[8845]: conn=1017 fd=13 ACCEPT from IP=10.93.64.180:57109 (IP=0.0.0.0:389) 
slapd[8845]: conn=1017 op=0 BIND
dn="uid=cas-auth,ou=si,ou=access,dc=domain,dc=com" method=128
slapd[8845]: conn=1017 op=0 BIND
dn="uid=cas-auth,ou=si,ou=access,dc=domain,dc=com" mech=SIMPLE ssf=0
slapd[8845]: conn=1017 op=0 RESULT tag=97 err=0 text=
slapd[8845]: conn=1017 op=1 SRCH base="ou=People,dc=domain,dc=com"
scope=2 deref=3 filter="(uid=myuser)"
slapd[8845]: conn=1017 op=1 SRCH attr=1.1
slapd[8845]: conn=1017 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= 
slapd[8845]: conn=1017 fd=13 closed (connection lost)

from tranlucent proxy to slave:
slapd[6491]: conn=1747 fd=13 ACCEPT from IP=10.93.64.207:35881 (IP=0.0.0.0:389) 
slapd[6491]: conn=1747 op=0 [IP=10.93.64.180
USERNAME=uid=cas-auth,ou=si,ou=access,dc=domain,dc=com] BIND
dn="uid=cas-auth,ou=si,ou=access,dc=domain,dc=com" method=128
slapd[6491]: conn=1747 op=0 [IP=10.93.64.180
USERNAME=uid=cas-auth,ou=si,ou=access,dc=domain,dc=com] BIND
dn="uid=cas-auth,ou=SI,ou=Access,dc=domain,dc=com" mech=SIMPLE ssf=0
slapd[6491]: conn=1747 op=0 [IP=10.93.64.180
USERNAME=uid=cas-auth,ou=si,ou=access,dc=domain,dc=com] RESULT tag=97
err=0 text=
slapd[6491]: conn=1747 op=1 UNBIND
slapd[6491]: conn=1747 fd=13 closed


The configuration part relative to translucent:

# Entry 1: olcOverlay={3}translucent,olcDatabase={2}mdb,cn=config
dn: olcOverlay={3}translucent,olcDatabase={2}mdb,cn=config
objectclass: olcConfig
objectclass: olcOverlayConfig
objectclass: olcTranslucentConfig
objectclass: top
olcoverlay: {3}translucent
olctranslucentbindlocal: TRUE
# Entry 2: olcDatabase={0}ldap,olcOverlay={3}translucent,olcDatabase={2}m... dn: olcDatabase={0}ldap,olcOverlay={3}translucent,olcDatabase={2}mdb,cn=conf 
 ig
objectclass: olcConfig
objectclass: olcLDAPConfig
objectclass: olcTranslucentDatabase
objectclass: olcDatabaseConfig
olcdatabase: {0}ldap
olcdbchasereferrals: TRUE
olcdbidassertauthzfrom: {0}*
olcdbidassertbind: bindmethod="simple" binddn="uid=roaccess,ou=access,dc=dom 
 ain,dc=com" credentials="hideme" mode="self"
olcdbsessiontrackingrequest: TRUE
olcdburi: ldap://ldap-data.domain.it

I do not really know where to look else. I'll continue to try
different things to make it work but any idea/suggestion/correction is
welcome.

Thank you in advance for your time.
I don't know if it is related or not but I can reproduce, via ldapsearch, log entries between the proxy and the slave when CAS is configured with proxy as ldap backend.
# ldapsearch -x -b ou=people,dc=domain,dc=com -H ldap://ldap.domain.it -WD uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com -LLL -a always -n -v uid=myuser 1.1 

Client -> Proxy
Jan 15 13:11:45 ldap-sudo slapd[29272]: conn=1057 fd=13 ACCEPT from IP=10.93.64.180:38275 (IP=0.0.0.0:389) Jan 15 13:11:45 ldap-sudo slapd[29272]: conn=1057 op=0 BIND dn="uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com" method=128 Jan 15 13:11:45 ldap-sudo slapd[29272]: conn=1057 op=0 BIND dn="uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com" mech=SIMPLE ssf=0 Jan 15 13:11:45 ldap-sudo slapd[29272]: conn=1057 op=0 RESULT tag=97 err=0 text= 
Jan 15 13:11:45 ldap-sudo slapd[29272]: conn=1057 op=1 UNBIND
Jan 15 13:11:45 ldap-sudo slapd[29272]: conn=1057 fd=13 closed

Proxy -> Slave
Jan 15 13:11:45 ldap-data slapd[6491]: conn=2746 fd=22 ACCEPT from IP=10.93.64.207:58162 (IP=0.0.0.0:389) Jan 15 13:11:45 ldap-data slapd[6491]: conn=2746 op=0 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] BIND dn="uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com" method=128 Jan 15 13:11:45 ldap-data slapd[6491]: conn=2746 op=0 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] BIND dn="uid=cas-auth,ou=SI,ou=Access,dc=domain,dc=com" mech=SIMPLE ssf=0 Jan 15 13:11:45 ldap-data slapd[6491]: conn=2746 op=0 [IP=10.93.64.180 USERNAME=uid=cas-auth,ou=SI,ou=access,dc=domain,dc=com] RESULT tag=97 err=0 text= 
Jan 15 13:11:45 ldap-data slapd[6491]: conn=2746 op=1 UNBIND
Jan 15 13:11:45 ldap-data slapd[6491]: conn=2746 fd=22 closed

In the command I added the "-n" switch to simulate just the bind part.
If I compare with logs from CAS request, it is like the search part is not forwarded from proxy to slave. Is there any special functionality that the client should support when requesting with via translucent overlay ? 


--
------------

M. P.