XCP-ng
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Auth LDAP Plugin "Could Not Authenticate User"

    Scheduled Pinned Locked Moved Unsolved Management
    2 Posts 2 Posters 50 Views 2 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      coolsport00
      last edited by coolsport00

      Hey everyone -

      Thought I'd post this in case others are looking for a resolution to the error I received. In my testing of XO/XCP thus far, I hadn't yet implemented AD-integratin (LDAP)....until today. I wanted to test this out. I was entering the parameters as I found in the KB:
      https://docs.vates.tech/kb/vkb-1166/
      as well as the User Guide:
      https://docs.xen-orchestra.com/users-and-access/users#ldap

      ...but was still running into "Could Not Authenticate User" error when I went to 'test' the plugin. I knew the pwd was correct as I logged into other systems with this acct. I tried other accts, and multiple LDAP servers (DCs), and even took DNS out of the equation (used IP)...as well as not checking for certificates. Nothing. I ended up changing one of the parameters that finally got me a successful test ---> the "User Filter" parameter. I had "(sAMAccountName={{name}})" in the configuration box and decided to change it to "(userPrincipalName={{name}})" which ended up being the the change that got me going. Aside from helping others who may experience this issue, I'm also posting for Olivier and the Vates team to see if there's a way to have a more precise log event pinpointing to the problem section in the plugin to help troublehshoot? Not sure if it's possible...but thought I'd put my feedback here as well.
      Thanks Community!

      poddingueP 1 Reply Last reply
      Reply Quote 1
      • poddingueP poddingue marked this topic as a question
      • poddingueP
        poddingue Vates 🪐 @coolsport00
        last edited by

        My guess, and I'm not an AD person so take it lightly: sAMAccountName holds the short login (jdoe), while userPrincipalName is the jdoe@yourdomain form. So if you typed the full address in the Test box, the first filter would find nobody. Was that the case? The docs list both filters but don't really say when to pick which: https://docs.xen-orchestra.com/users-and-access/users#ldap.
        On the logging, if I read the plugin code right, it already logs how many entries the filter matched at debug level, it's just that the Test button only gives back "could not authenticate user". Showing that in the UI sounds like a good one for https://feedback.vates.tech/, where the XO team tracks this kind of request.

        1 Reply Last reply
        Reply Quote 0

        Hello! It looks like you're interested in this conversation, but you don't have an account yet.

        Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.

        With your input, this post could be even better 💗

        Register Login
        • First post
          Last post