LDAP groups not creating, error out

[rybussell]

Followed https://ravada.readthedocs.io/en/latest/docs/INSTALL_Ubuntu.html
OS is Ubuntu 22.04
Fully updated.

I have everything up and running. Able to log into the web interface with our LDAP credentials. Users able to start virtual desktops... All that is great...

When I go to create a group at https://ipaddress/group/new

I get multiple different error messages... The group name I try is PleaseCreateMe (please note actual domain name changed for errors...)

Under groupOfUniqueNames:

Error creating group PleaseCreateMe : 0000208D: NameErr: DSID-0310023C, problem 2001 (NO_OBJECT), data 0, best match of: 'DC=mydomain,DC=com' $VAR1 = [ 'dn', 'cn=PleaseCreateMe,ou=groups,dc=mydomain,dc=com', 'cn', 'PleaseCreateMe', 'attrs', [ 'cn', 'PleaseCreateMe', 'objectClass', [ 'top', 'groupOfUniqueNames' ], 'description', 'Group for PleaseCreateMe' ] ];

If I switch to nsMemberOf:

Error creating group PleaseCreateMe : 00000057: LdapErr: DSID-0C090EB7, comment: Error in attribute conversion operation, data 0, v2580 $VAR1 = [ 'dn', 'cn=PleaseCreateMe,ou=groups,dc=mydomain,dc=com', 'cn', 'PleaseCreateMe', 'attrs', [ 'cn', 'PleaseCreateMe', 'objectClass', [ 'top', 'nsMemberOf' ], 'description', 'Group for PleaseCreateMe' ] ];

Under posixGroup:

Error creating group PleaseCreateMe : 0000208D: NameErr: DSID-0310023C, problem 2001 (NO_OBJECT), data 0, best match of: 'DC=mydomain,DC=com' $VAR1 = [ 'dn', 'cn=PleaseCreateMe,ou=groups,dc=mydomain,dc=com', 'cn', 'PleaseCreateMe', 'attrs', [ 'cn', 'PleaseCreateMe', 'objectClass', [ 'top', 'posixGroup' ], 'description', 'Group for PleaseCreateMe', 'gidNumber', 100 ] ];

What is interesting about posixGroup is it flashes on screen for a brief moment and says
Oops! Group name cannot be empty
Oops! Group name must be less than 80 characters...

Last, if I try to create the group in command line using:

rvd_back --add-group-ldap PleaseCreateMe

Error creating group PleaseCreateMe : 00000057: LdapErr: DSID-0C090EB7, comment: Error in attribute conversion operation, data 0, v2580
$VAR1 = [
'dn',
'cn=PleaseCreateMe,ou=groups,dc=mydomain,dc=com',
'cn',
'PleaseCreateMe',
'attrs',
[
'cn',
'PleaseCreateMe',
'objectClass',
[
'groupOfUniqueNames',
'nsMemberOf',
'posixGroup',
'top'
],
'description',
'Group for PleaseCreateMe',
'gidNumber',
100
]
];

My Ravada.conf file is as follows:

ldap:
server: 192.168.0.254
port: 389
base: dc=mydomain,dc=com
field: cn (tried sAMAccountName, others)
admin_user: CN=admin_user,OU=admins,dc=mydomain,dc=com
password: AdminPassword12345!

Anything that sticks out? Anything to try?

[frankiejol]

Hello @rybussell thank you for your accurate report. Can you please check the LDAP server you are using. I guess it is 389-ds if you followed the doc. But just to make sure. Type dpkg -l | grep -i 389.
Also , please confirm are you using Ravada v2.1.7.
Thanks !

[rybussell]

Version: 2.1.7-beta1

I ran dpkg -l | grep -i 389 and nothing returns.. not an error.. nothing..

I'm able to do other things with LDAP though.. Like I can go to the Virtual Machine settings under Access and where it says :

Type a typical LDAP user name to fetch the attribute list

I can type names and verify access.. So I feel like LDAP is working correctly.

Unless the groups are based of something else..

[frankiejol]

Sorry @rybussell there is something missing here. There must be some LDAP server installed somewhere. And dpkg returning nothing just seems wrong.
I don't need sudo to show my own. Please try sudo dpkg -l | grep -i 389

Just in case I just tried creating a group of unique names in a plain server I have available just in case.
Anyway please let me know if you spot something about your LDAP server and see what can be wrong.

[rybussell]

When I installed the system, I edited the /etc/ravada.conf file...
It looks like this (again, names changed for security and notes added in parentheses):

---
db:
    hostname: localhost
    user: ravada_user
    password: my_db_password

ldap:
    server: 192.168.1.1 (it's a windows server 2019)
    port: 389
    base: dc=mydomain,dc=com
    field: cn
    admin_user:
        dn: CN=adminuser,OU=admins,dc=mydomain,dc=com
        password: agoodworkingpassword

[frankiejol]

Hey, is this correct ?
server: 192.168.1.1 (it's a windows server 2019)
Is your LDAP tool in a Windows server ?

[rybussell]

The server is at that IP address and it is an LDAP server. We run several applications against it for LDAP auth.
I know 192.168.1.1 is a common router IP but not here.

[frankiejol]

ok ! We tested on OpenLDAP and 389-Directory Server, when you say it is an LDAP server, I guess it's not one of those. Do you know the name of the tool ?
I am looking at the error messages, it is definitely something missing in the way we create the group, but I just don't know what. Is it possible you dump the contents of some other group created in this LDAP server ?

[rybussell]

Not sure what is meant by the name of the tool.
We just enabled the LDAP server role on the server. We use it for all kinds of authentication for things like WordPress, other web applications.

And sorry for the delay in response. We put this project on the back burner for a minute to get other things finished first before we really focus on VDI.

[frankiejol]

Sorry @rybussell I didn't explain well. My guess is you have an LDAP server product different from the ones we tested Ravada with. We are working on a feature that does not require LDAP for groups management. I expect to release a beta version for this in the very next weeks. Hopefully it will be useful for you. I will let you know.