Issues with LDAP authentication?

[hagaram]

Originally I wanted to create a new bug, but this is probably some kind of misconfiguration issue on my end. I would like to ask you for assistance. Didn't any of you encounter this kind of issue?
Just to note I don't have this issue when using Netbox with LDAP in my original setup, but I'm trying to migrate to Nautobot.

Environment

• Python version: 3.9
• Nautobot version: 1.2.5

Steps to Reproduce

1. Configure LDAP as per https://nautobot.readthedocs.io/en/latest/configuration/authentication/ldap/
2. I also reffered to https://django-auth-ldap.readthedocs.io/en/latest/
3. I've tried original image without any modifications
4. I used custom docker image with LDAP installed manually

ARG NAUTOBOT_VERSION
ARG _PYTHON_VERSION

FROM ghcr.io/nautobot/nautobot:${NAUTOBOT_VERSION}-py${_PYTHON_VERSION} as base

USER 0
RUN apt-get update -y && apt-get install -y libldap2-dev libsasl2-dev libssl-dev

FROM base as builder

RUN apt-get install -y gcc && \
    apt-get autoremove -y && \
    apt-get clean all && \
    rm -rf /var/lib/apt/lists/*

RUN pip3 install --upgrade pip wheel && pip3 install django-auth-ldap

FROM base as final
ARG _PYTHON_VERSION
USER 0
COPY --from=builder /usr/local/lib/python${_PYTHON_VERSION}/site-packages /usr/local/lib/python${_PYTHON_VERSION}/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin
USER nautobot

WORKDIR /opt/nautobot

Expected Behavior

I expected my user to login to nautobot and authenticate against my LDAP server. Or at least send somewhat valid query to LDAP server.

Observed Behavior

• "Wrong username or password"
• LDAP received empty query and nautobot raised an exception

 File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 829, in _resolve_lookup                                                                                                                 

│     current = current[bit]                                                                                                                                                                                                 │
│   File "/usr/local/lib/python3.9/site-packages/django/forms/forms.py", line 157, in __getitem__                                                                                                                   │
│     raise KeyError(                                                                                                                                                                                               │
│ KeyError: "Key 'relationships' not found in 'LoginForm'. Choices are: password, username."                                                                                                                        │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 837, in _resolve_lookup                                                                                                             │
│     current = getattr(current, bit)                                                                                                                                                                               │
│ AttributeError: 'LoginForm' object has no attribute 'relationships'                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 843, in _resolve_lookup                                                                                                             │
│     current = current[int(bit)]                                                                                                                                                                                   │
│ ValueError: invalid literal for int() with base 10: 'relationships'                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:            

Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 848, in _resolve_lookup                                                                                                             │
│     raise VariableDoesNotExist("Failed lookup for key "                                                                                                                                                           │
│ django.template.base.VariableDoesNotExist: Failed lookup for key [relationships] in <LoginForm bound=False, valid=False, fields=(username;password)>                                                              │
│ 12:07:33.410 DEBUG   django.template :                                                                                                                                                                            │
│   Exception while resolving variable 'custom_fields' in template 'login.html'.                                                                                                                                    │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/forms/forms.py", line 155, in __getitem__                                                                                                                   │
│     field = self.fields[name]                                                                                                                                                                                     │
│ KeyError: 'custom_fields'                                                                                                                                                                                         │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 829, in _resolve_lookup                                                                                                             │
│     current = current[bit]                                                                                                                                                                                        │
│   File "/usr/local/lib/python3.9/site-packages/django/forms/forms.py", line 157, in __getitem__                                                                                                                   │
│     raise KeyError(                                                                                                                                                                                               │
│ KeyError: "Key 'custom_fields' not found in 'LoginForm'. Choices are: password, username."                                                                                                                        │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 837, in _resolve_lookup                                                                                                             │
│     current = getattr(current, bit)                                                                                                                                                                               │
│ AttributeError: 'LoginForm' object has no attribute 'custom_fields'                                                                                                                                               │
│                                                                        

During handling of the above exception, another exception occurred:                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 843, in _resolve_lookup                                                                                                             │
│     current = current[int(bit)]                                                                                                                                                                                   │
│ ValueError: invalid literal for int() with base 10: 'custom_fields'                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 848, in _resolve_lookup                                                                                                             │
│     raise VariableDoesNotExist("Failed lookup for key "                                                                                                                                                           │
│ django.template.base.VariableDoesNotExist: Failed lookup for key [custom_fields] in <LoginForm bound=False, valid=False, fields=(username;password)>                                                              │
│ 12:07:33.411 DEBUG   django.template :                                                                                                                                                                            │
│   Exception while resolving variable 'relationships' in template 'login.html'.                                                                                                                                    │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/forms/forms.py", line 155, in __getitem__                                                                                                                   │
│     field = self.fields[name]                                                                                                                                                                                     │
│ KeyError: 'relationships'                                                                                                                                                                                         │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 829, in _resolve_lookup                                                                                                             │
│     current = current[bit]                                                                                                                                                                                        │
│   File "/usr/local/lib/python3.9/site-packages/django/forms/forms.py", line 157, in __getitem__                                                                                                                   │
│     raise KeyError(                                                                                                                                                                                               │
│ KeyError: "Key 'relationships' not found in 'LoginForm'. Choices are: password, username."                                                                                                                        │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:   


Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 829, in _resolve_lookup                                                                                                             │
│     current = current[bit]                                                                                                                                                                                        │
│   File "/usr/local/lib/python3.9/site-packages/django/forms/forms.py", line 157, in __getitem__                                                                                                                   │
│     raise KeyError(                                                                                                                                                                                               │
│ KeyError: "Key 'relationships' not found in 'LoginForm'. Choices are: password, username."                                                                                                                        │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 837, in _resolve_lookup                                                                                                             │
│     current = getattr(current, bit)                                                                                                                                                                               │
│ AttributeError: 'LoginForm' object has no attribute 'relationships'                                                                                                                                               │
│ AttributeError: 'LoginForm' object has no attribute 'relationships'                                                                                                                                               │
│ AttributeError: 'LoginForm' object has no attribute 'relationships'                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 843, in _resolve_lookup                                                                                                             │
│     current = current[int(bit)]                                                                                                                                                                                   │
│ ValueError: invalid literal for int() with base 10: 'relationships'                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ During handling of the above exception, another exception occurred:                                                                                                                                               │
│                                                                                                                                                                                                                   │
│ Traceback (most recent call last):                                                                                                                                                                                │
│   File "/usr/local/lib/python3.9/site-packages/django/template/base.py", line 848, in _resolve_lookup                                                                                                             │
│     raise VariableDoesNotExist("Failed lookup for key "                                                                                                                                                           │
│ django.template.base.VariableDoesNotExist: Failed lookup for key [relationships] in <LoginForm bound=False, valid=False, fields=(username;password)>  

Do I need to use some kind of custom form/template ? Do you think there is an issue on my end ?

[glennmatthews]

Thanks for starting a discussion!

I know that if you turn on DEBUG level logging of Django itself, you can see errors similar to the above on the console, but those are cosmetic only (see #802) and do not impact normal operation. If that's how you gathered these logs, I think those can be ignored.

More than likely there's an error in your LDAP config causing the authentication failures. Can you potentially share a sanitized copy of your config?

[hagaram]

Hi @glennmatthews,
thank you very much for your response! Yes, you are right, I gathered the logs with DEBUG turned on.

This is the LDAP config I ended up with. All my attempts failed so far.

AUTH_LDAP_SERVER_URI = os.environ.get('AUTH_LDAP_SERVER_URI')
AUTH_LDAP_BIND_DN = os.environ.get('AUTH_LDAP_BIND_DN')
AUTH_LDAP_BIND_PASSWORD = os.environ.get("AUTH_LDAP_BIND_PASSWORD")

AUTH_LDAP_USER_SEARCH = LDAPSearch("ou=people,ou=org_un,dc=dc_sanintized,dc=dc_sanintized2",
                                    ldap.SCOPE_SUBTREE,
                                    "(cn=%(user)s)")

AUTH_LDAP_GROUP_SEARCH = LDAPSearch("ou=groups,ou=org_un,dc=dc_sanintized,dc=dc_sanintized2", ldap.SCOPE_SUBTREE,
                                "(objectClass=groupOfNames)")

AUTH_LDAP_USER_FLAGS_BY_GROUP = {
  "is_active": "cn=active,ou=groups,ou=org_un,dc=dc_sanintized,dc=dc_sanintized2",
  "is_superuser": "cn=superuser,ou=groups,ou=org_un,dc=dc_sanintized,dc=dc_sanintized2"
}

AUTH_LDAP_USER_ATTR_MAP = {
  "email": "cn"
}

AUTHENTICATION_BACKENDS = [
    'django_auth_ldap.backend.LDAPBackend',
    'nautobot.core.authentication.ObjectPermissionBackend',
]

#Options below made no difference
#AUTH_LDAP_ALWAYS_UPDATE_USER = True
#AUTH_LDAP_FIND_GROUP_PERMS = True
#AUTH_LDAP_CACHE_TIMEOUT = 3600
#AUTH_LDAP_ALWAYS_UPDATE_USER = True
#AUTH_LDAP_FIND_GROUP_PERMS = True
#AUTH_LDAP_AUTHORIZE_ALL_USERS = True
#AUTH_LDAP_MIRROR_GROUPS = True

Username is in form [email protected] which is what I suspect might be an issue?

[hagaram]

After hours of debugging with ldapsearch, strace etc. I found out that tis is a TLS issue. The workaround is quite simple, even tough I don't understand why this is necessary, as I've never had this issue before.

export LDAPTLS_CACERT=/etc/ssl/certs/ca-certificates.crt

and voala, problem solved.

It seems that ldap libs don't use openssl and use nss, which has some kind of underlying issue in my opinion.