"incompatible character encoding" with LDAP auth (Bug #1078)

It seems I am unable to get the LDAP example config to work (and I've spent nearly 2 hours with it -_- )

Florian: as you were the one to add the config for the newer OpenLDAPs, could you give me a short sum-up of what I need to do to get the example stuff into a virgin OpenLDAP? I've been trying to test it in a Ubuntu Lucid VM (current vagrant status), I wouldn't mind if we could get it to work on Travis too though :-)

Holger: If Florian doesn't answer early enough, I'm tempted to just bump the lib (it's a minor bump so it should work as before) and see if it makes it through ci.chiliproject.org, which IIRC tests the LDAP parts.

Here is the way to do this:

sudo apt-get install openldap ldap-utils

sudo mkdir -p /var/lib/ldap/redmine
sudo chown openldap:openldap /var/lib/ldap/redmine

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f test/fixtures/ldap/slapd_config.ldif
sudo ldapadd -D cn=Manager,dc=redmine,dc=org -w secret -f test/fixtures/ldap/test-ldap.ldif

rake test TEST=test/functional/ldap_auth_sources_controller.rb

I tested this on Ubuntu 11.04 but it should work on newer systems to. Maybe you want to add this to the wiki.

EDIT: The test above was the wrong test. Or maybe both are needed. No Idea. But all tests are running without error. This may be the correct one:

rake test TEST=test/unit/auth_source_ldap_test.rb

Florian Mutter wrote:

Here is the way to do this:

That's in the line of what I tried on Lucid (the package for the openldap server is called slapd, but that's less of a problem), when trying to import the config I get the following error though:

vagrant@lucid32:~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /opt/chiliproject/default/current/test/fixtures/ldap/slapd_config.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcDatabase=hdb,cn=config" 
ldap_add: Invalid syntax (21)
    additional info: objectClass: value #1 invalid per syntax

Any idea?

You are missing the hdb module. Maybe the switched to bdb by default. You can load that module by putting the following in a ldif file and load it with like the first ldap_add command above:

# Load dynamic backend modules
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib/ldap
olcModuleload: {0}back_hdb

This should maybe included in the slapd_conf.ldap

Sorry wrong script. Use this one

# Load dynamic backend modules
dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulepath: /usr/lib/ldap
olcModuleload: back_hdb.la

Florian Mutter wrote:

I hope this works.

Kind of, I get another error, LDAP seems to be hard… Maybe we could reverse the process? If you have the time, could you grab https://github.com/thegcat/chiliproject-vagrant/ and see if you can get it working there? (once the machine is up with vagrant up, you can just vagrant ssh to get on the machine, the user you are logged in as then has passwordless sudo rights).

After successfully loading the back_hdb.la part, I get:

vagrant@lucid32:~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /opt/chiliproject/default/current/test/fixtures/ldap/slapd_config.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcDatabase=hdb,cn=config" 
ldap_add: Other (e.g., implementation specific) error (80)
    additional info: <olcAccess> handler exited with 1

Thanks for your help :-)

Hmm, maybe ldap stored some of the entries in a previous attempt to import the slapd_conf.ldif. If you have nothing els in your ldap you can try apt-get purge slapd; rm -r /var/lib/ldap/redmine; apt-get install slapd and try again. Another way would be ldapmodify but to use this the ldif needs to be updated with something like this:

changetype: modify 
replace: olcAccess

Still getting:

vagrant@lucid32:~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /opt/chiliproject/default/current/test/fixtures/ldap/slapd_config.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "olcDatabase=hdb,cn=config" 
ldap_add: Other (e.g., implementation specific) error (80)
    additional info: <olcAccess> handler exited with 1

Oh well, I'll wait to see if the CI works with the new lib or not.