Re: NAV authentication with LDAP + MS AD

2 Apr 2014

      Hi,
I pulled the fix from:
https://nav.uninett.no/hg/stable/rev/23d774154094
this makes the login with wrong credentials work (before we had an error)
but in case of good credentials the system  still crashes. Debug output
below:
read1msg:  mark request completed, ld 0x7fdfb4d38300 msgid 4
request done: ld 0x7fdfb4d38300 msgid 4
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 4, msgid 4)
ldap_parse_result
ldap_msgfree
[Wed Apr 02 17:23:22 2014] [error] [Wed Apr 02 17:23:22 2014] [ERROR]
[pid=12954 django.request] Internal Server Error: /index/login/
[Wed Apr 02 17:23:22 2014] [error] Traceback (most recent call last):
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/python2.7/dist-packages/django/core/handlers/base.py", line 111,
in get_response
[Wed Apr 02 17:23:22 2014] [error]     response = callback(request,
*callback_args, **callback_kwargs)
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/python2.7/dist-packages/django/views/decorators/debug.py", line
69, in sensitive_post_parameters_wrapper
[Wed Apr 02 17:23:22 2014] [error]     return view(request, *args, **kwargs)
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/pymodules/python2.7/nav/web/webfront/views.py", line 92, in login
[Wed Apr 02 17:23:22 2014] [error]     return do_login(request)
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/python2.7/dist-packages/django/views/decorators/debug.py", line
34, in sensitive_variables_wrapper
[Wed Apr 02 17:23:22 2014] [error]     return func(*args, **kwargs)
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/pymodules/python2.7/nav/web/webfront/views.py", line 127, in
do_login
[Wed Apr 02 17:23:22 2014] [error]     account = auth.authenticate(username,
password)
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/pymodules/python2.7/nav/web/auth.py", line 79, in authenticate
[Wed Apr 02 17:23:22 2014] [error]     user =
ldapauth.authenticate(username, password)
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/pymodules/python2.7/nav/web/ldapauth.py", line 151, in
authenticate
[Wed Apr 02 17:23:22 2014] [error]     if user.is_group_member(group_dn):
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/pymodules/python2.7/nav/web/ldapauth.py", line 280, in
is_group_member
[Wed Apr 02 17:23:22 2014] [error]     result = self.ldap.search_s(group_dn,
ldap.SCOPE_BASE, filterstr)
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 552, in search_s
[Wed Apr 02 17:23:22 2014] [error]     return
self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=
self.timeout)
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 545, in
search_ext_s
[Wed Apr 02 17:23:22 2014] [error]     msgid =
self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientct
rls,timeout,sizelimit)
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 541, in
search_ext
[Wed Apr 02 17:23:22 2014] [error]     timeout,sizelimit,
[Wed Apr 02 17:23:22 2014] [error]   File
"/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 99, in
_ldap_call
[Wed Apr 02 17:23:22 2014] [error]     result = func(*args,**kwargs)
[Wed Apr 02 17:23:22 2014] [error] UnicodeEncodeError: 'ascii' codec can't
encode character u'\xfc' in position 26: ordinal not in range(128)
ldap_free_connection 1 1
ldap_send_unbind
ldap_free_connection: actually freed
==== mail received from system ===
Traceback (most recent call last):
File "/usr/lib/python2.7/dist-packages/django/core/handlers/base.py", line
111, in get_response
    response = callback(request, *callback_args, **callback_kwargs)
File "/usr/lib/python2.7/dist-packages/django/views/decorators/debug.py",
line 69, in sensitive_post_parameters_wrapper
    return view(request, *args, **kwargs)
File "/usr/lib/pymodules/python2.7/nav/web/webfront/views.py", line 92, in
login
    return do_login(request)
File "/usr/lib/python2.7/dist-packages/django/views/decorators/debug.py",
line 34, in sensitive_variables_wrapper
    return func(*args, **kwargs)
File "/usr/lib/pymodules/python2.7/nav/web/webfront/views.py", line 127,
in do_login
    account = auth.authenticate(username, password)
File "/usr/lib/pymodules/python2.7/nav/web/auth.py", line 79, in
authenticate
    user = ldapauth.authenticate(username, password)
File "/usr/lib/pymodules/python2.7/nav/web/ldapauth.py", line 151, in
authenticate
    if user.is_group_member(group_dn):
File "/usr/lib/pymodules/python2.7/nav/web/ldapauth.py", line 280, in
is_group_member
    result = self.ldap.search_s(group_dn, ldap.SCOPE_BASE, filterstr)
File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 552, in
search_s
    return 
self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=
self.timeout)
File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 545, in
search_ext_s
    msgid = 
self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientct
rls,timeout,sizelimit)
File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 541, in
search_ext
    timeout,sizelimit,
File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 99, in
_ldap_call
    result = func(*args,**kwargs)
UnicodeEncodeError: 'ascii' codec can't encode character u'\xfc' in position
26: ordinal not in range(128)
<WSGIRequest
path:/index/login/,
GET:<QueryDict: {}>,
POST:<QueryDict: {u'origin': [u''], u'username': [u'XXX-adm'], u'password':
[u'***********']}>,
COOKIES:{'sessionid': '59e85ca4ca567cfd8966ab12'},
META:{'CONTENT_LENGTH': '47',
'CONTENT_TYPE': 'application/x-www-form-urlencoded',
'DOCUMENT_ROOT': '/usr/share/nav/htdocs',
'GATEWAY_INTERFACE': 'CGI/1.1',
'HTTPS': '1',
'HTTP_ACCEPT': 
'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'HTTP_ACCEPT_ENCODING': 'gzip, deflate',
'HTTP_ACCEPT_LANGUAGE': 'de,en-us;q=0.7,en;q=0.3',
'HTTP_CONNECTION': 'keep-alive',
'HTTP_COOKIE': 'sessionid=59e85ca4c39f3dbe7a567cfd8966ab12',
'HTTP_DNT': '1',
'HTTP_HOST': 'urz-nav',
'HTTP_REFERER': 'https://urz-nav-pet.urz.unibas.ch/index/login/',
'HTTP_USER_AGENT': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:28.0)
Gecko/20100101 Firefox/28.0',
'PATH_INFO': u'/index/login/',
'PATH_TRANSLATED': '/usr/share/pyshared/nav/wsgi.py/index/login/',
'QUERY_STRING': '',
'REMOTE_ADDR': '1',
'REMOTE_PORT': '64036',
'REQUEST_METHOD': 'POST',
'REQUEST_URI': '/index/login/',
'SCRIPT_FILENAME': '/usr/share/pyshared/nav/wsgi.py',
'SCRIPT_NAME': u'',
'SERVER_ADDR': '1',
'SERVER_ADMIN': 'webmaster@localhost',
'SERVER_NAME': 'urz-nav',
'SERVER_PORT': '443',
'SERVER_PROTOCOL': 'HTTP/1.1',
'SERVER_SIGNATURE': '<address>Apache/2.2.22 (Debian) Server at urz-nav Port
443</address>\n',
'SERVER_SOFTWARE': 'Apache/2.2.22 (Debian)',
'SSL_TLS_SNI': 'urz-nav-pet.urz.unibas.ch',
'mod_wsgi.application_group': 'urz-nav|',
'mod_wsgi.callable_object': 'application',
'mod_wsgi.handler_script': '',
'mod_wsgi.input_chunked': '0',
'mod_wsgi.listener_host': '',
'mod_wsgi.listener_port': '443',
'mod_wsgi.process_group': 'NAV',
'mod_wsgi.request_handler': 'wsgi-script',
'mod_wsgi.script_reloading': '1',
'mod_wsgi.version': (3, 3),
'wsgi.errors': <mod_wsgi.Log object at 0x7fdfb27046f0>,
'wsgi.file_wrapper': <built-in method file_wrapper of mod_wsgi.Adapter
object at 0x7fdfb4ca4a08>,
'wsgi.input': <mod_wsgi.Input object at 0x7fdfb34604f0>,
'wsgi.multiprocess': True,
'wsgi.multithread': True,
'wsgi.run_once': False,
'wsgi.url_scheme': 'https',
'wsgi.version': (1, 1)}>
-- 
Mischa Diehm | Network Operations Center (NOC)
UniBasel | UniRechenZentrum (URZ)
Klingebergstr. 70 | CH-4056 Basel
Tel. +41 61 267 1574 | http://urz.unibas.ch

From:  Morten Brekkevold morten.brekkevold@uninett.no
Date:  Mittwoch, 2. April 2014 10:13
To:  Sjøholt Steinar Otto ssj@hials.no
Cc:  "nav-users@uninett.no" nav-users@uninett.no
Subject:  Re: NAV authentication with LDAP + MS AD

> On Tue, 1 Apr 2014 11:29:27 +0000 Sjøholt Steinar Otto ssj@hials.no wrote:
> 
>>  I'm happy to say the fix works for MOST of our users.
>> 
>>  Unfortunately not for me...
>> 
>>  I have traced it down to the fact that i have a "ø" in my last name.
>>  Users with names not containing "æøå" can log in just fine.
> [snip]
>>  [Tue Apr 01 11:29:17 2014] [error]
>> self.ldap.simple_bind_s(user_dn.encode(encoding),
>>  [Tue Apr 01 11:29:17 2014] [error] UnicodeDecodeError: 'ascii' codec can't
>> decode byte 0xc3 in position 18: ordinal not in range(128)
> 
> Oops. The code does not consider that the user search result from the
> LDAP server is already encoded as UTF-8. Attempting to encode an already
> encoded string will cause Python to attempt to decode it from ASCII to
> unicode, before encoding that as UTF-8 again.
> 
> And I'm sorry to say, your name is not ASCII compatible ,)
> 
> It's a quick fix; I've taken the liberty of patching your server so you
> can log in again, Steinar :)
> 
> 
> -- 
> Morten Brekkevold
> UNINETT
> 

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Re: NAV authentication with LDAP + MS AD