Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1t21PU-001VZ9-I8 for pgsql-admin@arkaria.postgresql.org; Sat, 19 Oct 2024 04:49:52 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1t21PR-00FABq-Q6 for pgsql-admin@arkaria.postgresql.org; Sat, 19 Oct 2024 04:49:50 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1t21PR-00FA8i-Ci for pgsql-admin@lists.postgresql.org; Sat, 19 Oct 2024 04:49:49 +0000 Received: from cloud.gatewaynet.com ([185.90.37.94]) by magus.postgresql.org with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1t21PO-001qm8-Pu for pgsql-admin@lists.postgresql.org; Sat, 19 Oct 2024 04:49:49 +0000 Content-Type: multipart/alternative; boundary="------------M0KVXJAuYYxdx4XNJ9VeAirc" Message-ID: Date: Sat, 19 Oct 2024 07:49:44 +0300 MIME-Version: 1.0 Subject: Re: LDAP authentication problem To: pgsql-admin@lists.postgresql.org References: Content-Language: en-US From: Achilleas Mantzios In-Reply-To: List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk This is a multi-part message in MIME format. --------------M0KVXJAuYYxdx4XNJ9VeAirc Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Στις 18/10/24 14:29, ο/η Domen Šetar έγραψε: > Hi Admins, > > I have faced very strange problem in one of my postgresql servers. We > use LDAP authentication. > > Several colegues can't login with their AD accounts into the server. I > found error messages in postgresql log: > > 2024-10-18 07:23:46 CEST [3203974]: [2-1] … could not search LDAP for > filter "(samaccountname=johndoe)" on server "adc1 adc2": Operations error > > 2024-10-18 07:23:46 CEST [3203974]: [3-1] … DETAIL: LDAP diagnostics: > 000004DC: LdapErr: DSID-0C090C78, comment: In order to perform this > operation a successful bind must be completed on the connection., data > 0, v4f7c > > 2024-10-18 07:23:46 CEST [3203974]: [4-1] … FATAL: LDAP > authentication failed for user "johndoe” > > I can login with my AD account. > > Ldapsearch works from the host. > > My colegues can login with the same LDAP account to postgresql on > antoher hosts. > Can you post the effective pg_hba.conf lines? What does the AD logs say ? BTW, Had you looked for AD alternatives before deploying it? Such as FreeIPA ? OpenLDAP ? > I'm out of ideas what could be wrong. > > Best regards! > > izum > > > > Domen Šetar > /Computer Systems Support/ > IZUM – Institute of Information Science| Prešernova ulica 17 | 2000 > Maribor |Slovenia/ > /T: +386 2 25 20 339| M: +386 41 676 342| www.izum.si > |domen.setar@izum.si > --------------M0KVXJAuYYxdx4XNJ9VeAirc Content-Type: multipart/related; boundary="------------DR60Ebs4Sa2thDf0DjvY7qWU" --------------DR60Ebs4Sa2thDf0DjvY7qWU Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit

Στις 18/10/24 14:29, ο/η Domen Šetar έγραψε:

Hi Admins,

I have faced very strange problem in one of my postgresql servers. We use LDAP authentication.

Several colegues can't login with their AD accounts into the server. I found error messages in postgresql log:

2024-10-18 07:23:46 CEST [3203974]: [2-1] … could not search LDAP for filter "(samaccountname=johndoe)" on server "adc1 adc2": Operations error

2024-10-18 07:23:46 CEST [3203974]: [3-1] … DETAIL: LDAP diagnostics: 000004DC: LdapErr: DSID-0C090C78, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c

2024-10-18 07:23:46 CEST [3203974]: [4-1] … FATAL: LDAP authentication failed for user "johndoe”

I can login with my AD account.

Ldapsearch works from the host.

My colegues can login with the same LDAP account to postgresql on antoher hosts.

Can you post the effective pg_hba.conf lines? What does the AD logs say ?

BTW, Had you looked for AD alternatives before deploying it? Such as FreeIPA ? OpenLDAP ?

I'm out of ideas what could be wrong.

Best regards!

Domen Šetar
Computer Systems Support
IZUM – Institute of Information Science | Prešernova ulica 17 | 2000 Maribor | Slovenia
T: +386 2 25 20 339 | M: +386 41 676 342 | www.izum.si | domen.setar@izum.si

--------------DR60Ebs4Sa2thDf0DjvY7qWU Content-Type: image/jpeg; name="image002.jpg" Content-Disposition: inline; filename="image002.jpg" Content-Id: Content-Transfer-Encoding: base64 /9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRof Hh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwh MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAAR CABHAEcDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAA AgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkK FhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWG h4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl 5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREA AgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYk NOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOE hYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk 5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD3+iiigArN1OR0vdIVXZVe8ZXAONw8mU4P 4gH8K0qwvE2q6ZoqaZfarctbwJeYVwpYbjFIOcc4xn8cVUU27ImTsrhqU0qaN4idZXVokk8t g2Cn7hTx6c81uD7o+lcFf+PfBsmmarF/bYb7Wj5VInLDMYTAyME8frXer90fSnKLjuhRkm9G LRRRUFhRRRQAUUUUAFZev2Oj32lsuuR2z2UbCQm4ICoR0OT06n8zWpXJ+PNP07VLPSbTVGuB bPqAOLeMuxYQykAgAnHHPB/qLp/EiZ/Czj4brw1f6odK0bwvDr1swMc1zBYRQtDkdfMwqnrx 936mvWx0rjfsNg2lyaZa6tqNlDLG0KD7KIUXcMDnylA6+oNdkOgqqruyKSsLRRRWRqFFFFAB RRRQAVz3i7XZfD9pYXUOmy6g0l2IjDCu6QAxyElR6jb+Wa6Guc8Y3mtWVnp76FFDPeNd4MMu MSIIpGKg9j8vXIq6avJJkVHaLOavfGer67ZT6VY+DtWjmvI2g827iMccYYbdzHHQZzivRYlZ YkVm3MFAJ9TXn8vjKDxFoGoJaXVzo2v2MDym0lO1wyrkjBGHHHpkegzXoQ+6PpV1VbS1iaev W4tFFFYmoUUUUAFFFFABXM+NLvTLG00y51S/ubCOO+UxXMAB2P5cn3gVbKkbh07iumrG1+ys NQfS7XULNLqJ7w7UkAKhhDKckEHdxnj1IParhZS1Jnfl0OB8X6v8O/Etg8lxqii+ijJiuIIm EuQOn3QDn0P6V6sv3R9K4/UfDfhhdJ1iQ+HNPH2WJwfLgRWOIw3DbflPOM9sZrsB0FVUlFpK N/mRTi022LRRRWRqFFFFABRRRQAVmar/AMf+i/8AX63/AKImooprcUtilqv/ACA/E/8A1zk/ 9J1rfHQUUU3sJbi0UUVJQUUUUAf/2Q== --------------DR60Ebs4Sa2thDf0DjvY7qWU-- --------------M0KVXJAuYYxdx4XNJ9VeAirc--