{"action":"closed","issue":{"url":"https://api.github.com/repos/rancher/rancher/issues/5151","repository_url":"https://api.github.com/repos/rancher/rancher","labels_url":"https://api.github.com/repos/rancher/rancher/issues/5151/labels{/name}","comments_url":"https://api.github.com/repos/rancher/rancher/issues/5151/comments","events_url":"https://api.github.com/repos/rancher/rancher/issues/5151/events","html_url":"https://github.com/rancher/rancher/issues/5151","id":160683071,"number":5151,"title":"Cannot configure ActiveDirectory due to some groups not accessible","user":{"login":"frleb","id":227136,"avatar_url":"https://avatars.githubusercontent.com/u/227136?v=3","gravatar_id":"","url":"https://api.github.com/users/frleb","html_url":"https://github.com/frleb","followers_url":"https://api.github.com/users/frleb/followers","following_url":"https://api.github.com/users/frleb/following{/other_user}","gists_url":"https://api.github.com/users/frleb/gists{/gist_id}","starred_url":"https://api.github.com/users/frleb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frleb/subscriptions","organizations_url":"https://api.github.com/users/frleb/orgs","repos_url":"https://api.github.com/users/frleb/repos","events_url":"https://api.github.com/users/frleb/events{/privacy}","received_events_url":"https://api.github.com/users/frleb/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rancher/rancher/labels/area/access-control","name":"area/access-control","color":"FBCA04"},{"url":"https://api.github.com/repos/rancher/rancher/labels/kind/enhancement","name":"kind/enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/rancher/rancher/labels/status/resolved","name":"status/resolved","color":"0052cc"},{"url":"https://api.github.com/repos/rancher/rancher/labels/status/to-test","name":"status/to-test","color":"66aa66"}],"state":"closed","locked":false,"assignee":{"login":"tfiduccia","id":11514927,"avatar_url":"https://avatars.githubusercontent.com/u/11514927?v=3","gravatar_id":"","url":"https://api.github.com/users/tfiduccia","html_url":"https://github.com/tfiduccia","followers_url":"https://api.github.com/users/tfiduccia/followers","following_url":"https://api.github.com/users/tfiduccia/following{/other_user}","gists_url":"https://api.github.com/users/tfiduccia/gists{/gist_id}","starred_url":"https://api.github.com/users/tfiduccia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tfiduccia/subscriptions","organizations_url":"https://api.github.com/users/tfiduccia/orgs","repos_url":"https://api.github.com/users/tfiduccia/repos","events_url":"https://api.github.com/users/tfiduccia/events{/privacy}","received_events_url":"https://api.github.com/users/tfiduccia/received_events","type":"User","site_admin":false},"assignees":[{"login":"tfiduccia","id":11514927,"avatar_url":"https://avatars.githubusercontent.com/u/11514927?v=3","gravatar_id":"","url":"https://api.github.com/users/tfiduccia","html_url":"https://github.com/tfiduccia","followers_url":"https://api.github.com/users/tfiduccia/followers","following_url":"https://api.github.com/users/tfiduccia/following{/other_user}","gists_url":"https://api.github.com/users/tfiduccia/gists{/gist_id}","starred_url":"https://api.github.com/users/tfiduccia/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tfiduccia/subscriptions","organizations_url":"https://api.github.com/users/tfiduccia/orgs","repos_url":"https://api.github.com/users/tfiduccia/repos","events_url":"https://api.github.com/users/tfiduccia/events{/privacy}","received_events_url":"https://api.github.com/users/tfiduccia/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/rancher/rancher/milestones/67","html_url":"https://github.com/rancher/rancher/milestones/Release%201.2.0","labels_url":"https://api.github.com/repos/rancher/rancher/milestones/67/labels","id":1788744,"number":67,"title":"Release 1.2.0","description":"","creator":{"login":"will-chan","id":10134676,"avatar_url":"https://avatars.githubusercontent.com/u/10134676?v=3","gravatar_id":"","url":"https://api.github.com/users/will-chan","html_url":"https://github.com/will-chan","followers_url":"https://api.github.com/users/will-chan/followers","following_url":"https://api.github.com/users/will-chan/following{/other_user}","gists_url":"https://api.github.com/users/will-chan/gists{/gist_id}","starred_url":"https://api.github.com/users/will-chan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/will-chan/subscriptions","organizations_url":"https://api.github.com/users/will-chan/orgs","repos_url":"https://api.github.com/users/will-chan/repos","events_url":"https://api.github.com/users/will-chan/events{/privacy}","received_events_url":"https://api.github.com/users/will-chan/received_events","type":"User","site_admin":false},"open_issues":203,"closed_issues":197,"state":"open","created_at":"2016-05-26T00:51:12Z","updated_at":"2016-10-25T23:33:32Z","due_on":"2016-10-28T07:00:00Z","closed_at":null},"comments":4,"created_at":"2016-06-16T14:58:08Z","updated_at":"2016-10-25T23:33:32Z","closed_at":"2016-10-25T23:33:32Z","body":"**Rancher Version:**\r\n1.1.0-dev3\r\n\r\n**Docker Version:**\r\n1.10.3\r\n\r\n**OS and where are the hosts located? (cloud, bare metal, etc):**\r\nUbuntu 16.04 LTS\r\n\r\n**Setup Details: (single node rancher vs. HA rancher, internal DB vs. external DB)**\r\nSingle node, Internal DB\r\n\r\n**Environment Type: (Cattle/Kubernetes/Swarm/Mesos)**\r\nCattle\r\n\r\n**Steps to Reproduce:**\r\nCreate a user in Active Directory. \r\nMake the user member of a local domain group. \r\nIn the property of this group, security tab, uncheck all permissions for the \"authenticated users\".\r\n\r\nIn the Access Control menu, try to set up an Active Directory Authentication. Test and enable the authentication with the same user above.\r\n\r\nI also suspect your ActiveDirectory access control doesnt support universal group from an Active Directory Forest.\r\n\r\nMain domain : example.ca\r\nthe user account \"test\" is in example.ca\r\n\r\nthere is a subdomain : fsg.example.ca\r\nthe test@example.ca is member of FSG-UL-etude which is a universal group.\r\n\r\n**Results:** \r\nThe UI gave us an \"Internal server error\".\r\n\r\n[cattle-error-debug-log.txt](https://github.com/rancher/rancher/files/318569/cattle-error-debug-log.txt)\r\n\r\na group with restricted permissions on the object : \r\n2016-06-16 12:32:08,300 INFO  [:] [] [] [] [cutorService-20] [i.c.p.i.a.a.i.l.a.ADIdentityProvider] Failed to get object: CN=CourrielEtudiant,OU=Courriel_Etudiant,OU=IDUL,OU=Groupes,DC=example,DC=ca : [LDAP: error code 32 - 0000208D: NameErr: DSID-031522DA, problem 2001 (NO_OBJECT), data 0, best match of:\r\n\t'OU=Courriel_Etudiant,OU=IDUL,OU=Groupes,DC=example,DC=ca'\r\n] \r\n\r\nuniversal group in a other domain than the user account :\r\n2016-06-16 12:32:08,299 INFO  [:] [] [] [] [cutorService-14] [i.c.p.i.a.a.i.l.a.ADIdentityProvider] Failed to get object: CN=FSG-UL-etude,OU=FSG,OU=Groupes_Fonctions,DC=fsg,DC=example,DC=ca : [LDAP: error code 10 - 0000202B: RefErr: DSID-03100747, data 0, 1 access points\r\n\tref 1: 'fsg.example.ca'\r\n] \r\n\r\n**Expected:**\r\nIn a very large Active Directory domain with restriction on object group, permit enabling Active Directory Access Control even if the object groups are not accessible."}}
{"actor":{"display_login":"tfiduccia"}}