{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/awx/issues/2060","repository_url":"https://api.github.com/repos/ansible/awx","labels_url":"https://api.github.com/repos/ansible/awx/issues/2060/labels{/name}","comments_url":"https://api.github.com/repos/ansible/awx/issues/2060/comments","events_url":"https://api.github.com/repos/ansible/awx/issues/2060/events","html_url":"https://github.com/ansible/awx/issues/2060","id":340007530,"node_id":"MDU6SXNzdWUzNDAwMDc1MzA=","number":2060,"title":"Attempting to log on with a LDAP user simply logs a 401 error","user":{"login":"mhurron","id":3199503,"node_id":"MDQ6VXNlcjMxOTk1MDM=","avatar_url":"https://avatars3.githubusercontent.com/u/3199503?v=4","gravatar_id":"","url":"https://api.github.com/users/mhurron","html_url":"https://github.com/mhurron","followers_url":"https://api.github.com/users/mhurron/followers","following_url":"https://api.github.com/users/mhurron/following{/other_user}","gists_url":"https://api.github.com/users/mhurron/gists{/gist_id}","starred_url":"https://api.github.com/users/mhurron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mhurron/subscriptions","organizations_url":"https://api.github.com/users/mhurron/orgs","repos_url":"https://api.github.com/users/mhurron/repos","events_url":"https://api.github.com/users/mhurron/events{/privacy}","received_events_url":"https://api.github.com/users/mhurron/received_events","type":"User","site_admin":false},"labels":[{"id":687169246,"node_id":"MDU6TGFiZWw2ODcxNjkyNDY=","url":"https://api.github.com/repos/ansible/awx/labels/component:api","name":"component:api","color":"fbca04","default":false},{"id":687169295,"node_id":"MDU6TGFiZWw2ODcxNjkyOTU=","url":"https://api.github.com/repos/ansible/awx/labels/component:ui","name":"component:ui","color":"009800","default":false},{"id":687172858,"node_id":"MDU6TGFiZWw2ODcxNzI4NTg=","url":"https://api.github.com/repos/ansible/awx/labels/state:needs_triage","name":"state:needs_triage","color":"A0522D","default":false},{"id":607283748,"node_id":"MDU6TGFiZWw2MDcyODM3NDg=","url":"https://api.github.com/repos/ansible/awx/labels/type:bug","name":"type:bug","color":"F79F81","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-07-10T21:07:44Z","updated_at":"2018-07-30T09:30:37Z","closed_at":null,"author_association":"NONE","body":"##### ISSUE TYPE\r\n - Bug Report\r\n \r\n\r\n##### COMPONENT NAME\r\n - API\r\n - UI\r\n\r\n##### SUMMARY\r\nAttempting to log on with a LDAP user simply logs a 401 error. Logging in with a locally defined user works.\r\n\r\n- \"POST /api/login/ HTTP/1.1\" 401 5879 \"https://host.domain.com/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.1 Safari/605.1.15\"\r\n\r\n##### ENVIRONMENT\r\n* AWX version: 1.0.6.25\r\n* AWX install method: docker on linux\r\n* Ansible version:  version included in docker container\r\n* Operating System: RHEL7\r\n* Web Browser: Safari\r\n\r\n##### STEPS TO REPRODUCE\r\n\r\nConfigure LDAP: (obviously changed sensitive information)\r\n\r\n\"AUTH_LDAP_SERVER_URI\": \"ldap://controller.domain.com:389\",\r\n    \"AUTH_LDAP_BIND_DN\": \"CN=awxuser,OU=Users,DC=domain,DC=com\",\r\n    \"AUTH_LDAP_BIND_PASSWORD\": [password],\r\n    \"AUTH_LDAP_START_TLS\": false,\r\n    \"AUTH_LDAP_CONNECTION_OPTIONS\": {\r\n        \"OPT_NETWORK_TIMEOUT\": 30,\r\n        \"OPT_REFERRALS\": 0\r\n    },\r\n    \"AUTH_LDAP_USER_SEARCH\": [\"OU=Users,DC=domain,DC=com\",\"SCOPE_SUBTREE\",\"(cn=%(user)s)\"],\r\n    \"AUTH_LDAP_USER_DN_TEMPLATE\": \"\",\r\n    \"AUTH_LDAP_USER_ATTR_MAP\": {},\r\n    \"AUTH_LDAP_GROUP_SEARCH\": [\"OU=Groups,dc=domain,dc=com\",\"SCOPE_SUBTREE\",\"(objectClass=group)\"],\r\n    \"AUTH_LDAP_GROUP_TYPE\": \"ActiveDirectoryGroupType\",\r\n    \"AUTH_LDAP_GROUP_TYPE_PARAMS\": {},\r\n    \"AUTH_LDAP_REQUIRE_GROUP\": null,\r\n    \"AUTH_LDAP_DENY_GROUP\": null,\r\n    \"AUTH_LDAP_USER_FLAGS_BY_GROUP\": {\"is_superuser\": \"CN=admins,OU=Groups,DC=domain,dc=com\"},\r\n\r\nLogin via UI with LDAP user.\r\n\r\n##### EXPECTED RESULTS\r\n\r\nAccess should be granted\r\n\r\n##### ACTUAL RESULTS\r\n\r\n\"POST /api/login/ HTTP/1.1\" 401 5879 \"https://host.domain.com/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.1 Safari/605.1.15\"\r\n\r\nUI displays - Invalid username and/or password. Please try again.\r\n\r\n##### ADDITIONAL INFORMATION\r\n"},"comment":{"url":"https://api.github.com/repos/ansible/awx/issues/comments/408804154","html_url":"https://github.com/ansible/awx/issues/2060#issuecomment-408804154","issue_url":"https://api.github.com/repos/ansible/awx/issues/2060","id":408804154,"node_id":"MDEyOklzc3VlQ29tbWVudDQwODgwNDE1NA==","user":{"login":"onitake","id":371687,"node_id":"MDQ6VXNlcjM3MTY4Nw==","avatar_url":"https://avatars0.githubusercontent.com/u/371687?v=4","gravatar_id":"","url":"https://api.github.com/users/onitake","html_url":"https://github.com/onitake","followers_url":"https://api.github.com/users/onitake/followers","following_url":"https://api.github.com/users/onitake/following{/other_user}","gists_url":"https://api.github.com/users/onitake/gists{/gist_id}","starred_url":"https://api.github.com/users/onitake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/onitake/subscriptions","organizations_url":"https://api.github.com/users/onitake/orgs","repos_url":"https://api.github.com/users/onitake/repos","events_url":"https://api.github.com/users/onitake/events{/privacy}","received_events_url":"https://api.github.com/users/onitake/received_events","type":"User","site_admin":false},"created_at":"2018-07-30T09:30:37Z","updated_at":"2018-07-30T09:30:37Z","author_association":"NONE","body":"I'm not 100% sure, but it seems like I was hitting the same issue here.\r\n\r\nMy LDAP group parameters were specified as follows:\r\n```json\r\n{\r\n \"name_attr\": \"cn\",\r\n \"ldap_group_user_attr\": \"uid\"\r\n}\r\n```\r\nThis has worked fine in 1.0. In 1.0.6, it doesn't, but the paramters are no longer required, because these exact values are now the defaults of `PosixUIDGroupType`.\r\nAfter removing them login will succeed again.\r\n\r\nHowever, if you need custom values for these parameters, it seems to me that there is an invalid unicode/non-unicode string key search buried in the code, which will produce the following stack trace:\r\n```python\r\nTraceback (most recent call last):\r\n  File \"/usr/lib/python2.7/site-packages/awx/sso/backends.py\", line 110, in authenticate\r\n    return super(LDAPBackend, self).authenticate(username, password)\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/django_auth_ldap/backend.py\", line 167, in authenticate\r\n    user = ldap_user.authenticate(password)\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/django_auth_ldap/backend.py\", line 339, in authenticate\r\n    self._get_or_create_user()\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/django_auth_ldap/backend.py\", line 570, in _get_or_create_user\r\n    signal_responses = populate_user.send(self.backend.__class__, user=self._user, ldap_user=self)\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/dispatch/dispatcher.py\", line 193, in send\r\n    for receiver in self._live_receivers(sender)\r\n  File \"/usr/lib/python2.7/site-packages/awx/sso/backends.py\", line 352, in on_populate_user\r\n    ldap_user._get_groups().get_group_dns()\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/django_auth_ldap/backend.py\", line 828, in get_group_dns\r\n    group_infos = self._get_group_infos()\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/django_auth_ldap/backend.py\", line 840, in _get_group_infos\r\n    self._group_search)\r\n  File \"/usr/lib/python2.7/site-packages/awx/sso/ldap_group_types.py\", line 46, in user_groups\r\n    groups = search.execute(ldap_user.connection)\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/django_auth_ldap/config.py\", line 164, in execute\r\n    self.attrlist)\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/ldap/ldapobject/simple.py\", line 875, in search_s\r\n    timeout=self.timeout\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/ldap/ldapobject/simple.py\", line 852, in search_ext_s\r\n    sizelimit\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/ldap/ldapobject/simple.py\", line 828, in search_ext\r\n    sizelimit,\r\n  File \"/var/lib/awx/venv/awx/lib/python2.7/site-packages/ldap/ldapobject/simple.py\", line 91, in _ldap_call\r\n    result = func(*args, **kwargs)\r\nTypeError: ('expected string in list', u'cn')\r\n```"}}
{"actor":{"display_login":"onitake"}}