{"action":"closed","issue":{"url":"https://api.github.com/repos/camptocamp/puppet-openldap/issues/238","repository_url":"https://api.github.com/repos/camptocamp/puppet-openldap","labels_url":"https://api.github.com/repos/camptocamp/puppet-openldap/issues/238/labels{/name}","comments_url":"https://api.github.com/repos/camptocamp/puppet-openldap/issues/238/comments","events_url":"https://api.github.com/repos/camptocamp/puppet-openldap/issues/238/events","html_url":"https://github.com/camptocamp/puppet-openldap/issues/238","id":408456447,"node_id":"MDU6SXNzdWU0MDg0NTY0NDc=","number":238,"title":"ldap_modify: Error 80 adding TLS certificates and keys","user":{"login":"jacksgt","id":11589682,"node_id":"MDQ6VXNlcjExNTg5Njgy","avatar_url":"https://avatars3.githubusercontent.com/u/11589682?v=4","gravatar_id":"","url":"https://api.github.com/users/jacksgt","html_url":"https://github.com/jacksgt","followers_url":"https://api.github.com/users/jacksgt/followers","following_url":"https://api.github.com/users/jacksgt/following{/other_user}","gists_url":"https://api.github.com/users/jacksgt/gists{/gist_id}","starred_url":"https://api.github.com/users/jacksgt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jacksgt/subscriptions","organizations_url":"https://api.github.com/users/jacksgt/orgs","repos_url":"https://api.github.com/users/jacksgt/repos","events_url":"https://api.github.com/users/jacksgt/events{/privacy}","received_events_url":"https://api.github.com/users/jacksgt/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-02-09T18:20:23Z","updated_at":"2019-02-09T18:20:38Z","closed_at":"2019-02-09T18:20:38Z","author_association":"NONE","body":"Hi everyone,\r\n\r\nI just had this weird error `ldap_modify: Other (e.g., implementation specific) error (80)` when Puppet was applying the LDIF to modify the SSL / TLS certificates and keys for OpenLDAP.\r\n\r\n\r\nHere my initial puppet code:\r\n```puppet\r\nclass profile::openldap (\r\nString $server_name = 'example',\r\nString $tld = 'com',\r\nString $admin_password,\r\nString $ssl_key_path = '/etc/ssl/private/ssl-cert-snakeoil.key',\r\nString $ssl_cert_path = '/etc/ssl/certs/ssl-cert-snakeoil.pem',\r\n) {\r\n\r\nclass { '::openldap::server':\r\n  provider => 'olc',\r\n  ssl_key => $ssl_key_path,\r\n  ssl_cert => $ssl_cert_path,\r\n}\r\n\r\nopenldap::server::database { \"dc=${server_name},dc=${tld}\":\r\n  ensure => present,\r\n  rootdn => \"cn=admin,dc=${server_name},dc=${tld}\",\r\n  rootpw => $admin_password,\r\n}\r\n```\r\n\r\nThe complete error message:\r\n```\r\nError: LDIF content:\r\ndn: cn=config\r\nadd: olcTLSCertificateFile\r\nolcTLSCertificateFile: /etc/ssl/certs/ssl-cert-snakeoil.pem\r\n-\r\nadd: olcTLSCertificateKeyFile\r\nolcTLSCertificateKeyFile: /etc/ssl/private/ssl-cert-snakeoil.key\r\n-\r\n\r\nError message: Execution of '/usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/openldap_global_conf20190209-14638-1aj63yj' returned 80: SASL/EXTERNAL authentication started\r\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\r\nSASL SSF: 0\r\nldap_modify: Other (e.g., implementation specific) error (80)\r\nmodifying entry \"cn=config\"\r\nError: /Stage[main]/Openldap::Server::Slapdconf/Openldap::Server::Globalconf[TLSCertificate]/Openldap_global_conf[TLSCertificate]/ensure: change from 'absent' to 'present' failed: LDIF content:\r\ndn: cn=config\r\nadd: olcTLSCertificateFile\r\nolcTLSCertificateFile: /etc/ssl/certs/ssl-cert-snakeoil.pem\r\n-\r\nadd: olcTLSCertificateKeyFile\r\nolcTLSCertificateKeyFile: /etc/ssl/private/ssl-cert-snakeoil.key\r\n-\r\n\r\nError message: Execution of '/usr/bin/ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/openldap_global_conf20190209-14638-1aj63yj' returned 80: SASL/EXTERNAL authentication started\r\nSASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\r\nSASL SSF: 0\r\nldap_modify: Other (e.g., implementation specific) error (80)\r\nmodifying entry \"cn=config\"\r\n```\r\n\r\nAfter digging around for quite some time I found the issue: slapd was unable to access the files!\r\nAlbeit, this is a very bad error message for that.\r\n\r\n```\r\n$ ls -l /etc/ssl/private/ssl-cert-snakeoil.key \r\n-rw-r----- 1 root ssl-cert 1704 Feb  9 18:00 /etc/ssl/private/ssl-cert-snakeoil.key\r\n$ groups openldap\r\nopenldap : openldap\r\n```\r\n\r\nThe fix was to add the 'openldap' user (which slapd runs as on Debian) to the 'ssl-cert' group (which has access to the certificates and private keys). Also don't forget to restart your slapd!\r\n\r\nFix in Puppet:\r\n\r\n```puppet\r\nuser { 'openldap':\r\n  groups => ['ssl-cert'],\r\n  require => [ Package['ssl-cert'], Package['slapd'] ],\r\n}\r\n```\r\n\r\nAfterwards Puppet ran just fine:\r\n```\r\nNotice: /Stage[main]/Openldap::Server::Install/Package[slapd]/ensure: created\r\nNotice: /Stage[main]/Openldap::Server::Config/Shellvar[slapd]/value: value changed ['ldap:/// ldapi:///'] to ['ldap:/// ldapi:/// ']\r\nNotice: /Stage[main]/Openldap::Server::Service/Service[slapd]: Triggered 'refresh' from 1 event\r\nNotice: /Stage[main]/Openldap::Server::Slapdconf/File[/etc/ldap/slapd.d]/mode: mode changed '0755' to '0750'\r\nNotice: /Stage[main]/Openldap::Server::Slapdconf/Openldap::Server::Globalconf[TLSCertificate]/Openldap_global_conf[TLSCertificate]/ensure: created\r\nNotice: /Stage[main]/Openldap::Server::Slapdconf/Openldap::Server::Database[dc=my-domain,dc=com]/Openldap_database[dc=my-domain,dc=com]/ensure: removed\r\nNotice: /Stage[main]/Profile::Openldap/Openldap::Server::Database[dc=example,dc=com]/Openldap_database[dc=example,dc=com]/ensure: created\r\n```\r\n\r\nJust a heads-up in case anyone else stumbles onto this issue."}}
{"actor":{"display_login":"jacksgt"}}