You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "Mikoakos (via GitHub)" <gi...@apache.org> on 2025/03/27 14:14:00 UTC
[I] invalid LDAP login problem [superset]
Mikoakos opened a new issue, #32884:
URL: https://github.com/apache/superset/issues/32884
### Bug description
Hi All,
We’ve encountered the following issue. We used the configuration below for LDAP authentication; however, upon attempting to log in, we received an "invalid login" error message.
`from flask_appbuilder.security.manager import AUTH_LDAP
AUTH_TYPE = AUTH_LDAP
AUTH_LDAP_ALLOW_LOCAL_DB = True
AUTH_USER_REGISTRATION = True
AUTH_USER_REGISTRATION_ROLE = "Gamma"
AUTH_LDAP_USE_TLS = False
AUTH_LDAP_SERVER = "ldap://XX.XX.XX.XX:389"
AUTH_LDAP_SEARCH = "ou=Client,dc=bm,dc=hu"
AUTH_LDAP_BIND_USER = "cn=Manager,dc=bm,dc=hu"
AUTH_LDAP_BIND_PASSWORD = "xxxxxx"
AUTH_LDAP_UID_FIELD = "pertuEmail"
AUTH_LDAP_SEARCH_FILTER = "(|(pertuEmail={username})(uid={username}))"
AUTH_LDAP_ALLOW_SELF_SIGNED = True
AUTH_LDAP_APPEND_DOMAIN = False
AUTH_API_LOGIN_ALLOW_MULTIPLE_PROVIDERS = True
AUTH_ROLES_MAPPING = {
"ou=Client,dc=bm,dc=hu": ["Gamma", "Alpha"],
"cn=Manager,dc=bm,dc=hu": ["Admin"],
}
AUTH_ROLES_SYNC_AT_LOGIN = True
`
The system did not allow us to log in either via LDAP or with previously stored users.
Best regards,
Ákos Mikovics
### Screenshots/recordings
_No response_
### Superset version
master / latest-dev
### Python version
3.11
### Node version
16
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] invalid LDAP login problem [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #32884:
URL: https://github.com/apache/superset/issues/32884#issuecomment-2758222116
<!-- Greeting -->
Hey @Mikoakos! I'm here to help you with any bugs, questions, or contributions while you wait for a human to assist you. Let's get this sorted out!
<!-- Answer -->
I found a similar unsolved discussion that might be relevant to your issue: [Superset docker and LDAP Integration | Unable to get the next page after authentication with LDAP](https://github.com/apache/superset/discussions/30018) <sup>[[1]](https://github.com/apache/superset/discussions/30018)</sup>. Although it doesn't provide a solution, it might offer some insights or commonalities with your situation.
Regarding your configuration, here are a few things to check:
1. **LDAP Server and Credentials**: Ensure that the `AUTH_LDAP_SERVER`, `AUTH_LDAP_BIND_USER`, and `AUTH_LDAP_BIND_PASSWORD` are correct and have the necessary permissions to search the LDAP directory.
2. **Search Filter and UID Field**: Verify that the `AUTH_LDAP_SEARCH_FILTER` and `AUTH_LDAP_UID_FIELD` are correctly set to match the attributes used in your LDAP directory. The filter `(pertuEmail={username})(uid={username})` should match the LDAP entries.
3. **Role Mapping**: Check that the group names in `AUTH_ROLES_MAPPING` match exactly with the LDAP group names. Any mismatch can prevent proper role assignment.
4. **TLS and Self-Signed Certificates**: Since `AUTH_LDAP_USE_TLS` is set to `False`, ensure that your LDAP server does not require TLS. If it does, you might need to enable TLS and configure the server to accept self-signed certificates if necessary.
5. **Local Database Authentication**: With `AUTH_LDAP_ALLOW_LOCAL_DB` set to `True`, ensure that local database authentication is correctly configured and that there are no conflicts with LDAP authentication.
6. **Logs**: Check the Superset logs for any LDAP-related errors or warnings that might provide more context on the "invalid login" issue.
These steps might help you identify the root cause of the problem.
<!-- Dosu Comment Footer -->
*To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
---
<sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/88a023b1-3f50-41bc-bf05-f940244c374d?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/88a023b1-3f50-41bc-bf05-f940244c374d?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/88a023b1-3f50-41bc-bf05-f940244c374d?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/88a023b1-3f50-41bc-bf05-f940244c374d?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/88a023b1-3f50-41bc-bf05-f940244c374d?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/88a023b1-3f50-41bc-bf05-f940244c374d?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/88a023b1-3f50-41bc-bf05-f940244c374d?feedback_type=other)</sup>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] invalid LDAP login problem [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #32884: invalid LDAP login problem
URL: https://github.com/apache/superset/issues/32884
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org