ldap users into existing groups

[robert.stanislawiak]

I want to map users from ldap into existing groups and in my config.xml I use omero.ldap.new_user_group value for example "some_group". After a some time period I can`t login again and apache shows me internal server error 500...There is no problem with users created internaly with omero. My system version OMERO.web 4.4.9-ice34-b98.

that`s my config

<properties id="__ACTIVE__">
<property name="omero.config.profile" value="default"/>
<property name="omero.config.version" value="4.2.1"/>
<property name="omero.web.application_server" value="fastcgi-tcp"/>
<property name="omero.db.name" value="omero_database"/>
<property name="omero.db.user" value="omero_user"/>
<property name="omero.db.pass" value="***"/>
<property name="omero.data.dir" value="/MSCOPE"/>
<property name="omero.web.viewer.initial_zoom_level" value="3"/>
<property name="omero.ldap.config" value="true"/>
<property name="omero.ldap.base" value="DC=puls,DC=edu,DC=pl"/>
<property name="omero.ldap.referral" value="follow"/>
<property name="omero.ldap.urls" value="ldap://a.b.c.d:389"/>
<property name="omero.ldap.password" value="***"/>
<property name="omero.ldap.username" value="cn=Manager,dc=puls,dc=edu,dc=pl"/>
<property name="omero.ldap.user_filter" value="(cn=*)"/>
<property name="omero.ldap.user_mapping" value="omeName=cn,firstName=cn,lastName=sn,email=mail"/>
<property name="omero.ldap.new_user_group" value="PULS"/>
<property name="omero.ldap.sync_on_login" value="false"/>
<property name="omero.db.poolsize" value="50"/>
<property name="omero.sessions.timeout" value="600000"/>
</properties>
<properties id="default">
<property name="omero.config.version" value="4.2.1"/>
<property name="omero.web.application_server" value="fastcgi-tcp"/>
<property name="omero.db.name" value="omero_database"/>
<property name="omero.db.user" value="omero_user"/>
<property name="omero.db.pass" value="***"/>
<property name="omero.data.dir" value="/MSCOPE"/>
<property name="omero.web.viewer.initial_zoom_level" value="3"/>
<property name="omero.ldap.config" value="true"/>
<property name="omero.ldap.base" value="DC=puls,DC=edu,DC=pl"/>
<property name="omero.ldap.referral" value="follow"/>
<property name="omero.ldap.urls" value="ldap://a.b.c.d:389"/>
<property name="omero.ldap.password" value="***"/>
<property name="omero.ldap.username" value="cn=Manager,dc=puls,dc=edu,dc=pl"/>
<property name="omero.ldap.user_filter" value="(cn=*)"/>
<property name="omero.ldap.user_mapping" value="omeName=cn,firstName=cn,lastName=sn,email=mail"/>
<property name="omero.ldap.new_user_group" value="PULS"/>
<property name="omero.ldap.sync_on_login" value="false"/>
<property name="omero.db.poolsize" value="50"/>
<property name="omero.sessions.timeout" value="600000"/>
</properties>

what is the problem?

Apache gives me this

[Mon Dec 30 16:05:06 2013] [error] [client 150.254.175.41] FastCGI: comm with server "/home/cc36812/apps/OMERO.server-4.4.9-ice34-b98/var/omero.fcgi" aborted: idle timeout (30 sec), referer: http://microscopy.oi.up.poznan.pl/omero ... bclient%2F
[Mon Dec 30 16:05:06 2013] [error] [client 150.254.175.41] FastCGI: incomplete headers (0 bytes) received from server "/home/cc36812/apps/OMERO.server-4.4.9-ice34-b98/var/omero.fcgi", referer: http://microscopy.oi.up.poznan.pl/omero ... bclient%2F

[jmoore]

Could you possibly upload the server log files? Specifically: var/log/Blitz-0.log, var/log/master.out and var/log/master.err.

Thanks,
~Josh

[robert.stanislawiak]

It looks like sometimes - randomly - omero is not passing credentials to LDAP server, my blitz log file is over 400MB large and master.out is empty. What file extension is allowed for upload?

[jmoore]

.zip should be allowed. If you have any trouble, let us know.

Cheers,
~Josh

[robert.stanislawiak]

zip file is about 900KB and i can`t attach it

[jmoore]

Sorry about that. Would you mind uploading via http://qa.openmicroscopy.org.uk/qa/upload/ then? Cheers, ~Josh

[robert.stanislawiak]

Sorry about that. Would you mind uploading via http://qa.openmicroscopy.org.uk/qa/upload/ then? Cheers, ~Josh

I`ve uploaded
7802 unknown QA Bug 2014 01 07 150.254.175.41

[jmoore]

Thanks for the logs. The first error I see is:

Code: Select all

2014-01-03 15:14:46,890 INFO  [        ome.services.util.ServiceHandler] (erver-2002)  Excp:    org.springframework.ldap.ServiceUnavailableException: 150.254.159.58:389; socket closed; nested exception is javax.naming.ServiceUnavailableException: 150.254.159.58:389; socket closed; remaining name ''
2014-01-03 15:14:46,890 ERROR [        ome.services.util.ServiceHandler] (erver-2002) Method interface ome.services.util.Executor$Work.doWork invocation took 960435
2014-01-03 15:14:46,890 ERROR [services.blitz.fire.PermissionsVerifierI] (erver-2002) Exception thrown while checking password for:36812
ome.conditions.InternalException:  Wrapped Exception: (org.springframework.ldap.ServiceUnavailableException):
150.254.159.58:389; socket closed; nested exception is javax.naming.ServiceUnavailableException: 150.254.159.58:389; socket closed; remaining name ''
        at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:210)


There are then a total of 18 of these at the following times:

Code: Select all

grep -E "^2014.*org.springframework.ldap.ServiceUnavailableException" Blitz-0.log  | cut -f 1 -d,
2014-01-03 15:14:46
2014-01-03 20:50:24
2014-01-03 20:51:20
2014-01-03 22:24:26
2014-01-05 09:30:04
2014-01-05 09:30:46
2014-01-05 16:25:28
2014-01-05 16:26:05
2014-01-05 16:47:33
2014-01-05 16:48:05
2014-01-05 16:56:58
2014-01-05 16:57:51
2014-01-05 17:13:16
2014-01-05 20:23:05
2014-01-05 23:14:08
2014-01-05 23:15:01
2014-01-05 23:46:09


[jmoore]

The most related information I can find seems to be:

• https://confluence.atlassian.com/display/CROWDKB/ServiceUnavailableException+Reported+when+Connecting+to+LDAP
• http://stackoverflow.com/questions/14136091/ldap-search-is-very-slow

At the moment, I assume what's happening is that queries are taking too long and therefore eventually there are no more connections. From the related Atlassian ticket CWD-1942, "...we concluded that the timeout may happen if:
1. The DC [the server] is connecting to is too big (huge number of users/groups), causing the LDAP query to be very expensive for AD.
2. [The server] is connecting to distributed DCs located in different physical locations, causing a search to depend on the communication latency between DCs.
3. The AD server query timeout is set to be very small."

Do any of those seem to hold? If so, you might try their suggested workaround:

Code: Select all

-Dcom.sun.jndi.ldap.connect.pool.timeout=3


(though 3 milliseconds was thought to be a bit short). The option can be added to your etc/grid/templates.xml file around line 205.

Another possibility would be to try setting omero.ldap.referral to ignore (the default) if you don't explicitly know that you need it.

Sorry for not having a more concrete fix, but hopefully with some back and forth we can figure out what's going on.

Cheers,
~Josh

[robert.stanislawiak]

-Dcom.sun.jndi.ldap.connect.pool.timeout=3

I ve applied this and it works. Thank you very much!

regards
RS