Open Microscopy Environment

Posted: **Mon Dec 30, 2013 2:28 pm**

I want to map users from ldap into existing groups and in my config.xml I use omero.ldap.new_user_group value for example "some_group". After a some time period I can`t login again and apache shows me internal server error 500...There is no problem with users created internaly with omero. My system version OMERO.web 4.4.9-ice34-b98.

that`s my config

<properties id="__ACTIVE__">
<property name="omero.config.profile" value="default"/>
<property name="omero.config.version" value="4.2.1"/>
<property name="omero.web.application_server" value="fastcgi-tcp"/>
<property name="omero.db.name" value="omero_database"/>
<property name="omero.db.user" value="omero_user"/>
<property name="omero.db.pass" value="***"/>
<property name="omero.data.dir" value="/MSCOPE"/>
<property name="omero.web.viewer.initial_zoom_level" value="3"/>
<property name="omero.ldap.config" value="true"/>
<property name="omero.ldap.base" value="DC=puls,DC=edu,DC=pl"/>
<property name="omero.ldap.referral" value="follow"/>
<property name="omero.ldap.urls" value="ldap://a.b.c.d:389"/>
<property name="omero.ldap.password" value="***"/>
<property name="omero.ldap.username" value="cn=Manager,dc=puls,dc=edu,dc=pl"/>
<property name="omero.ldap.user_filter" value="(cn=*)"/>
<property name="omero.ldap.user_mapping" value="omeName=cn,firstName=cn,lastName=sn,email=mail"/>
<property name="omero.ldap.new_user_group" value="PULS"/>
<property name="omero.ldap.sync_on_login" value="false"/>
<property name="omero.db.poolsize" value="50"/>
<property name="omero.sessions.timeout" value="600000"/>
</properties>
<properties id="default">
<property name="omero.config.version" value="4.2.1"/>
<property name="omero.web.application_server" value="fastcgi-tcp"/>
<property name="omero.db.name" value="omero_database"/>
<property name="omero.db.user" value="omero_user"/>
<property name="omero.db.pass" value="***"/>
<property name="omero.data.dir" value="/MSCOPE"/>
<property name="omero.web.viewer.initial_zoom_level" value="3"/>
<property name="omero.ldap.config" value="true"/>
<property name="omero.ldap.base" value="DC=puls,DC=edu,DC=pl"/>
<property name="omero.ldap.referral" value="follow"/>
<property name="omero.ldap.urls" value="ldap://a.b.c.d:389"/>
<property name="omero.ldap.password" value="***"/>
<property name="omero.ldap.username" value="cn=Manager,dc=puls,dc=edu,dc=pl"/>
<property name="omero.ldap.user_filter" value="(cn=*)"/>
<property name="omero.ldap.user_mapping" value="omeName=cn,firstName=cn,lastName=sn,email=mail"/>
<property name="omero.ldap.new_user_group" value="PULS"/>
<property name="omero.ldap.sync_on_login" value="false"/>
<property name="omero.db.poolsize" value="50"/>
<property name="omero.sessions.timeout" value="600000"/>
</properties>

what is the problem?

Apache gives me this

[Mon Dec 30 16:05:06 2013] [error] [client 150.254.175.41] FastCGI: comm with server "/home/cc36812/apps/OMERO.server-4.4.9-ice34-b98/var/omero.fcgi" aborted: idle timeout (30 sec), referer: http://microscopy.oi.up.poznan.pl/omero ... bclient%2F
[Mon Dec 30 16:05:06 2013] [error] [client 150.254.175.41] FastCGI: incomplete headers (0 bytes) received from server "/home/cc36812/apps/OMERO.server-4.4.9-ice34-b98/var/omero.fcgi", referer: http://microscopy.oi.up.poznan.pl/omero ... bclient%2F

Posted: **Wed Jan 01, 2014 4:32 pm**

Could you possibly upload the server log files? Specifically: var/log/Blitz-0.log, var/log/master.out and var/log/master.err.

Thanks,
~Josh

Posted: **Sun Jan 05, 2014 1:39 pm**

It looks like sometimes - randomly - omero is not passing credentials to LDAP server, my blitz log file is over 400MB large and master.out is empty. What file extension is allowed for upload?

Posted: **Sun Jan 05, 2014 5:52 pm**

.zip should be allowed. If you have any trouble, let us know.

Cheers,
~Josh

Posted: **Sun Jan 05, 2014 6:59 pm**

zip file is about 900KB and i can`t attach it

Posted: **Mon Jan 06, 2014 8:01 am**

Sorry about that. Would you mind uploading via http://qa.openmicroscopy.org.uk/qa/upload/ then? Cheers, ~Josh

Posted: **Tue Jan 07, 2014 8:39 am**

jmoore wrote:Sorry about that. Would you mind uploading via http://qa.openmicroscopy.org.uk/qa/upload/ then? Cheers, ~Josh

I`ve uploaded
7802 unknown QA Bug 2014 01 07 150.254.175.41

Posted: **Tue Jan 07, 2014 9:17 am**

Thanks for the logs. The first error I see is:

Code: Select all: 2014-01-03 15:14:46,890 INFO [ ome.services.util.ServiceHandler] (erver-2002) Excp: org.springframework.ldap.ServiceUnavailableException: 150.254.159.58:389; socket closed; nested exception is javax.naming.ServiceUnavailableException: 150.254.159.58:389; socket closed; remaining name '' 2014-01-03 15:14:46,890 ERROR [ ome.services.util.ServiceHandler] (erver-2002) Method interface ome.services.util.Executor$Work.doWork invocation took 960435 2014-01-03 15:14:46,890 ERROR [services.blitz.fire.PermissionsVerifierI] (erver-2002) Exception thrown while checking password for:36812 ome.conditions.InternalException: Wrapped Exception: (org.springframework.ldap.ServiceUnavailableException): 150.254.159.58:389; socket closed; nested exception is javax.naming.ServiceUnavailableException: 150.254.159.58:389; socket closed; remaining name '' at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:210)

There are then a total of 18 of these at the following times:

Code: Select all: grep -E "^2014.*org.springframework.ldap.ServiceUnavailableException" Blitz-0.log | cut -f 1 -d, 2014-01-03 15:14:46 2014-01-03 20:50:24 2014-01-03 20:51:20 2014-01-03 22:24:26 2014-01-05 09:30:04 2014-01-05 09:30:46 2014-01-05 16:25:28 2014-01-05 16:26:05 2014-01-05 16:47:33 2014-01-05 16:48:05 2014-01-05 16:56:58 2014-01-05 16:57:51 2014-01-05 17:13:16 2014-01-05 20:23:05 2014-01-05 23:14:08 2014-01-05 23:15:01 2014-01-05 23:46:09

Posted: **Tue Jan 07, 2014 9:32 am**

The most related information I can find seems to be:

At the moment, I assume what's happening is that queries are taking too long and therefore eventually there are no more connections. From the related Atlassian ticket CWD-1942, "...we concluded that the timeout may happen if:
1. The DC [the server] is connecting to is too big (huge number of users/groups), causing the LDAP query to be very expensive for AD.
2. [The server] is connecting to distributed DCs located in different physical locations, causing a search to depend on the communication latency between DCs.
3. The AD server query timeout is set to be very small."

Do any of those seem to hold? If so, you might try their suggested workaround:

Code: Select all: -Dcom.sun.jndi.ldap.connect.pool.timeout=3

(though 3 milliseconds was thought to be a bit short). The option can be added to your etc/grid/templates.xml file around line 205.

Another possibility would be to try setting omero.ldap.referral to ignore (the default) if you don't explicitly know that you need it.

Sorry for not having a more concrete fix, but hopefully with some back and forth we can figure out what's going on.

Cheers,
~Josh

Posted: **Fri Jan 10, 2014 9:38 pm**

-Dcom.sun.jndi.ldap.connect.pool.timeout=3

I ve applied this and it works. Thank you very much!

regards
RS

Open Microscopy Environment

ldap users into existing groups

ldap users into existing groups

Re: ldap users into existing groups

Re: ldap users into existing groups

Re: ldap users into existing groups

Re: ldap users into existing groups

Re: ldap users into existing groups

Re: ldap users into existing groups

Re: ldap users into existing groups

Re: ldap users into existing groups

Re: ldap users into existing groups