How to integrate Chef Server with LDAP while no mail attribute is present in LDAP record
I'm trying to integrate Chef Server with LDAP. After following carefully the steps defined in https://docs.chef.io/server_ldap.html, login action with LDAP accounts did not work.
To debug, I executed some ldapsearch commands with the same parameters I did use in /etc/opscode/chef-server.rb. There, I did retrieve records but noticed that those lack the email attribute.
The documentation of Chef clearly states the following warning:
I have a strong feeling that this might be the cause of not being able to login.
Adding email attribute to the LDAP records is not an option. Is there a way to circumvent this problem?
ldap chef
asked Nov 25 '18 at 15:11
kekovskikekovski
235
add a comment |
I'm trying to integrate Chef Server with LDAP. After following carefully the steps defined in https://docs.chef.io/server_ldap.html, login action with LDAP accounts did not work.
To debug, I executed some ldapsearch commands with the same parameters I did use in /etc/opscode/chef-server.rb. There, I did retrieve records but noticed that those lack the email attribute.
The documentation of Chef clearly states the following warning:
I have a strong feeling that this might be the cause of not being able to login.
Adding email attribute to the LDAP records is not an option. Is there a way to circumvent this problem?
ldap chef
asked Nov 25 '18 at 15:11
kekovskikekovski
235
1
In theory, chef only needs the mail attribute for account provisioning, but it should not be required for login. Still I wonder why you wouldn't be able to add an email property to user entries as a workaround attempt, even a fake one like<uid>@domain, where domain is the canonical representation of the domain components in user's dn (e.g.'foo@bar.com'fromdc=bar,dc=com). Also, did you try to authenticate the same user usingopscode-manage? Please edit your post and let us see the output and also what the ldapsearch query and output looks like.
– EricLavault
Nov 25 '18 at 17:55
add a comment |
I'm trying to integrate Chef Server with LDAP. After following carefully the steps defined in https://docs.chef.io/server_ldap.html, login action with LDAP accounts did not work.
To debug, I executed some ldapsearch commands with the same parameters I did use in /etc/opscode/chef-server.rb. There, I did retrieve records but noticed that those lack the email attribute.
The documentation of Chef clearly states the following warning:
I have a strong feeling that this might be the cause of not being able to login.
Adding email attribute to the LDAP records is not an option. Is there a way to circumvent this problem?
ldap chef
asked Nov 25 '18 at 15:11
kekovskikekovski
235
I'm trying to integrate Chef Server with LDAP. After following carefully the steps defined in https://docs.chef.io/server_ldap.html, login action with LDAP accounts did not work.
To debug, I executed some ldapsearch commands with the same parameters I did use in /etc/opscode/chef-server.rb. There, I did retrieve records but noticed that those lack the email attribute.
The documentation of Chef clearly states the following warning:
I have a strong feeling that this might be the cause of not being able to login.
Adding email attribute to the LDAP records is not an option. Is there a way to circumvent this problem?
ldap chef
ldap chef
asked Nov 25 '18 at 15:11
kekovskikekovski
235
asked Nov 25 '18 at 15:11
kekovskikekovski
235
asked Nov 25 '18 at 15:11
kekovskikekovski
235
asked Nov 25 '18 at 15:11
kekovskikekovski
235
asked Nov 25 '18 at 15:11
kekovskikekovski
235
235
1
In theory, chef only needs the mail attribute for account provisioning, but it should not be required for login. Still I wonder why you wouldn't be able to add an email property to user entries as a workaround attempt, even a fake one like<uid>@domain, where domain is the canonical representation of the domain components in user's dn (e.g.'foo@bar.com'fromdc=bar,dc=com). Also, did you try to authenticate the same user usingopscode-manage? Please edit your post and let us see the output and also what the ldapsearch query and output looks like.
– EricLavault
Nov 25 '18 at 17:55
add a comment |
1
In theory, chef only needs the mail attribute for account provisioning, but it should not be required for login. Still I wonder why you wouldn't be able to add an email property to user entries as a workaround attempt, even a fake one like<uid>@domain, where domain is the canonical representation of the domain components in user's dn (e.g.'foo@bar.com'fromdc=bar,dc=com). Also, did you try to authenticate the same user usingopscode-manage? Please edit your post and let us see the output and also what the ldapsearch query and output looks like.
– EricLavault
Nov 25 '18 at 17:55
1
1
In theory, chef only needs the mail attribute for account provisioning, but it should not be required for login. Still I wonder why you wouldn't be able to add an email property to user entries as a workaround attempt, even a fake one like
<uid>@domain, where domain is the canonical representation of the domain components in user's dn (e.g. 'foo@bar.com' from dc=bar,dc=com). Also, did you try to authenticate the same user using opscode-manage ? Please edit your post and let us see the output and also what the ldapsearch query and output looks like.– EricLavault
Nov 25 '18 at 17:55
In theory, chef only needs the mail attribute for account provisioning, but it should not be required for login. Still I wonder why you wouldn't be able to add an email property to user entries as a workaround attempt, even a fake one like
<uid>@domain, where domain is the canonical representation of the domain components in user's dn (e.g. 'foo@bar.com' from dc=bar,dc=com). Also, did you try to authenticate the same user using opscode-manage ? Please edit your post and let us see the output and also what the ldapsearch query and output looks like.– EricLavault
Nov 25 '18 at 17:55
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53468852%2fhow-to-integrate-chef-server-with-ldap-while-no-mail-attribute-is-present-in-lda%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53468852%2fhow-to-integrate-chef-server-with-ldap-while-no-mail-attribute-is-present-in-lda%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
In theory, chef only needs the mail attribute for account provisioning, but it should not be required for login. Still I wonder why you wouldn't be able to add an email property to user entries as a workaround attempt, even a fake one like
<uid>@domain, where domain is the canonical representation of the domain components in user's dn (e.g.'foo@bar.com'fromdc=bar,dc=com). Also, did you try to authenticate the same user usingopscode-manage? Please edit your post and let us see the output and also what the ldapsearch query and output looks like.– EricLavault
Nov 25 '18 at 17:55