Quick Links

Re: [EXT] Re: pgadmin4 container deployment with ldap-authentication

From:	<heiko(dot)onnebrink(at)metronom(dot)com>
To:	<khushboo(dot)vashi(at)enterprisedb(dot)com>
Cc:	<pgadmin-support(at)lists(dot)postgresql(dot)org>, <hendrik(dot)hansmeier(at)hh-it(dot)co>
Subject:	Re: [EXT] Re: pgadmin4 container deployment with ldap-authentication
Date:	2020-08-11 12:56:34
Message-ID:	06420A5D-1CBC-4B2E-875B-C3F9443B582D@metronom.com
Views:	Raw Message \| Whole Thread \| Download mbox \| Resend email
Thread:
Lists:	pgadmin-support

<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style></style>
</head>
<body lang="en-DE" link="blue" vlink="purple">
<div class="WordSection1">
Can you confirm that the parameter that I pass to docker are (syntactical) correct to properly filter for the requested user record.<o:p></o:p>
As we should not timeout once we properly filter by userPrincipalName I want to be sure that filtering is properly passed to the LDAP quey.<o:p></o:p>
<o:p> </o:p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
From: Khushboo Vashi <khushboo(dot)vashi(at)enterprisedb(dot)com> 
Date: Tuesday, 11. August 2020 at 14:36 
To: "Onnebrink, Heiko" <heiko(dot)onnebrink(at)metronom(dot)com> 
Cc: "pgadmin-support lists.postgresql.org" <pgadmin-support(at)lists(dot)postgresql(dot)org>, Hendrik Hansmeier <hendrik(dot)hansmeier(at)hh-it(dot)co> 
Subject: Re: [EXT] Re: pgadmin4 container deployment with ldap-authentication<o:p></o:p>
</div>
<div>
<o:p> </o:p>
</div>
<div>
<div>
Hi,<o:p></o:p>
</div>
<o:p> </o:p>
<div>
<div>
On Tue, Aug 11, 2020 at 4:29 PM <<a href="mailto:heiko(dot)onnebrink(at)metronom(dot)com">heiko(dot)onnebrink(at)metronom(dot)com</a>> wrote:<o:p></o:p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
Hi, 
I am just back from holiday and wanted to test the same (as I authored this LDAP change request I think its overdue to test it __ )) 
 
To ensure the env is fine I executed ldapsearch on the docker host to have some check first: 
 
ldapsearch -LLL -x -h <a href="http://ldap.mgi.de:389" target="_blank">ldap.mgi.de:389</a> -D "cn=SVCLDAP,cn=Users,dc=asf,dc=madm,dc=net" -w xxxxxx -b"dc=madm,dc=net"  userPrincipalName=<a href="mailto:Heiko(dot)Onnebrink(at)metronom(dot)com" target="_blank">Heiko(dot)Onnebrink(at)metronom(dot)com</a> 
 
I got some fine output back within some ms: 
 
dn: CN=Onnebrink Heiko,OU=HQ01-DUS,OU=Users,OU=DE,OU=MSYS,DC=r2,DC=madm,DC=netobjectClass: topobjectClass: person 
objectClass: organizationalPerson 
objectClass: user 
cn: Onnebrink Heiko 
sn: Onnebrink 
c: DE 
l: Duesseldorf 
title: Mr 
description: XPC User (migriert) - managed by identityDirectory 
postalCode: 40235 
physicalDeliveryOfficeName: 09.02.207 
etc (truncated) 
 
Next I transferred the args from test and passed them to pgBadger docker container
 
 
docker run -p 443:443 
-e PGADMIN_DEFAULT_EMAIL=<a href="mailto:admin(at)metronom(dot)com" target="_blank">admin(at)metronom(dot)com</a> 
-e PGADMIN_DEFAULT_PASSWORD=admin 
-e 'PGADMIN_CONFIG_AUTHENTICATION_SOURCES=["ldap"]' 
-e 'PGADMIN_CONFIG_LDAP_SERVER_URI="ldap://<a href="http://ldap.mgi.de:389" target="_blank">ldap.mgi.de:389</a>"'
 
-e 'PGADMIN_CONFIG_LDAP_USERNAME_ATTRIBUTE="userPrincipalName"' 
-e 'PGADMIN_CONFIG_LDAP_BIND_USER="cn=SVCLDAP,cn=Users,dc=asf,dc=madm,dc=net"' 
-e 'PGADMIN_CONFIG_LDAP_BIND_PASSWORD="xxxxxx"' 
-e 'PGADMIN_CONFIG_LDAP_SEARCH_BASE_DN="dc=madm,dc=net"' 
-e PGADMIN_CONFIG_LDAP_AUTO_CREATE_USER=True 
-e PGADMIN_ENABLE_TLS=TRUE 
-v '/dockerdata/pgadmin/servers.json:/servers.json' 
-v '/dockerdata/pgadmin/server.cert:/certs/server.cert' 
-v '/dockerdata/pgadmin/server.key:/certs/server.key' 
--name pgadminssl <a href="http://registry.metroscales.io/rdb-dev/pgadmin:latest" target="_blank">
registry.metroscales.io/rdb-dev/pgadmin:latest</a> 
NOTE: Configuring authentication for SERVER mode. 
 
sudo: setrlimit(RLIMIT_CORE): Operation not permitted 
[2020-08-11 10:45:49 +0000] [1] [INFO] Starting gunicorn 19.9.0 
[2020-08-11 10:45:49 +0000] [1] [INFO] Listening at: http://[::]:443 (1) 
[2020-08-11 10:45:49 +0000] [1] [INFO] Using worker: threads 
/usr/local/lib/python3.8/os.py:1023: RuntimeWarning: line buffering (buffering=1) isn't supported in binary mode, the default buffer size will be used 
  return io.open(fd, *args, **kwargs) 
[2020-08-11 10:45:49 +0000] [97] [INFO] Booting worker with pid: 97 
 
I started up pgAdmin web and entered <a href="mailto:heiko(dot)onnebrink(at)metronom(dot)com" target="_blank">
heiko(dot)onnebrink(at)metronom(dot)com</a> with pwd as credentials 
 
After logon a new window pops up with this Json result 
{ 
 success:0, 
 result:null, 
 info:"", 
 data:null, 
 errormsg:"error receiving data: timed out" 
 } 
 
Here the error stack from pgAdmin container: 
 
::ffff:10.97.177.148 - - [11/Aug/2020:10:49:02 +0000] "GET / HTTP/1.1" 302 237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Safari/605.1.15" 
::ffff:10.97.177.148 - - [11/Aug/2020:10:49:02 +0000] "GET /login?next=%2F HTTP/1.1" 200 1698 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Safari/605.1.15" 
2020-08-11 10:49:27,835: ERROR  flask.app:      error receiving data: timed out 
Traceback (most recent call last): 
  File "/usr/local/lib/python3.8/site-packages/ldap3/strategy/sync.py", line 82, in receiving 
    data = self.connection.socket.recv(self.socket_size) 
socket.timeout: timed out 
 
During handling of the above exception, another exception occurred: 
 
Traceback (most recent call last): 
  File "/usr/local/lib/python3.8/site-packages/flask/app.py", line 1813, in full_dispatch_request 
    rv = self.dispatch_request() 
  File "/usr/local/lib/python3.8/site-packages/flask/app.py", line 1799, in dispatch_request 
    return self.view_functions[rule.endpoint](**req.view_args) 
  File "/pgadmin4/pgadmin/authenticate/__init__.py", line 55, in login 
    status, msg = auth_obj.authenticate() 
  File "/pgadmin4/pgadmin/authenticate/__init__.py", line 118, in authenticate 
    status, msg = source.authenticate(self.form) 
  File "/pgadmin4/pgadmin/authenticate/ldap.py", line 73, in authenticate 
    status, ldap_user = self.search_ldap_user() 
  File "/pgadmin4/pgadmin/authenticate/ldap.py", line 228, in search_ldap_user 
    self.conn.search(search_base=search_base_dn, 
  File "/usr/local/lib/python3.8/site-packages/ldap3/core/connection.py", line 819, in search 
    response = self.post_send_search(self.send('searchRequest', request, controls)) 
  File "/usr/local/lib/python3.8/site-packages/ldap3/strategy/sync.py", line 139, in post_send_search 
    responses, result = self.get_response(message_id) 
  File "/usr/local/lib/python3.8/site-packages/ldap3/strategy/base.py", line 353, in get_response 
    responses = self._get_response(message_id, timeout) 
  File "/usr/local/lib/python3.8/site-packages/ldap3/strategy/sync.py", line 157, in _get_response 
    responses = self.receiving() 
  File "/usr/local/lib/python3.8/site-packages/ldap3/strategy/sync.py", line 92, in receiving 
    raise communication_exception_factory(LDAPSocketReceiveError, type(e)(str(e)))(self.connection.last_error) 
ldap3.core.exceptions.LDAPSocketReceiveError: error receiving data: timed out 
::ffff:10.97.177.148 - - [11/Aug/2020:10:49:27 +0000] "POST /authenticate/login HTTP/1.1" 500 94 "<a href="https://10.96.48.68/login?next=%2F" target="_blank">https://10.96.48.68/login?next=%2F</a>" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/605.1.15
(KHTML, like Gecko) Version/13.1.1 Safari/605.1.15"<o:p></o:p>
</blockquote>
<div>
Looking at the error (receiving data timed out), I think we need to provide the configuration option to set the
"Receive Timeout"  parameter.<o:p></o:p>
</div>
<div>
Can you please log this issue @ <a href="https://redmine.postgresql.org/projects/pgadmin4">https://redmine.postgresql.org/projects/pgadmin4</a> , so we can fix and track it ?<o:p></o:p>
</div>
<div>
<o:p> </o:p>
</div>
<div>
Thanks for the testing.<o:p></o:p>
</div>
<div>
<o:p> </o:p>
</div>
<div>
Thanks,<o:p></o:p>
</div>
<div>
Khushboo<o:p></o:p>
</div>
<div>
<o:p> </o:p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
Thanks for any advice 
cheers 
Heiko 
 
From: Khushboo Vashi <<a href="mailto:khushboo(dot)vashi(at)enterprisedb(dot)com" target="_blank">khushboo(dot)vashi(at)enterprisedb(dot)com</a>> 
Date: Tuesday, 11. August 2020 at 06:09 
To: Hendrik Hansmeier <<a href="mailto:hendrik(dot)hansmeier(at)hh-it(dot)co" target="_blank">hendrik(dot)hansmeier(at)hh-it(dot)co</a>> 
Cc: "pgadmin-support <a href="http://lists.postgresql.org" target="_blank">lists.postgresql.org</a>" <<a href="mailto:pgadmin-support(at)lists(dot)postgresql(dot)org" target="_blank">pgadmin-support(at)lists(dot)postgresql(dot)org</a>> 
Subject: [EXT] Re: pgadmin4 container deployment with ldap-authentication 
 
Hi, 
 
 
On Tue, Aug 11, 2020 at 4:35 AM Hendrik Hansmeier <mailto:<a href="mailto:hendrik(dot)hansmeier(at)hh-it(dot)co" target="_blank">hendrik(dot)hansmeier(at)hh-it(dot)co</a>> wrote: 
Hi, 
i am trying to get pgadmin4 running in server-mode as a docker-container. So i pulled the image and after i tried out the image a little bit, i tried to use ldap-authentication. 
Unfortunately, i didn't get it running as expected. I am not able to authenticate against my samba 4-domain. This is how i tried to launch the container: 
 
docker run -p 8280:80 
    -e "PGADMIN_DEFAULT_EMAIL=<emailAddress>" 
    -e "PGADMIN_DEFAULT_PASSWORD=<password>" 
    -e "AUTHENTICATION_SOURCES=['ldap']" 
    -e "LDAP_AUTO_CREATE_USER=True" 
    -e "LDAP_SERVER_URI='ldaps://<domaincontroller>:636'" 
    -e "LDAP_BASE_DN='cn=Users,dc=mydomain,dc=local'" 
    -e "LDAP_BIND_USER='cn=User1,cn=Users,dc=mydomain,dc=local'" 
    -e "LDAP_BIND_PASSWORD=<BindDNPassword>" 
    -e "LDAP_CA_CERT_FILE='/etc/ssl/certs/myca.pem'" 
    -e "LDAP_CERT_FILE='/etc/ssl/certs/my.cert.pem'" 
    -e "LDAP_KEY_FILE='/etc/ssl/private/my.key.pem'" 
    -d dpage/pgadmin4 
 
I am using the container behind a reverse-proxy on nginx (debian buster), for the first try via http. The authentication with the given user PGADMIN_DEFAULT_EMAIL works as expected but ldap-authentication results in an error-message "Specified user does not
exist". 
Am i using the environment-parameters for ldap-authentication correctly? May a reverse-proxy over https help to get ldaps working? 
The variable prefix "PGADMIN_CONFIG_"  should be used to override any of the configuration options in pgAdmin’s config.py file. So add this prefix to all the config params you have used. (Ex, AUTHENTICATION_SOURCES, LDAP_SERVER_URI etc...)  
 
Ex:  AUTHENTICATION_SOURCES should be PGADMIN_CONFIG_AUTHENTICATION_SOURCES 
Please refer <a href="https://www.pgadmin.org/docs/pgadmin4/4.24/container_deployment.html#environment-variables" target="_blank">https://www.pgadmin.org/docs/pgadmin4/4.24/container_deployment.html#environment-variables</a> for more information. 
 
Also, set LDAP_SEARCH_BASE_DN param which is required to configure LDAP Authentication in Dedicated User mode (which you have configured). 
Please refer <a href="https://www.pgadmin.org/docs/pgadmin4/4.24/enabling_ldap_authentication.html" target="_blank">https://www.pgadmin.org/docs/pgadmin4/4.24/enabling_ldap_authentication.html</a> 
 
Thanks, 
Khushboo 
 
-- 
Best regards, 
 
Hendrik Hansmeier 
 
 
Hendrik Hansmeier IT-Consulting ::: Bunsenstraße 5 ::: 51647 Gummersbach 
FON +49 (0) 2261 814 174 ::: MOB +49 (0) 151 235 866 02 ::: E-MAIL mailto:<a href="mailto:hendrik(dot)hansmeier(at)hh-it(dot)co" target="_blank">hendrik(dot)hansmeier(at)hh-it(dot)co</a> 
USt-IdNr.: DE311717013 ::: Finanzamt Gummersbach 
 
Geschäftsanschrift/Business address: METRO-NOM GmbH, Metro-Straße 12, 40235 Duesseldorf, Germany 
Aufsichtsrat/Supervisory Board: Olaf Koch (Vorsitzender/Chairman) 
Geschäftsführung/Management Board: Timo Salzsieder (Vorsitzender/CEO), Felix Lindemann (COO), Frank Hammerle (CFO) 
Sitz Düsseldorf, Amtsgericht Düsseldorf, HRB 18232/Registered Office Düsseldorf, Commercial Register of the Düsseldorf Local Court, HRB 18232 
 
Betreffend Mails von *@<a href="http://metronom.com" target="_blank">metronom.com</a> <<a href="http://metrosystems.net/" target="_blank">http://metrosystems.net/</a>> 
Die in dieser E-Mail enthaltenen Nachrichten und Anhänge sind ausschließlich für den bezeichneten Adressaten bestimmt. Sie können rechtlich geschützte, vertrauliche Informationen enthalten. Falls Sie nicht der bezeichnete Empfänger oder zum Empfang dieser E-Mail
nicht berechtigt sind, ist die Verwendung, Vervielfältigung oder Weitergabe der Nachrichten und Anhänge untersagt. Falls Sie diese E-Mail irrtümlich erhalten haben, informieren Sie bitte unverzüglich den Absender und vernichten Sie die E-Mail. 
 
Regarding mails from *@<a href="http://metronom.com" target="_blank">metronom.com</a> <<a href="http://metrosystems.net/" target="_blank">http://metrosystems.net/</a>> 
This e-mail message and any attachment are intended exclusively for the named addressee. They may contain confidential information which may also be protected by professional secrecy. Unless you are the named addressee (or authorised to receive for the addressee)
you may not copy or use this message or any attachment or disclose the contents to anyone else. If this e-mail was<o:p></o:p>
</blockquote>
</div>
</div>
</div>
Geschäftsanschrift/Business
address: METRO-NOM GmbH, Metro-Straße 12, 40235 Duesseldorf, Germany <span lang="DE" style="font-size: 9pt; font-family: Verdana, sans-serif; color: #222222; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial;">Aufsichtsrat/Supervisory Board: Olaf Koch
(Vorsitzender/Chairman) 
Geschäftsführung/Management Board: Timo Salzsieder (Vorsitzender/CEO), Felix
Lindemann (COO), Frank Hammerle (CFO) 
Sitz Düsseldorf, Amtsgericht Düsseldorf, HRB 18232/Registered Office
Düsseldorf, Commercial Register of the Düsseldorf Local Court, HRB 18232<o:p></o:p>

Betreffend
Mails von *@<a href="http://metrosystems.net/" target="_blank">metronom.com</a> 
Die in dieser E-Mail enthaltenen Nachrichten und Anhänge sind ausschließlich
für den bezeichneten Adressaten bestimmt. Sie können rechtlich geschützte,
vertrauliche Informationen enthalten. Falls Sie nicht der bezeichnete Empfänger
oder zum Empfang dieser E-Mail nicht berechtigt sind, ist die Verwendung,
Vervielfältigung oder Weitergabe der Nachrichten und Anhänge untersagt. Falls
Sie diese E-Mail irrtümlich erhalten haben, informieren Sie bitte unverzüglich
den Absender und vernichten Sie die E-Mail.<o:p></o:p>

Regarding mails from *@<a href="http://metrosystems.net/" target="_blank">metronom.com</a> 
This e-mail message and any attachment are intended exclusively for the named
addressee. They may contain confidential information which may also be protected
by professional secrecy. Unless you are the named addressee (or authorised to
receive for the addressee) you may not copy or use this message or any
attachment or disclose the contents to anyone else. If this e-mail was</body>
</html>

Attachment	Content-Type	Size
unknown_filename	text/html	19.1 KB

In response to

Re: [EXT] Re: pgadmin4 container deployment with ldap-authentication at 2020-08-11 12:35:56 from Khushboo Vashi

Responses

Re: [EXT] Re: pgadmin4 container deployment with ldap-authentication at 2020-08-11 13:09:45 from Khushboo Vashi

Browse pgadmin-support by date

	From	Date	Subject
Next Message	Khushboo Vashi	2020-08-11 13:09:45	Re: [EXT] Re: pgadmin4 container deployment with ldap-authentication
Previous Message	heiko.onnebrink	2020-08-11 12:46:43	Re: [EXT] Re: pgadmin4 container deployment with ldap-authentication