starred/lldap-lldap

Fork 0

mirror of https://github.com/lldap/lldap.git synced 2026-04-25 16:25:55 +03:00

[GH-ISSUE #786] [INTEGRATION] Grafana Integration #283

New issue

Closed

opened 2026-02-27 08:16:22 +03:00 by kerem · 5 comments

kerem commented

2026-02-27 08:16:22 +03:00

Owner

Originally created by @kaaax0815 on GitHub (Jan 7, 2024).
Original GitHub issue: https://github.com/lldap/lldap/issues/786

Describe the bug
Cant login with grafana using lldap as auth source

To Reproduce
Use the Grafana example config

Expected behavior
Should work

Logs

ldap-lldap-1  | > Setup permissions..
ldap-lldap-1  | > Starting lldap..
ldap-lldap-1  |
ldap-lldap-1  | Loading configuration from /data/lldap_config.toml
ldap-lldap-1  | Configuration: Configuration {
ldap-lldap-1  |     ldap_host: "0.0.0.0",
ldap-lldap-1  |     ldap_port: 3890,
ldap-lldap-1  |     http_host: "0.0.0.0",
ldap-lldap-1  |     http_port: 17170,
ldap-lldap-1  |     jwt_secret: ***SECRET***,
ldap-lldap-1  |     ldap_base_dn: "dc=redacted,dc=de",
ldap-lldap-1  |     ldap_user_dn: UserId(
ldap-lldap-1  |         "admin",
ldap-lldap-1  |     ),
ldap-lldap-1  |     ldap_user_email: "",
ldap-lldap-1  |     ldap_user_pass: ***SECRET***,
ldap-lldap-1  |     database_url: "sqlite:///data/users.db?mode=rwc",
ldap-lldap-1  |     ignored_user_attributes: [],
ldap-lldap-1  |     ignored_group_attributes: [],
ldap-lldap-1  |     verbose: true,
ldap-lldap-1  |     key_file: "/data/private_key",
ldap-lldap-1  |     key_seed: Some(
ldap-lldap-1  |         ***SECRET***,
ldap-lldap-1  |     ),
ldap-lldap-1  |     smtp_options: MailOptions {
ldap-lldap-1  |         enable_password_reset: false,
ldap-lldap-1  |         from: None,
ldap-lldap-1  |         reply_to: None,
ldap-lldap-1  |         server: "localhost",
ldap-lldap-1  |         port: 587,
ldap-lldap-1  |         user: "",
ldap-lldap-1  |         password: ***SECRET***,
ldap-lldap-1  |         smtp_encryption: Tls,
ldap-lldap-1  |         tls_required: None,
ldap-lldap-1  |     },
ldap-lldap-1  |     ldaps_options: LdapsOptions {
ldap-lldap-1  |         enabled: false,
ldap-lldap-1  |         port: 6360,
ldap-lldap-1  |         cert_file: "cert.pem",
ldap-lldap-1  |         key_file: "key.pem",
ldap-lldap-1  |     },
ldap-lldap-1  |     http_url: Url {
ldap-lldap-1  |         scheme: "http",
ldap-lldap-1  |         cannot_be_a_base: false,
ldap-lldap-1  |         username: "",
ldap-lldap-1  |         password: None,
ldap-lldap-1  |         host: Some(
ldap-lldap-1  |             Domain(
ldap-lldap-1  |                 "localhost",
ldap-lldap-1  |             ),
ldap-lldap-1  |         ),
ldap-lldap-1  |         port: None,
ldap-lldap-1  |         path: "/",
ldap-lldap-1  |         query: None,
ldap-lldap-1  |         fragment: None,
ldap-lldap-1  |     },
ldap-lldap-1  |     server_setup: None,
ldap-lldap-1  | }
ldap-lldap-1  | WARNING: A key_seed was given, we will ignore the server_key and generate one from the seed!
ldap-lldap-1  | 2024-01-07T20:15:28.384660480+00:00  INFO     set_up_server [ 2.82ms | 41.19% / 100.00% ]
ldap-lldap-1  | 2024-01-07T20:15:28.384733022+00:00  INFO     ┝━ ｉ [info]: Starting LLDAP version 0.5.0
ldap-lldap-1  | 2024-01-07T20:15:28.385659464+00:00  DEBUG    ┝━ get_schema_version [ 137µs | 4.86% ]
ldap-lldap-1  | 2024-01-07T20:15:28.386659407+00:00  DEBUG    │  ┕━ 🐛 [debug]:  | return: Some(SchemaVersion(5))
ldap-lldap-1  | 2024-01-07T20:15:28.386693008+00:00  DEBUG    ┝━ list_groups [ 486µs | 17.25% ] filters: Some(DisplayName("lldap_admin"))
ldap-lldap-1  | 2024-01-07T20:15:28.392167955+00:00  DEBUG    │  ┕━ 🐛 [debug]:  | return: [Group { id: GroupId(1), display_name: "lldap_admin", creation_date: 2024-01-07T20:08:26.094561459, uuid: Uuid("93d867d8-cbcd-3af8-af0f-c2847d6b853b"), users: [UserId("admin")], attributes: [] }]
ldap-lldap-1  | 2024-01-07T20:15:28.392179136+00:00  DEBUG    ┝━ list_groups [ 313µs | 11.09% ] filters: Some(DisplayName("lldap_password_manager"))
ldap-lldap-1  | 2024-01-07T20:15:28.393364244+00:00  DEBUG    │  ┕━ 🐛 [debug]:  | return: [Group { id: GroupId(2), display_name: "lldap_password_manager", creation_date: 2024-01-07T20:08:26.098511151, uuid: Uuid("4ac3982d-8211-385e-b2d7-8423adb72f27"), users: [], attributes: [] }]
ldap-lldap-1  | 2024-01-07T20:15:28.393370484+00:00  DEBUG    ┝━ list_groups [ 309µs | 10.97% ] filters: Some(DisplayName("lldap_strict_readonly"))
ldap-lldap-1  | 2024-01-07T20:15:28.396034875+00:00  DEBUG    │  ┕━ 🐛 [debug]:  | return: [Group { id: GroupId(3), display_name: "lldap_strict_readonly", creation_date: 2024-01-07T20:08:26.101163622, uuid: Uuid("aa43b180-8cdf-3c63-a399-bf299c93eb2d"), users: [], attributes: [] }]
ldap-lldap-1  | 2024-01-07T20:15:28.396053496+00:00  DEBUG    ┝━ list_users [ 286µs | 10.15% ] filters: Some(MemberOf("lldap_admin")) | _get_groups: false
ldap-lldap-1  | 2024-01-07T20:15:28.396972748+00:00  DEBUG    │  ┕━ 🐛 [debug]:  | return: [UserAndGroups { user: User { user_id: UserId("admin"), email: "", display_name: Some("Administrator"), creation_date: 2024-01-07T20:08:26.104275255, uuid: Uuid("826d4dfe-cfd9-301e-ad28-cdfdfb993fee"), attributes: [] }, groups: Some([GroupDetails { group_id: GroupId(1), display_name: "lldap_admin", creation_date: 2024-01-07T20:08:26.094561459, uuid: Uuid("93d867d8-cbcd-3af8-af0f-c2847d6b853b"), attributes: [] }]) }]
ldap-lldap-1  | 2024-01-07T20:15:28.397190513+00:00  INFO     ┝━ ｉ [info]: Starting the LDAP server on port 3890
ldap-lldap-1  | 2024-01-07T20:15:28.398319849+00:00  DEBUG    ┝━ get_jwt_blacklist [ 127µs | 4.49% ]
ldap-lldap-1  | 2024-01-07T20:15:28.398452961+00:00  INFO     ┕━ ｉ [info]: Starting the API/web server on port 17170
ldap-lldap-1  | 2024-01-07T20:15:28.398608716+00:00  INFO     ｉ [info]: starting 1 workers
ldap-lldap-1  | 2024-01-07T20:15:28.398623526+00:00  INFO     ｉ [info]: Actix runtime found; starting in Actix runtime
ldap-lldap-1  | 2024-01-07T20:15:28.399375493+00:00  INFO     ｉ [info]: DB Cleanup Cron started
ldap-lldap-1  | 2024-01-07T20:15:30.216169678+00:00  INFO     LDAP session [ 102ms | 0.14% / 100.00% ]
ldap-lldap-1  | 2024-01-07T20:15:30.216362593+00:00  INFO     ┝━ LDAP request [ 101ms | 0.18% / 99.18% ]
ldap-lldap-1  | 2024-01-07T20:15:30.216383473+00:00  DEBUG    │  ┝━ 🐛 [debug]:  | msg: LdapMsg { msgid: 1, op: BindRequest(LdapBindRequest { dn: "uid=admin,ou=people,dc=redacted,dc=de", cred: LdapBindCred::Simple }), ctrl: [] }
ldap-lldap-1  | 2024-01-07T20:15:30.216387053+00:00  DEBUG    │  ┝━ do_bind [ 100ms | 0.07% / 99.00% ] dn: uid=admin,ou=people,dc=redacted,dc=de
ldap-lldap-1  | 2024-01-07T20:15:30.216425094+00:00  DEBUG    │  │  ┝━ bind [ 100ms | 0.04% / 98.70% ]
ldap-lldap-1  | 2024-01-07T20:15:30.216432134+00:00  DEBUG    │  │  │  ┝━ get_password_file_for_user [ 143µs | 0.14% ] user_id: UserId("admin")
ldap-lldap-1  | 2024-01-07T20:15:30.216845444+00:00  DEBUG    │  │  │  ┕━ passwords_match [ 100ms | 98.52% ] username: admin
ldap-lldap-1  | 2024-01-07T20:15:30.316893617+00:00  DEBUG    │  │  ┝━ get_user_groups [ 239µs | 0.24% ] user_id: "admin"
ldap-lldap-1  | 2024-01-07T20:15:30.317679905+00:00  DEBUG    │  │  │  ┕━ 🐛 [debug]:  | return: {GroupDetails { group_id: GroupId(1), display_name: "lldap_admin", creation_date: 2024-01-07T20:08:26.094561459, uuid: Uuid("93d867d8-cbcd-3af8-af0f-c2847d6b853b"), attributes: [] }}
ldap-lldap-1  | 2024-01-07T20:15:30.317687355+00:00  DEBUG    │  │  ┕━ 🐛 [debug]: Success!
ldap-lldap-1  | 2024-01-07T20:15:30.317697586+00:00  DEBUG    │  ┕━ 🐛 [debug]:  | response: BindResponse(LdapBindResponse { res: LdapResult { code: Success, matcheddn: "", message: "", referral: [] }, saslcreds: None })
ldap-lldap-1  | 2024-01-07T20:15:30.318167007+00:00  INFO     ┕━ LDAP request [ 691µs | 0.07% / 0.68% ]
ldap-lldap-1  | 2024-01-07T20:15:30.318177997+00:00  DEBUG       ┝━ 🐛 [debug]:  | msg: LdapMsg { msgid: 2, op: SearchRequest(LdapSearchRequest { base: "dc=redacted,dc=de", scope: Subtree, aliases: Never, sizelimit: 0, timelimit: 0, typesonly: false, filter: Or([And([Equality("uid", "bernd@redacted.de"), Equality("memberOf", "cn=grafana,ou=groups,dc=redacted,dc=de")])]), attrs: ["uid", "sn", "mail", "displayName", "memberOf"] }), ctrl: [] }
ldap-lldap-1  | 2024-01-07T20:15:30.318180097+00:00  DEBUG       ┝━ do_search [ 622µs | 0.13% / 0.61% ]
ldap-lldap-1  | 2024-01-07T20:15:30.318188427+00:00  DEBUG       │  ┝━ 🐛 [debug]:  | request.base: "dc=redacted,dc=de" | scope: Global
ldap-lldap-1  | 2024-01-07T20:15:30.318191137+00:00  DEBUG       │  ┝━ get_user_list [ 244µs | 0.02% / 0.24% ]
ldap-lldap-1  | 2024-01-07T20:15:30.318199737+00:00  DEBUG       │  │  ┝━ 🐛 [debug]:  | filters: Or([And([UserId(UserId("bernd@redacted.de")), MemberOf("grafana")])])
ldap-lldap-1  | 2024-01-07T20:15:30.318206307+00:00  DEBUG       │  │  ┕━ list_users [ 224µs | 0.22% ] filters: Some(Or([And([UserId(UserId("bernd@redacted.de")), MemberOf("grafana")])])) | _get_groups: true
ldap-lldap-1  | 2024-01-07T20:15:30.318951854+00:00  DEBUG       │  │     ┕━ 🐛 [debug]:  | return: []
ldap-lldap-1  | 2024-01-07T20:15:30.318957275+00:00  DEBUG       │  ┕━ get_groups_list [ 249µs | 0.03% / 0.25% ]
ldap-lldap-1  | 2024-01-07T20:15:30.318962405+00:00  WARN        │     ┝━ 🚧 [warn]: Ignoring unknown group attribute ""memberof"" in filter.\n\
ldap-lldap-1  |                                 To disable this warning, add it to "ignored_group_attributes" in the config.
ldap-lldap-1  | 2024-01-07T20:15:30.318969385+00:00  DEBUG       │     ┝━ 🐛 [debug]:  | filters: Or([And([DisplayName("bernd@redacted.de"), Not(And([]))])])
ldap-lldap-1  | 2024-01-07T20:15:30.318980655+00:00  DEBUG       │     ┕━ list_groups [ 219µs | 0.22% ] filters: Some(Or([And([DisplayName("bernd@redacted.de"), Not(And([]))])]))
ldap-lldap-1  | 2024-01-07T20:15:30.320130442+00:00  DEBUG       │        ┕━ 🐛 [debug]:  | return: []
ldap-lldap-1  | 2024-01-07T20:15:30.320523521+00:00  DEBUG       ┕━ 🐛 [debug]:  | response: SearchResultDone(LdapResult { code: Success, matcheddn: "", message: "", referral: [] })

Additional context
Grafana Config

# This is only the ldap config, you also need to enable ldap support in the main config file
# of Grafana. See https://grafana.com/docs/grafana/latest/auth/ldap/#enable-ldap
# You can test that it is working correctly by trying usernames at: https://<your grafana instance>/admin/ldap

[[servers]]
# Ldap server host (specify multiple hosts space separated)
host = "lldap"
# Default port is 389 or 636 if use_ssl = true
port = 3890
# Set to true if LDAP server should use an encrypted TLS connection (either with STARTTLS or LDAPS)
use_ssl = false
# If set to true, use LDAP with STARTTLS instead of LDAPS
start_tls = false
# set to true if you want to skip SSL cert validation
ssl_skip_verify = false
# set to the path to your root CA certificate or leave unset to use system defaults
# root_ca_cert = "/path/to/certificate.crt"
# Authentication against LDAP servers requiring client certificates
# client_cert = "/path/to/client.crt"
# client_key = "/path/to/client.key"

# Search user bind dn
bind_dn = "uid=admin,ou=people,dc=redacted,dc=de"
# Search user bind password
# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
bind_password = "***"

# User search filter
# search_filter = "(uid=%s)"
# If you want to limit to only users of a specific group use this instead:
search_filter = "(&(uid=%s)(memberOf=cn=grafana,ou=groups,dc=redacted,dc=de))"

# An array of base dns to search through
search_base_dns = ["dc=redacted,dc=de"]

# Specify names of the LDAP attributes your LDAP uses
[servers.attributes]
member_of = "memberOf"
email = "mail"
name = "displayName"
surname = "sn"
username = "uid"

# If you want to map your ldap groups to grafana's groups, see: https://grafana.com/docs/grafana/latest/auth/ldap/#group-mappings
# As a quick example, here is how you would map lldap's admin group to grafana's admin
#[[servers.group_mappings]]
#group_dn = "cn=lldap_admin,ou=groups,dc=example,dc=org"
#org_role = "Admin"
#grafana_admin = true

Originally created by @kaaax0815 on GitHub (Jan 7, 2024). Original GitHub issue: https://github.com/lldap/lldap/issues/786 **Describe the bug** Cant login with grafana using lldap as auth source **To Reproduce** Use the Grafana example config **Expected behavior** Should work **Logs** ``` ldap-lldap-1 | > Setup permissions.. ldap-lldap-1 | > Starting lldap.. ldap-lldap-1 | ldap-lldap-1 | Loading configuration from /data/lldap_config.toml ldap-lldap-1 | Configuration: Configuration { ldap-lldap-1 | ldap_host: "0.0.0.0", ldap-lldap-1 | ldap_port: 3890, ldap-lldap-1 | http_host: "0.0.0.0", ldap-lldap-1 | http_port: 17170, ldap-lldap-1 | jwt_secret: ***SECRET***, ldap-lldap-1 | ldap_base_dn: "dc=redacted,dc=de", ldap-lldap-1 | ldap_user_dn: UserId( ldap-lldap-1 | "admin", ldap-lldap-1 | ), ldap-lldap-1 | ldap_user_email: "", ldap-lldap-1 | ldap_user_pass: ***SECRET***, ldap-lldap-1 | database_url: "sqlite:///data/users.db?mode=rwc", ldap-lldap-1 | ignored_user_attributes: [], ldap-lldap-1 | ignored_group_attributes: [], ldap-lldap-1 | verbose: true, ldap-lldap-1 | key_file: "/data/private_key", ldap-lldap-1 | key_seed: Some( ldap-lldap-1 | ***SECRET***, ldap-lldap-1 | ), ldap-lldap-1 | smtp_options: MailOptions { ldap-lldap-1 | enable_password_reset: false, ldap-lldap-1 | from: None, ldap-lldap-1 | reply_to: None, ldap-lldap-1 | server: "localhost", ldap-lldap-1 | port: 587, ldap-lldap-1 | user: "", ldap-lldap-1 | password: ***SECRET***, ldap-lldap-1 | smtp_encryption: Tls, ldap-lldap-1 | tls_required: None, ldap-lldap-1 | }, ldap-lldap-1 | ldaps_options: LdapsOptions { ldap-lldap-1 | enabled: false, ldap-lldap-1 | port: 6360, ldap-lldap-1 | cert_file: "cert.pem", ldap-lldap-1 | key_file: "key.pem", ldap-lldap-1 | }, ldap-lldap-1 | http_url: Url { ldap-lldap-1 | scheme: "http", ldap-lldap-1 | cannot_be_a_base: false, ldap-lldap-1 | username: "", ldap-lldap-1 | password: None, ldap-lldap-1 | host: Some( ldap-lldap-1 | Domain( ldap-lldap-1 | "localhost", ldap-lldap-1 | ), ldap-lldap-1 | ), ldap-lldap-1 | port: None, ldap-lldap-1 | path: "/", ldap-lldap-1 | query: None, ldap-lldap-1 | fragment: None, ldap-lldap-1 | }, ldap-lldap-1 | server_setup: None, ldap-lldap-1 | } ldap-lldap-1 | WARNING: A key_seed was given, we will ignore the server_key and generate one from the seed! ldap-lldap-1 | 2024-01-07T20:15:28.384660480+00:00 INFO set_up_server [ 2.82ms | 41.19% / 100.00% ] ldap-lldap-1 | 2024-01-07T20:15:28.384733022+00:00 INFO ┝━ ｉ [info]: Starting LLDAP version 0.5.0 ldap-lldap-1 | 2024-01-07T20:15:28.385659464+00:00 DEBUG ┝━ get_schema_version [ 137µs | 4.86% ] ldap-lldap-1 | 2024-01-07T20:15:28.386659407+00:00 DEBUG │ ┕━ 🐛 [debug]: | return: Some(SchemaVersion(5)) ldap-lldap-1 | 2024-01-07T20:15:28.386693008+00:00 DEBUG ┝━ list_groups [ 486µs | 17.25% ] filters: Some(DisplayName("lldap_admin")) ldap-lldap-1 | 2024-01-07T20:15:28.392167955+00:00 DEBUG │ ┕━ 🐛 [debug]: | return: [Group { id: GroupId(1), display_name: "lldap_admin", creation_date: 2024-01-07T20:08:26.094561459, uuid: Uuid("93d867d8-cbcd-3af8-af0f-c2847d6b853b"), users: [UserId("admin")], attributes: [] }] ldap-lldap-1 | 2024-01-07T20:15:28.392179136+00:00 DEBUG ┝━ list_groups [ 313µs | 11.09% ] filters: Some(DisplayName("lldap_password_manager")) ldap-lldap-1 | 2024-01-07T20:15:28.393364244+00:00 DEBUG │ ┕━ 🐛 [debug]: | return: [Group { id: GroupId(2), display_name: "lldap_password_manager", creation_date: 2024-01-07T20:08:26.098511151, uuid: Uuid("4ac3982d-8211-385e-b2d7-8423adb72f27"), users: [], attributes: [] }] ldap-lldap-1 | 2024-01-07T20:15:28.393370484+00:00 DEBUG ┝━ list_groups [ 309µs | 10.97% ] filters: Some(DisplayName("lldap_strict_readonly")) ldap-lldap-1 | 2024-01-07T20:15:28.396034875+00:00 DEBUG │ ┕━ 🐛 [debug]: | return: [Group { id: GroupId(3), display_name: "lldap_strict_readonly", creation_date: 2024-01-07T20:08:26.101163622, uuid: Uuid("aa43b180-8cdf-3c63-a399-bf299c93eb2d"), users: [], attributes: [] }] ldap-lldap-1 | 2024-01-07T20:15:28.396053496+00:00 DEBUG ┝━ list_users [ 286µs | 10.15% ] filters: Some(MemberOf("lldap_admin")) | _get_groups: false ldap-lldap-1 | 2024-01-07T20:15:28.396972748+00:00 DEBUG │ ┕━ 🐛 [debug]: | return: [UserAndGroups { user: User { user_id: UserId("admin"), email: "", display_name: Some("Administrator"), creation_date: 2024-01-07T20:08:26.104275255, uuid: Uuid("826d4dfe-cfd9-301e-ad28-cdfdfb993fee"), attributes: [] }, groups: Some([GroupDetails { group_id: GroupId(1), display_name: "lldap_admin", creation_date: 2024-01-07T20:08:26.094561459, uuid: Uuid("93d867d8-cbcd-3af8-af0f-c2847d6b853b"), attributes: [] }]) }] ldap-lldap-1 | 2024-01-07T20:15:28.397190513+00:00 INFO ┝━ ｉ [info]: Starting the LDAP server on port 3890 ldap-lldap-1 | 2024-01-07T20:15:28.398319849+00:00 DEBUG ┝━ get_jwt_blacklist [ 127µs | 4.49% ] ldap-lldap-1 | 2024-01-07T20:15:28.398452961+00:00 INFO ┕━ ｉ [info]: Starting the API/web server on port 17170 ldap-lldap-1 | 2024-01-07T20:15:28.398608716+00:00 INFO ｉ [info]: starting 1 workers ldap-lldap-1 | 2024-01-07T20:15:28.398623526+00:00 INFO ｉ [info]: Actix runtime found; starting in Actix runtime ldap-lldap-1 | 2024-01-07T20:15:28.399375493+00:00 INFO ｉ [info]: DB Cleanup Cron started ldap-lldap-1 | 2024-01-07T20:15:30.216169678+00:00 INFO LDAP session [ 102ms | 0.14% / 100.00% ] ldap-lldap-1 | 2024-01-07T20:15:30.216362593+00:00 INFO ┝━ LDAP request [ 101ms | 0.18% / 99.18% ] ldap-lldap-1 | 2024-01-07T20:15:30.216383473+00:00 DEBUG │ ┝━ 🐛 [debug]: | msg: LdapMsg { msgid: 1, op: BindRequest(LdapBindRequest { dn: "uid=admin,ou=people,dc=redacted,dc=de", cred: LdapBindCred::Simple }), ctrl: [] } ldap-lldap-1 | 2024-01-07T20:15:30.216387053+00:00 DEBUG │ ┝━ do_bind [ 100ms | 0.07% / 99.00% ] dn: uid=admin,ou=people,dc=redacted,dc=de ldap-lldap-1 | 2024-01-07T20:15:30.216425094+00:00 DEBUG │ │ ┝━ bind [ 100ms | 0.04% / 98.70% ] ldap-lldap-1 | 2024-01-07T20:15:30.216432134+00:00 DEBUG │ │ │ ┝━ get_password_file_for_user [ 143µs | 0.14% ] user_id: UserId("admin") ldap-lldap-1 | 2024-01-07T20:15:30.216845444+00:00 DEBUG │ │ │ ┕━ passwords_match [ 100ms | 98.52% ] username: admin ldap-lldap-1 | 2024-01-07T20:15:30.316893617+00:00 DEBUG │ │ ┝━ get_user_groups [ 239µs | 0.24% ] user_id: "admin" ldap-lldap-1 | 2024-01-07T20:15:30.317679905+00:00 DEBUG │ │ │ ┕━ 🐛 [debug]: | return: {GroupDetails { group_id: GroupId(1), display_name: "lldap_admin", creation_date: 2024-01-07T20:08:26.094561459, uuid: Uuid("93d867d8-cbcd-3af8-af0f-c2847d6b853b"), attributes: [] }} ldap-lldap-1 | 2024-01-07T20:15:30.317687355+00:00 DEBUG │ │ ┕━ 🐛 [debug]: Success! ldap-lldap-1 | 2024-01-07T20:15:30.317697586+00:00 DEBUG │ ┕━ 🐛 [debug]: | response: BindResponse(LdapBindResponse { res: LdapResult { code: Success, matcheddn: "", message: "", referral: [] }, saslcreds: None }) ldap-lldap-1 | 2024-01-07T20:15:30.318167007+00:00 INFO ┕━ LDAP request [ 691µs | 0.07% / 0.68% ] ldap-lldap-1 | 2024-01-07T20:15:30.318177997+00:00 DEBUG ┝━ 🐛 [debug]: | msg: LdapMsg { msgid: 2, op: SearchRequest(LdapSearchRequest { base: "dc=redacted,dc=de", scope: Subtree, aliases: Never, sizelimit: 0, timelimit: 0, typesonly: false, filter: Or([And([Equality("uid", "bernd@redacted.de"), Equality("memberOf", "cn=grafana,ou=groups,dc=redacted,dc=de")])]), attrs: ["uid", "sn", "mail", "displayName", "memberOf"] }), ctrl: [] } ldap-lldap-1 | 2024-01-07T20:15:30.318180097+00:00 DEBUG ┝━ do_search [ 622µs | 0.13% / 0.61% ] ldap-lldap-1 | 2024-01-07T20:15:30.318188427+00:00 DEBUG │ ┝━ 🐛 [debug]: | request.base: "dc=redacted,dc=de" | scope: Global ldap-lldap-1 | 2024-01-07T20:15:30.318191137+00:00 DEBUG │ ┝━ get_user_list [ 244µs | 0.02% / 0.24% ] ldap-lldap-1 | 2024-01-07T20:15:30.318199737+00:00 DEBUG │ │ ┝━ 🐛 [debug]: | filters: Or([And([UserId(UserId("bernd@redacted.de")), MemberOf("grafana")])]) ldap-lldap-1 | 2024-01-07T20:15:30.318206307+00:00 DEBUG │ │ ┕━ list_users [ 224µs | 0.22% ] filters: Some(Or([And([UserId(UserId("bernd@redacted.de")), MemberOf("grafana")])])) | _get_groups: true ldap-lldap-1 | 2024-01-07T20:15:30.318951854+00:00 DEBUG │ │ ┕━ 🐛 [debug]: | return: [] ldap-lldap-1 | 2024-01-07T20:15:30.318957275+00:00 DEBUG │ ┕━ get_groups_list [ 249µs | 0.03% / 0.25% ] ldap-lldap-1 | 2024-01-07T20:15:30.318962405+00:00 WARN │ ┝━ 🚧 [warn]: Ignoring unknown group attribute ""memberof"" in filter.\n\ ldap-lldap-1 | To disable this warning, add it to "ignored_group_attributes" in the config. ldap-lldap-1 | 2024-01-07T20:15:30.318969385+00:00 DEBUG │ ┝━ 🐛 [debug]: | filters: Or([And([DisplayName("bernd@redacted.de"), Not(And([]))])]) ldap-lldap-1 | 2024-01-07T20:15:30.318980655+00:00 DEBUG │ ┕━ list_groups [ 219µs | 0.22% ] filters: Some(Or([And([DisplayName("bernd@redacted.de"), Not(And([]))])])) ldap-lldap-1 | 2024-01-07T20:15:30.320130442+00:00 DEBUG │ ┕━ 🐛 [debug]: | return: [] ldap-lldap-1 | 2024-01-07T20:15:30.320523521+00:00 DEBUG ┕━ 🐛 [debug]: | response: SearchResultDone(LdapResult { code: Success, matcheddn: "", message: "", referral: [] }) ``` **Additional context** Grafana Config ``` # This is only the ldap config, you also need to enable ldap support in the main config file # of Grafana. See https://grafana.com/docs/grafana/latest/auth/ldap/#enable-ldap # You can test that it is working correctly by trying usernames at: https://<your grafana instance>/admin/ldap [[servers]] # Ldap server host (specify multiple hosts space separated) host = "lldap" # Default port is 389 or 636 if use_ssl = true port = 3890 # Set to true if LDAP server should use an encrypted TLS connection (either with STARTTLS or LDAPS) use_ssl = false # If set to true, use LDAP with STARTTLS instead of LDAPS start_tls = false # set to true if you want to skip SSL cert validation ssl_skip_verify = false # set to the path to your root CA certificate or leave unset to use system defaults # root_ca_cert = "/path/to/certificate.crt" # Authentication against LDAP servers requiring client certificates # client_cert = "/path/to/client.crt" # client_key = "/path/to/client.key" # Search user bind dn bind_dn = "uid=admin,ou=people,dc=redacted,dc=de" # Search user bind password # If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" bind_password = "***" # User search filter # search_filter = "(uid=%s)" # If you want to limit to only users of a specific group use this instead: search_filter = "(&(uid=%s)(memberOf=cn=grafana,ou=groups,dc=redacted,dc=de))" # An array of base dns to search through search_base_dns = ["dc=redacted,dc=de"] # Specify names of the LDAP attributes your LDAP uses [servers.attributes] member_of = "memberOf" email = "mail" name = "displayName" surname = "sn" username = "uid" # If you want to map your ldap groups to grafana's groups, see: https://grafana.com/docs/grafana/latest/auth/ldap/#group-mappings # As a quick example, here is how you would map lldap's admin group to grafana's admin #[[servers.group_mappings]] #group_dn = "cn=lldap_admin,ou=groups,dc=example,dc=org" #org_role = "Admin" #grafana_admin = true ```

kerem

2026-02-27 08:16:22 +03:00

closed this issue
added the
question

integration
labels

kerem commented

2026-02-27 08:16:23 +03:00

Author

Owner

@nitnelave commented on GitHub (Jan 7, 2024):

Hi! It's just a quick diagnosis, I didn't look too deeply, but it seems that you specify that users should be matched by user_id, yet you tried to log in with an email.

You can adjust your user filter to match either uid or mail if you want to be able to login with both

@nitnelave commented on GitHub (Jan 7, 2024): Hi! It's just a quick diagnosis, I didn't look too deeply, but it seems that you specify that users should be matched by user_id, yet you tried to log in with an email. You can adjust your user filter to match either uid or mail if you want to be able to login with both

kerem commented

2026-02-27 08:16:23 +03:00

Author

Owner

@kaaax0815 commented on GitHub (Feb 12, 2024):

I adjusted the grafana config to

search_filter = "(&(mail=%s)(memberOf=cn=grafana,ou=groups,dc=redacted,dc=de))"

this is the error i get

lldap-1  | 2024-02-12T20:07:58.984867816+00:00  INFO     LDAP session [ 93.0ms | 0.13% / 100.00% ]
lldap-1  | 2024-02-12T20:07:58.984891437+00:00  INFO     ┝━ LDAP request [ 92.3ms | 0.12% / 99.15% ]
lldap-1  | 2024-02-12T20:07:58.984902237+00:00  DEBUG    │  ┝━ 🐛 [debug]:  | msg: LdapMsg { msgid: 1, op: BindRequest(LdapBindRequest { dn: "uid=admin,ou=people,dc=redacted,dc=de", cred: LdapBindCred::Simple }), ctrl: [] }
lldap-1  | 2024-02-12T20:07:58.984904687+00:00  DEBUG    │  ┝━ do_bind [ 92.1ms | 0.03% / 99.03% ] dn: uid=admin,ou=people,dc=redacted,dc=de
lldap-1  | 2024-02-12T20:07:58.984911827+00:00  DEBUG    │  │  ┝━ bind [ 91.9ms | 0.02% / 98.72% ]
lldap-1  | 2024-02-12T20:07:58.984915377+00:00  DEBUG    │  │  │  ┝━ get_password_file_for_user [ 94.7µs | 0.10% ] user_id: UserId("admin")
lldap-1  | 2024-02-12T20:07:58.985094562+00:00  DEBUG    │  │  │  ┕━ passwords_match [ 91.7ms | 98.61% ] username: admin
lldap-1  | 2024-02-12T20:07:59.076860418+00:00  DEBUG    │  │  ┝━ get_user_groups [ 262µs | 0.28% ] user_id: "admin"
lldap-1  | 2024-02-12T20:07:59.077251808+00:00  DEBUG    │  │  │  ┕━ 🐛 [debug]:  | return: {GroupDetails { group_id: GroupId(1), display_name: "lldap_admin", creation_date: 2024-01-07T20:08:26.094561459, uuid: Uuid("93d867d8-cbcd-3af8-af0f-c2847d6b853b"), attributes: [] }}
lldap-1  | 2024-02-12T20:07:59.077255368+00:00  DEBUG    │  │  ┕━ 🐛 [debug]: Success!
lldap-1  | 2024-02-12T20:07:59.077261778+00:00  DEBUG    │  ┕━ 🐛 [debug]:  | response: BindResponse(LdapBindResponse { res: LdapResult { code: Success, matcheddn: "", message: "", referral: [] }, saslcreds: None })
lldap-1  | 2024-02-12T20:07:59.077531695+00:00  INFO     ┕━ LDAP request [ 665µs | 0.16% / 0.71% ]
lldap-1  | 2024-02-12T20:07:59.077548775+00:00  DEBUG       ┝━ 🐛 [debug]:  | msg: LdapMsg { msgid: 2, op: SearchRequest(LdapSearchRequest { base: "dc=redacted,dc=de", scope: Subtree, aliases: Never, sizelimit: 0, timelimit: 0, typesonly: false, filter: Or([And([Equality("mail", "bernd@redacted.de"), Equality("memberOf", "cn=grafana,ou=groups,dc=redacted,dc=de")])]), attrs: ["uid", "sn", "mail", "displayName", "memberOf"] }), ctrl: [] }
lldap-1  | 2024-02-12T20:07:59.077550305+00:00  DEBUG       ┝━ do_search [ 517µs | 0.17% / 0.56% ]
lldap-1  | 2024-02-12T20:07:59.077556175+00:00  DEBUG       │  ┝━ 🐛 [debug]:  | request.base: "dc=redacted,dc=de" | scope: Global
lldap-1  | 2024-02-12T20:07:59.077558235+00:00  DEBUG       │  ┝━ get_user_list [ 188µs | 0.02% / 0.20% ]
lldap-1  | 2024-02-12T20:07:59.077565505+00:00  DEBUG       │  │  ┝━ 🐛 [debug]:  | filters: Or([And([Equality(Email, "bernd@redacted.de"), MemberOf("grafana")])])
lldap-1  | 2024-02-12T20:07:59.077569695+00:00  DEBUG       │  │  ┕━ list_users [ 173µs | 0.19% ] filters: Some(Or([And([Equality(Email, "bernd@redacted.de"), MemberOf("grafana")])])) | _get_groups: true
lldap-1  | 2024-02-12T20:07:59.077945855+00:00  DEBUG       │  │     ┕━ 🐛 [debug]:  | return: [UserAndGroups { user: User { user_id: UserId("bernd"), email: "bernd@redacted.de", display_name: Some("Bernd Storath"), creation_date: 2024-01-07T20:09:56.262316346, uuid: Uuid("40cc32ca-7910-35a4-9b3a-d2e6e7ae2129"), attributes: [AttributeValue { name: "first_name", value: Serialized("Bernd") }, AttributeValue { name: "last_name", value: Serialized("Storath") }] }, groups: Some([GroupDetails { group_id: GroupId(4), display_name: "grafana", creation_date: 2024-01-07T20:09:15.170134553, uuid: Uuid("566c8f03-1a62-3835-915e-de871795abd4"), attributes: [] }]) }]
lldap-1  | 2024-02-12T20:07:59.077949335+00:00  DEBUG       │  ┝━ get_groups_list [ 161µs | 0.01% / 0.17% ]
lldap-1  | 2024-02-12T20:07:59.077952255+00:00  WARN        │  │  ┝━ 🚧 [warn]: Ignoring unknown group attribute ""mail"" in filter.\n\
lldap-1  |                                 To disable this warning, add it to "ignored_group_attributes" in the config.
lldap-1  | 2024-02-12T20:07:59.077953625+00:00  WARN        │  │  ┝━ 🚧 [warn]: Ignoring unknown group attribute ""memberof"" in filter.\n\
lldap-1  |                                 To disable this warning, add it to "ignored_group_attributes" in the config.
lldap-1  | 2024-02-12T20:07:59.077955375+00:00  DEBUG       │  │  ┝━ 🐛 [debug]:  | filters: Or([And([Not(And([])), Not(And([]))])])
lldap-1  | 2024-02-12T20:07:59.077957935+00:00  DEBUG       │  │  ┕━ list_groups [ 149µs | 0.16% ] filters: Some(Or([And([Not(And([])), Not(And([]))])]))
lldap-1  | 2024-02-12T20:07:59.078152780+00:00  DEBUG       │  │     ┕━ 🐛 [debug]:  | return: []
lldap-1  | 2024-02-12T20:07:59.078350765+00:00  DEBUG       │  ┕━ expand_attribute_wildcards [ 13.2µs | 0.01% ] ldap_attributes: ["uid", "sn", "mail", "displayName", "memberOf"]
lldap-1  | 2024-02-12T20:07:59.078356355+00:00  DEBUG       │     ┕━ 🐛 [debug]:  | resolved_attributes: ["uid", "sn", "mail", "displayName", "memberOf"]
lldap-1  | 2024-02-12T20:07:59.078383106+00:00  DEBUG       ┝━ 🐛 [debug]:  | response: SearchResultEntry(LdapSearchResultEntry { dn: "uid=bernd,ou=people,dc=redacted,dc=de", attributes: [LdapPartialAttribute { atype: "uid", vals: ["bernd"] }, LdapPartialAttribute { atype: "sn", vals: ["Storath"] }, LdapPartialAttribute { atype: "mail", vals: ["bernd@redacted.de"] }, LdapPartialAttribute { atype: "displayName", vals: ["Bernd Storath"] }, LdapPartialAttribute { atype: "memberOf", vals: ["cn=grafana,ou=groups,dc=redacted,dc=de"] }] })
lldap-1  | 2024-02-12T20:07:59.078490338+00:00  DEBUG       ┕━ 🐛 [debug]:  | response: SearchResultDone(LdapResult { code: Success, matcheddn: "", message: "", referral: [] })

@kaaax0815 commented on GitHub (Feb 12, 2024): I adjusted the grafana config to ``` search_filter = "(&(mail=%s)(memberOf=cn=grafana,ou=groups,dc=redacted,dc=de))" ``` this is the error i get ``` lldap-1 | 2024-02-12T20:07:58.984867816+00:00 INFO LDAP session [ 93.0ms | 0.13% / 100.00% ] lldap-1 | 2024-02-12T20:07:58.984891437+00:00 INFO ┝━ LDAP request [ 92.3ms | 0.12% / 99.15% ] lldap-1 | 2024-02-12T20:07:58.984902237+00:00 DEBUG │ ┝━ 🐛 [debug]: | msg: LdapMsg { msgid: 1, op: BindRequest(LdapBindRequest { dn: "uid=admin,ou=people,dc=redacted,dc=de", cred: LdapBindCred::Simple }), ctrl: [] } lldap-1 | 2024-02-12T20:07:58.984904687+00:00 DEBUG │ ┝━ do_bind [ 92.1ms | 0.03% / 99.03% ] dn: uid=admin,ou=people,dc=redacted,dc=de lldap-1 | 2024-02-12T20:07:58.984911827+00:00 DEBUG │ │ ┝━ bind [ 91.9ms | 0.02% / 98.72% ] lldap-1 | 2024-02-12T20:07:58.984915377+00:00 DEBUG │ │ │ ┝━ get_password_file_for_user [ 94.7µs | 0.10% ] user_id: UserId("admin") lldap-1 | 2024-02-12T20:07:58.985094562+00:00 DEBUG │ │ │ ┕━ passwords_match [ 91.7ms | 98.61% ] username: admin lldap-1 | 2024-02-12T20:07:59.076860418+00:00 DEBUG │ │ ┝━ get_user_groups [ 262µs | 0.28% ] user_id: "admin" lldap-1 | 2024-02-12T20:07:59.077251808+00:00 DEBUG │ │ │ ┕━ 🐛 [debug]: | return: {GroupDetails { group_id: GroupId(1), display_name: "lldap_admin", creation_date: 2024-01-07T20:08:26.094561459, uuid: Uuid("93d867d8-cbcd-3af8-af0f-c2847d6b853b"), attributes: [] }} lldap-1 | 2024-02-12T20:07:59.077255368+00:00 DEBUG │ │ ┕━ 🐛 [debug]: Success! lldap-1 | 2024-02-12T20:07:59.077261778+00:00 DEBUG │ ┕━ 🐛 [debug]: | response: BindResponse(LdapBindResponse { res: LdapResult { code: Success, matcheddn: "", message: "", referral: [] }, saslcreds: None }) lldap-1 | 2024-02-12T20:07:59.077531695+00:00 INFO ┕━ LDAP request [ 665µs | 0.16% / 0.71% ] lldap-1 | 2024-02-12T20:07:59.077548775+00:00 DEBUG ┝━ 🐛 [debug]: | msg: LdapMsg { msgid: 2, op: SearchRequest(LdapSearchRequest { base: "dc=redacted,dc=de", scope: Subtree, aliases: Never, sizelimit: 0, timelimit: 0, typesonly: false, filter: Or([And([Equality("mail", "bernd@redacted.de"), Equality("memberOf", "cn=grafana,ou=groups,dc=redacted,dc=de")])]), attrs: ["uid", "sn", "mail", "displayName", "memberOf"] }), ctrl: [] } lldap-1 | 2024-02-12T20:07:59.077550305+00:00 DEBUG ┝━ do_search [ 517µs | 0.17% / 0.56% ] lldap-1 | 2024-02-12T20:07:59.077556175+00:00 DEBUG │ ┝━ 🐛 [debug]: | request.base: "dc=redacted,dc=de" | scope: Global lldap-1 | 2024-02-12T20:07:59.077558235+00:00 DEBUG │ ┝━ get_user_list [ 188µs | 0.02% / 0.20% ] lldap-1 | 2024-02-12T20:07:59.077565505+00:00 DEBUG │ │ ┝━ 🐛 [debug]: | filters: Or([And([Equality(Email, "bernd@redacted.de"), MemberOf("grafana")])]) lldap-1 | 2024-02-12T20:07:59.077569695+00:00 DEBUG │ │ ┕━ list_users [ 173µs | 0.19% ] filters: Some(Or([And([Equality(Email, "bernd@redacted.de"), MemberOf("grafana")])])) | _get_groups: true lldap-1 | 2024-02-12T20:07:59.077945855+00:00 DEBUG │ │ ┕━ 🐛 [debug]: | return: [UserAndGroups { user: User { user_id: UserId("bernd"), email: "bernd@redacted.de", display_name: Some("Bernd Storath"), creation_date: 2024-01-07T20:09:56.262316346, uuid: Uuid("40cc32ca-7910-35a4-9b3a-d2e6e7ae2129"), attributes: [AttributeValue { name: "first_name", value: Serialized("Bernd") }, AttributeValue { name: "last_name", value: Serialized("Storath") }] }, groups: Some([GroupDetails { group_id: GroupId(4), display_name: "grafana", creation_date: 2024-01-07T20:09:15.170134553, uuid: Uuid("566c8f03-1a62-3835-915e-de871795abd4"), attributes: [] }]) }] lldap-1 | 2024-02-12T20:07:59.077949335+00:00 DEBUG │ ┝━ get_groups_list [ 161µs | 0.01% / 0.17% ] lldap-1 | 2024-02-12T20:07:59.077952255+00:00 WARN │ │ ┝━ 🚧 [warn]: Ignoring unknown group attribute ""mail"" in filter.\n\ lldap-1 | To disable this warning, add it to "ignored_group_attributes" in the config. lldap-1 | 2024-02-12T20:07:59.077953625+00:00 WARN │ │ ┝━ 🚧 [warn]: Ignoring unknown group attribute ""memberof"" in filter.\n\ lldap-1 | To disable this warning, add it to "ignored_group_attributes" in the config. lldap-1 | 2024-02-12T20:07:59.077955375+00:00 DEBUG │ │ ┝━ 🐛 [debug]: | filters: Or([And([Not(And([])), Not(And([]))])]) lldap-1 | 2024-02-12T20:07:59.077957935+00:00 DEBUG │ │ ┕━ list_groups [ 149µs | 0.16% ] filters: Some(Or([And([Not(And([])), Not(And([]))])])) lldap-1 | 2024-02-12T20:07:59.078152780+00:00 DEBUG │ │ ┕━ 🐛 [debug]: | return: [] lldap-1 | 2024-02-12T20:07:59.078350765+00:00 DEBUG │ ┕━ expand_attribute_wildcards [ 13.2µs | 0.01% ] ldap_attributes: ["uid", "sn", "mail", "displayName", "memberOf"] lldap-1 | 2024-02-12T20:07:59.078356355+00:00 DEBUG │ ┕━ 🐛 [debug]: | resolved_attributes: ["uid", "sn", "mail", "displayName", "memberOf"] lldap-1 | 2024-02-12T20:07:59.078383106+00:00 DEBUG ┝━ 🐛 [debug]: | response: SearchResultEntry(LdapSearchResultEntry { dn: "uid=bernd,ou=people,dc=redacted,dc=de", attributes: [LdapPartialAttribute { atype: "uid", vals: ["bernd"] }, LdapPartialAttribute { atype: "sn", vals: ["Storath"] }, LdapPartialAttribute { atype: "mail", vals: ["bernd@redacted.de"] }, LdapPartialAttribute { atype: "displayName", vals: ["Bernd Storath"] }, LdapPartialAttribute { atype: "memberOf", vals: ["cn=grafana,ou=groups,dc=redacted,dc=de"] }] }) lldap-1 | 2024-02-12T20:07:59.078490338+00:00 DEBUG ┕━ 🐛 [debug]: | response: SearchResultDone(LdapResult { code: Success, matcheddn: "", message: "", referral: [] }) ```

kerem commented

2026-02-27 08:16:23 +03:00

Author

Owner

@nitnelave commented on GitHub (Feb 12, 2024):

That request and response looks correct. From an LDAP point of view, I see nothing wrong here. LLDAP returned your user.

If you still can't log in, you'll have to look into the grafana logs to understand why.

@nitnelave commented on GitHub (Feb 12, 2024): That request and response looks correct. From an LDAP point of view, I see nothing wrong here. LLDAP returned your user. If you still can't log in, you'll have to look into the grafana logs to understand why.

kerem commented

2026-02-27 08:16:23 +03:00

Author

Owner

@nitnelave commented on GitHub (Feb 12, 2024):

And btw, you might want a filter that looks like (&(|(uid=%s)(mail=%s))(memberOf=cn=grafana,...)) to match either uid or mail

@nitnelave commented on GitHub (Feb 12, 2024): And btw, you might want a filter that looks like `(&(|(uid=%s)(mail=%s))(memberOf=cn=grafana,...))` to match either uid or mail

kerem commented

2026-02-27 08:16:23 +03:00

Author

Owner

@kaaax0815 commented on GitHub (Apr 18, 2024):

Works now

@kaaax0815 commented on GitHub (Apr 18, 2024): Works now

kerem referenced this issue

2026-02-27 08:18:21 +03:00

[PR #283] [MERGED] migration-tool: Extract the JWT from the JSON response #659