Bug 1806620 - User unable to login when ldap query times out even when htpasswd IDP credentials are used.
Summary: User unable to login when ldap query times out even when htpasswd IDP credent...
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: apiserver-auth
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.5.0
Assignee: Venkata Siva Teja Areti
QA Contact: scheng
Depends On:
Blocks: 1814898
TreeView+ depends on / blocked
Reported: 2020-02-24 16:09 UTC by Venkata Siva Teja Areti
Modified: 2020-07-13 17:21 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
: 1814898 (view as bug list)
Last Closed: 2020-07-13 17:20:43 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift oauth-server pull 34 0 None closed Bug 1806620: reduce ldap connection timeout from 60s to 30s 2021-01-25 02:05:50 UTC
Red Hat Product Errata RHBA-2020:2409 0 None None None 2020-07-13 17:21:02 UTC

Description Venkata Siva Teja Areti 2020-02-24 16:09:10 UTC
Description of problem:
When both ldap and htpasswd IDPs are configured, and if LDAP query took more time than allowed Request timeout(default is 60s), user fails to login when credentials from htpasswd are used. Even though request timeout exceeds, it seems logical to try the other IDP.

login succeeds if the order of htpasswd and ldap IDPs are reversed.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Apply ldap IDP followed by htpasswd IDP
2. break the connection between ldap server and oauth-server. I achieved this by changing ldap server port number 
3. trying to login as user configured in in htpasswd using `oc login` 

Actual results:
login fails with "Error from server (InternalError): Internal error occurred: unexpected response: 504"

Expected results:
login to succeed

Additional info:

Comment 2 Standa Laznicka 2020-02-25 11:00:52 UTC
I think this must have been there at least since 4.1. A solution to consider is to set the timeout the ldap library uses for connections (not the timelimit for searches, that's different) to half/portion of our request timeout. Ref: https://github.com/go-ldap/ldap/blob/bb7a9ca6e4fbc2129e3db588a34bc970ffe811a9/conn.go#L107

Comment 7 errata-xmlrpc 2020-07-13 17:20:43 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.