Bug 623115 - Unable to use PAM authentification with LDAP - server killed
Summary: Unable to use PAM authentification with LDAP - server killed
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Spacewalk
Classification: Community
Component: Server
Version: 1.1
Hardware: All
OS: Linux
high
medium
Target Milestone: ---
Assignee: Jan Pazdziora (Red Hat)
QA Contact: Martin Minar
URL:
Whiteboard:
: 641884 (view as bug list)
Depends On: 633805 633810
Blocks: space12
TreeView+ depends on / blocked
 
Reported: 2010-08-11 11:29 UTC by Martin Minar
Modified: 2016-07-04 00:55 UTC (History)
7 users (show)

Fixed In Version: oracle-lib-compat-10.2-24
Clone Of:
: 627859 (view as bug list)
Environment:
Last Closed: 2010-11-19 16:16:10 UTC
Embargoed:


Attachments (Terms of Use)

Description Martin Minar 2010-08-11 11:29:46 UTC
Description of problem:
When trying to connect to Spacewalk as PAM user using LDAP I get 503 service temporaly unavailable.

Version-Release number of selected component (if applicable):
Spacewalk nightly
spacewalk-backend-1.1.49-1.el5
spacewalk-schema-1.1.30-1.el5
tomcat5-5.5.23-0jpp.7.el5_3.2

How reproducible:
Always

Steps to Reproduce:
1. Start LDAP server
2. Create LDAP user (USER, PASS)
3. Create Spacewalk user (USER, PASS) with PAM toggled
4. Try to connect to Spacewalk using XML-RPC - client.auth.login(USER, PASS)
  
Actual results:
<ProtocolError for my_server/rpc/api: 503 Service Temporarily Unavailable>

Expected results:
sessionKey

Additional info:

Comment 2 Marco Giunta 2010-08-23 11:00:40 UTC
Description of problem:

Same problem here ...

Version-Release number of selected component (if applicable):

Spacewalk 1.1
spacewalk-backend-1.1.50-1.el5
spacewalk-schema-1.1.31-1.el5
tomcat5-5.5.23-0jpp.9.el5_5

How reproducible:
Always

Steps to Reproduce:
1. add in /etc/rhn/rhn.conf

...
pam_auth_service = rhn-satellite

2. create file /etc/pam.d/rhn-satellite
#%PAM-1.0
auth        required      pam_env.so
auth        sufficient    pam_ldap.so
auth        required      pam_deny.so
account     required      pam_ldap.so

3. configure /etc/ldap.conf to connect to ldap server:

...
host auth-01.example.it auth-02.example.it
base dc=example,dc=it
nss_base_passwd ou=People,dc=example,dc=it
nss_base_shadow ou=People,dc=example,dc=it
nss_base_group  ou=Groups,dc=example,dc=it
ssl start_tls
tls_cacertdir /etc/openldap/cacerts
pam_password md5

3. Create Spacewalk user (USER, PASS) with PAM toggled
4. try to login on Spacewalk login page

Actual results:
Error message in /var/log/tomcat5/catalina.out

...
java: ../../../libraries/libldap/extended.c:133: ldap_extended_operation_s: Assertion `( (ld)->ld_options.ldo_valid == 0x2 )' failed.

and server hang

Expected results:
succesfull login

Additional info:
This configuration was working well till 1.0 -> 1.1 upgrade; after that, I' m not able to login with my ldap account

Comment 3 Marco Giunta 2010-08-31 07:13:55 UTC
There is a possible solution in spacewalk-user ML, in a mail from Christoph Sievers (https://www.redhat.com/archives/spacewalk-list/2010-August/msg00177.html):


change /etc/rhn/rhn.conf

from
hibernate.connection.driver_proto=jdbc:oracle:oci
to
hibernate.connection.driver_proto=jdbc:oracle:thin


I've done the change above, and now I'm able to login with my ldap account ...

Comment 4 Jan Pazdziora (Red Hat) 2010-09-09 20:42:15 UTC
(In reply to comment #3)
> There is a possible solution in spacewalk-user ML, in a mail from Christoph
> Sievers
> (https://www.redhat.com/archives/spacewalk-list/2010-August/msg00177.html):
> 
> 
> change /etc/rhn/rhn.conf
> 
> from
> hibernate.connection.driver_proto=jdbc:oracle:oci
> to
> hibernate.connection.driver_proto=jdbc:oracle:thin
> 
> 
> I've done the change above, and now I'm able to login with my ldap account ...

Please note that we really do not want to do this if possible, as the OCI driver allows us to do TNS resolution and other stuff.

Comment 5 Jan Pazdziora (Red Hat) 2010-09-09 20:43:27 UTC
By any chance, were there some AVC denials logged in /var/log/audit/audit.log on this system?

Comment 6 Marco Giunta 2010-09-10 06:39:45 UTC
I've restored original configuration (hibernate.connection.driver_proto=jdbc:oracle:oci) and restarted Spacewalk; only error message in /var/log/audit/audit.log is:

type=ANOM_ABEND msg=audit(1284100567.049:1437): auid=0 uid=91 gid=91 ses=275 pid=32309 comm="java" sig=6

Let me know if you need more informations ...

Comment 8 Jan Pazdziora (Red Hat) 2010-09-10 09:14:03 UTC
I've reproduced the error both on x86_64 and on i386 architectures.

Comment 9 Stuart R. Kirk 2010-09-10 23:23:39 UTC
Confirmed.  Same problems.  Workaround addressed issue.

Comment 11 Jan Pazdziora (Red Hat) 2010-09-13 13:02:46 UTC
Taking.

Comment 12 Jan Pazdziora (Red Hat) 2010-09-13 14:39:17 UTC
Fixed in Spacewalk master, f5a5bb16292d33bf63941d5d45d361ebb2f39975.

We LD_PRELOAD openldap library to override the symbols in Oracle's .so, as that causes conflicts and segfaults.

The updated package oracle-lib-compat-10.2-23 should hit the nightly repos shortly.

Comment 13 Jan Pazdziora (Red Hat) 2010-09-14 08:09:14 UTC
Package is in the nightly compose, moving ON_QA.

Comment 14 Martin Minar 2010-09-14 12:44:53 UTC
RHEL5 version is ok, but Fedora13 version still makes SIGSEGV.

Comment 15 Jan Pazdziora (Red Hat) 2010-09-14 13:02:15 UTC
I've filed bug 633805 against Fedora's tomcat6.

Comment 16 Jan Pazdziora (Red Hat) 2010-09-23 07:03:52 UTC
The fix as written did not work when openldap-devel was not installed. We now lookup via pam_ldap.so.

Spacewalk master 3e5fd863b076ab611d0beb53a295b2d8e08f3ae0.

Comment 17 Michael Mráka 2010-10-11 12:35:07 UTC
*** Bug 641884 has been marked as a duplicate of this bug. ***

Comment 18 Sandro Mathys 2010-10-11 12:56:54 UTC
Thanks Michael for finding my duplicate and marking it as such.

Any chance this fix is backported to spacewalk 1.1 where it initially showed up?

Comment 19 Marcus Moeller 2010-10-18 07:07:56 UTC
Installed the package oracle-lib-compat-10.2.0.25 on 1.1 and everything worked fine.

Comment 22 Jan Pazdziora (Red Hat) 2010-11-19 16:16:10 UTC
With Spacewalk 1.2 released, marking as CLOSED CURRENTRELEASE.

https://www.redhat.com/archives/spacewalk-list/2010-November/msg00111.html


Note You need to log in before you can comment on or make changes to this bug.