# Authentication to LDAP/AD for Sunstone fails **URL:** \ **Category:** Product Support\ **Created:** [August 23, 2017, 6:13am UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798 "2017-08-23T06:13:07Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![NiclasEriksson](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiclasEriksson](https://forum.opennebula.io/u/NiclasEriksson)\ **Post date:** [August 23, 2017, 6:13am UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798/1 "2017-08-23T06:13:08Z")
I’ve deployed and setup the OpenNebula 5.4 virtual appliance in VMware for a testdrive. I’ve followed the ducumentation to setup LDAP auth towards my Active directory. I started out in the control panel gui but that didn’t work so I altered the config files on the appliance instead. These are the settings: **oned.conf** AUTH\_MAD = [ EXECUTABLE = “one\_auth\_mad”, AUTHN = “ssh,x509,ldap,server\_cipher,server\_x509” ] DEFAULT\_AUTH = “ldap” **ldap\_auth.conf** _dchostname_: :mapping\_generate: true :mapping\_timeout: 300 :mapping\_filename: server1.yaml :mapping\_key: GROUP\_DN :mapping\_default: 1 :user: ‘AD user’ :password: ‘AD user pass’ :auth\_method: :simple :host: _dchostname_ :port: 389 :base: ‘dc=domain,dc=com’ :user\_field: sAMAccountName :group: ‘dn of a group’ :rfc2307bis: true :order: - _dchostname_ When I try to login to Sunstone web GUI the error I get is: “OpenNebula is not running or there was a server exception. Please check the server logs.” **In the sunstone.log I see this:** Wed Aug 23 07:56:16 2017 [E]: User niclas.eriksson could not be authenticated Wed Aug 23 07:56:16 2017 [E]: Net::ReadTimeout Wed Aug 23 07:56:16 2017 [E]: undefined method `Exception’ for #CloudAuth:0x000000031abe88 Wed Aug 23 07:56:16 2017 [I]: 10.122.95.7 - - [23/Aug/2017:07:56:16 +0200] “POST /login HTTP/1.1” 500 - 60.0919 **In the oned.log I see this:** Message received: AUTHENTICATE SUCCESS 1831 ldap niclas.eriksson CN=Niclas%20Eriksson,OU=Users,OU=IC-Systems,DC=invidcloud,DC=com 1 **If I run:** ruby -wd /var/lib/one/remotes/auth/ldap/authenticate niclas.eriksson - password **I get this:** Exception `LoadError' at /usr/share/rubygems/rubygems.rb:1096 - cannot load such file -- rubygems/defaults/ruby Exception`LoadError’ at /usr/share/rubygems/rubygems/core\_ext/kernel\_require.rb:55 - cannot load such file – abrt Exception `LoadError' at /usr/share/rubygems/rubygems/core_ext/kernel_require.rb:141 - cannot load such file -- abrt /var/lib/one/remotes/auth/ldap/authenticate:42: warning: assigned but unused variable - pass Exception`NameError’ at /usr/share/ruby/psych/core\_ext.rb:16 - method `to_yaml' not defined in Object Exception`NameError’ at /usr/share/ruby/psych/core\_ext.rb:29 - method `yaml_as' not defined in Module Exception`NameError’ at /usr/share/ruby/psych/deprecated.rb:80 - undefined method `to_yaml_properties' for class`Object’ /usr/lib/one/ruby/opennebula/xml\_utils.rb:94: warning: `-' after local variable is interpreted as binary operator /usr/lib/one/ruby/opennebula/xml_utils.rb:94: warning: even though it seems like unary operator /usr/lib/one/ruby/opennebula/xml_pool.rb:25: warning: method redefined; discarding old initialize /usr/lib/one/ruby/opennebula/xml_element.rb:429: warning: previous definition of initialize was here /usr/lib/one/ruby/opennebula/xml_pool.rb:31: warning: method redefined; discarding old each_element /usr/lib/one/ruby/opennebula/xml_element.rb:435: warning: previous definition of each_element was here Exception`LoadError’ at /usr/share/rubygems/rubygems/core\_ext/kernel\_require.rb:55 - cannot load such file – nokogiri Exception `LoadError' at /usr/share/rubygems/rubygems/core_ext/kernel_require.rb:55 - cannot load such file -- ox Exception`LoadError’ at /usr/share/rubygems/rubygems/core\_ext/kernel\_require.rb:55 - cannot load such file – xmlparser Exception `LoadError' at /usr/share/rubygems/rubygems/core_ext/kernel_require.rb:141 - cannot load such file -- xmlparser /usr/lib/one/ruby/opennebula/virtual_machine_pool.rb:297: warning: assigned but unused variable - acct_hash /usr/lib/one/ruby/opennebula/host.rb:136: warning: ambiguous first argument; put parentheses or even spaces /usr/lib/one/ruby/opennebula/vdc.rb:176: warning: method redefined; discarding old add_host /usr/lib/one/ruby/opennebula/vdc.rb:164: warning: previous definition of add_host was here /usr/lib/one/ruby/opennebula/vdc.rb:192: warning: method redefined; discarding old del_host /usr/lib/one/ruby/opennebula/vdc.rb:186: warning: previous definition of del_host was here Exception`LoadError’ at /usr/share/rubygems/rubygems/core\_ext/kernel\_require.rb:55 - cannot load such file – net/ldap /usr/local/share/gems/gems/net-ldap-0.16.0/lib/net/ldap/password.rb:22: warning: assigned but unused variable - attribute\_value /usr/local/share/gems/gems/net-ldap-0.16.0/lib/net/ldap/instrumentation.rb:15: warning: shadowing outer local variable - payload /usr/local/share/gems/gems/net-ldap-0.16.0/lib/net/ldap/connection.rb:303: warning: assigned but unused variable - sort\_control Trying server [ic-dc02.invidcloud.com](http://ic-dc02.invidcloud.com) Exception `Errno::EAGAIN' at /usr/share/ruby/net/protocol.rb:153 - Resource temporarily unavailable - read would block Exception`Errno::EAGAIN’ at /usr/share/ruby/net/protocol.rb:153 - Resource temporarily unavailable - read would block Exception `Errno::EINPROGRESS' at /usr/share/ruby/socket.rb:54 - Operation now in progress - connect(2) would block Exception`Errno::EINPROGRESS’ at /usr/share/ruby/socket.rb:54 - Operation now in progress - connect(2) would block Exception `Errno::EINPROGRESS' at /usr/share/ruby/socket.rb:54 - Operation now in progress - connect(2) would block Exception`Errno::EINPROGRESS’ at /usr/share/ruby/socket.rb:54 - Operation now in progress - connect(2) would block ldap niclas.eriksson CN=Niclas%20Eriksson,OU=Users,OU=IC-Systems,DC=invidcloud,DC=com 1 Anyone that has some input what I do wrong? ---
**Author:** ![jfontan](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/jfontan/32/18_2.png) [@jfontan](https://forum.opennebula.io/u/jfontan)\ **Post date:** [August 23, 2017, 8:44am UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798/2 "2017-08-23T08:44:17Z")
LDAP auth seems to be working fine. - Do you see any other messages in `oned.log`? Maybe a user creation error. - Does the user `niclas.eriksson` exist in OpenNebula? - Do you have a proxy configured in that server? ---
**Author:** ![NiclasEriksson](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiclasEriksson](https://forum.opennebula.io/u/NiclasEriksson)\ **Post date:** [August 23, 2017, 8:53am UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798/3 "2017-08-23T08:53:04Z")
Thanks for the input Javi. The user gets added to OpenNebula automatically. No other error messages in oned.log that touches the user login/adding or similar what I can see. I haven’t set any proxy settings, but how can I check them? ---
**Author:** ![NiclasEriksson](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiclasEriksson](https://forum.opennebula.io/u/NiclasEriksson)\ **Post date:** [August 24, 2017, 5:53am UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798/4 "2017-08-24T05:53:29Z")
I can’t see any proxy settings. ---
**Author:** ![NiclasEriksson](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiclasEriksson](https://forum.opennebula.io/u/NiclasEriksson)\ **Post date:** [August 24, 2017, 1:51pm UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798/5 "2017-08-24T13:51:21Z")
Anyone that has some input on this? ---
**Author:** ![jfontan](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/jfontan/32/18_2.png) [@jfontan](https://forum.opennebula.io/u/jfontan)\ **Post date:** [August 24, 2017, 2:20pm UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798/6 "2017-08-24T14:20:55Z")
There’s also a timeout in the logs. Can you check how much does it take to contact the LDAP server? ```nohighlight $ time ruby -wd /var/lib/one/remotes/auth/ldap/authenticate niclas.eriksson - password ``` ---
**Author:** ![NiclasEriksson](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiclasEriksson](https://forum.opennebula.io/u/NiclasEriksson)\ **Post date:** [August 24, 2017, 3:25pm UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798/7 "2017-08-24T15:25:24Z")
Result: Trying server dchostname Exception `Errno::EAGAIN' at /usr/share/ruby/net/protocol.rb:153 - Resource temporarily unavailable - read would block Exception`Errno::EAGAIN’ at /usr/share/ruby/net/protocol.rb:153 - Resource temporarily unavailable - read would block Exception `Errno::EINPROGRESS' at /usr/share/ruby/socket.rb:54 - Operation now in progress - connect(2) would block Exception`Errno::EINPROGRESS’ at /usr/share/ruby/socket.rb:54 - Operation now in progress - connect(2) would block Exception `Errno::EINPROGRESS' at /usr/share/ruby/socket.rb:54 - Operation now in progress - connect(2) would block Exception`Errno::EINPROGRESS’ at /usr/share/ruby/socket.rb:54 - Operation now in progress - connect(2) would block ldap niclas.eriksson CN=Niclas%20Eriksson,OU=Users,OU=IC-Systems,DC=invidcloud,DC=com 1 real 0m51.661s user 0m0.230s sys 0m0.030s ---
**Author:** ![NiclasEriksson](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiclasEriksson](https://forum.opennebula.io/u/NiclasEriksson)\ **Post date:** [August 24, 2017, 3:26pm UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798/8 "2017-08-24T15:26:21Z")
The OpenNebula server and DC’s are in the same subnet with no FW between. The DC/forest/domain is in 2016 level if that has anything to do with it. ---
**Author:** ![NiclasEriksson](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiclasEriksson](https://forum.opennebula.io/u/NiclasEriksson)\ **Post date:** [August 29, 2017, 11:42am UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798/9 "2017-08-29T11:42:07Z")
I’ve tested this on a fresh install and it seems to work better now, but towards another domain. Can it be a domain/forrest level thing? ---
**Author:** ![NiclasEriksson](https://avatars.discourse-cdn.com/v4/letter/n/e495f1/32.png) [@NiclasEriksson](https://forum.opennebula.io/u/NiclasEriksson)\ **Post date:** [August 30, 2017, 2:20pm UTC](https://forum.opennebula.io/t/authentication-to-ldap-ad-for-sunstone-fails/4798/10 "2017-08-30T14:20:24Z")
I’ve got it working now after a few tweaks. Followed this (old?) guide: > **[CentOS 6.4 – Connecting OpenNebula Sunstone to LDAP server](https://n40lab.wordpress.com/2013/11/22/centos-6-4-connecting-opennebula-sunstone-to-ldap-server/)** > > In a previous post I’ve installed an LDAP server with OpenLDAP in my CentOS 6.4, please read it if you want to know the structure of my lab’s LDAP directory. I’m going to configur… Now it works.