Rabbitmq-server: ldap authentication vs active directory crashes

[Docjones]

Hello,

I am trying to get my login via active directory working.

I want to have full admin access to all users of ad-group "SW_Entwicklung". However, logging in with a user from that group seems to crash the ldap plugin at some point.

Here is the information:

• RabbitMQ version - 3.7.8
• Erlang version - 20.3.8.5
• RabbitMQ plugin information via rabbitmq-plugins list - ldap plugin
• Operating system, version, and patch level - docker container with tag "3-management"

advanced.config-File for ldap:

[
  {rabbit, [{auth_backends, [rabbit_auth_backend_ldap, rabbit_auth_backend_internal]}]},
  {rabbitmq_auth_backend_ldap,
   [ {servers,               ["dc1.ids.net"]},
     {dn_lookup_attribute,   "sAMAccountName"},
     {dn_lookup_base,        "OU=User,OU=Kleinostheim,DC=ids,DC=net"},
     {dn_lookup_bind,        {"[email protected]","***"}},
     {user_dn_pattern,       "${username}"},
     {other_bind,            {"[email protected]","***"}},
     {use_ssl,               true},
     {port,                  636},
     {log,                   network_unsafe},
     {group_lookup_base,     "OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net"},
     {vhost_access_query,    {in_group, "(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"}},
     {resource_access_query,
      {for, [{permission, configure, {constant, true}},
             {permission, write,
              {for, [{resource, queue,    {constant, true}},
                     {resource, exchange, {constant, true}}]}},
             {permission, read,
              {for, [{resource, exchange, {constant, true}},
                     {resource, queue,    {constant, true}}]}}
            ]
      }},
     {tag_queries,           [{administrator, {in_group, "(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"}},
                              {management,    {constant, true}}]}
   ]
  }
].
````
Log-File:

2018-10-17 15:34:21.411 [info] <0.5.0> Server startup complete; 4 plugins started.

• rabbitmq_auth_backend_ldap
• rabbitmq_management
• rabbitmq_web_dispatch
• rabbitmq_management_agent
  completed with 4 plugins.
  2018-10-17 15:34:24.586 [info] <0.710.0> LDAP CHECK: login for mrink
  2018-10-17 15:34:24.587 [info] <0.710.0> LDAP connecting to servers: ["dc1.ids.net"]
  2018-10-17 15:34:24.598 [info] <0.711.0> LDAP network traffic: bind request = {'BindRequest',3,"[email protected]",{simple,""}}
  2018-10-17 15:34:24.605 [info] <0.711.0> LDAP network traffic: bind reply = {ok,{'LDAPMessage',1,{bindResponse,{'BindResponse',success,[],[],asn1_NOVALUE,asn1_NOVALUE}},asn1_NOVALUE}}
  2018-10-17 15:34:24.606 [info] <0.376.0> LDAP bind succeeded: [email protected]
  2018-10-17 15:34:24.606 [info] <0.376.0> LDAP filling template "${username}" with
  [{username,<<"mrink">>}]
  2018-10-17 15:34:24.606 [info] <0.376.0> LDAP template result: "mrink"
  2018-10-17 15:34:24.607 [info] <0.711.0> LDAP network traffic: search request = {'SearchRequest',"OU=User,OU=Kleinostheim,DC=ids,DC=net",wholeSubtree,derefAlways,0,0,false,{equalityMatch,{'AttributeValueAssertion',"sAMAccountName","mrink"}},["distinguishedName"]}
  2018-10-17 15:34:24.608 [info] <0.711.0> LDAP network traffic: search reply = {ok,{'LDAPMessage',2,{searchResEntry,{'SearchResultEntry',"CN=Marc Rink,OU=User,OU=Kleinostheim,DC=ids,DC=net",[{'PartialAttribute',"distinguishedName",["CN=Marc Rink,OU=User,OU=Kleinostheim,DC=ids,DC=net"]}]}},asn1_NOVALUE}}
  2018-10-17 15:34:24.608 [info] <0.711.0> LDAP network traffic: search reply = {ok,{'LDAPMessage',2,{searchResDone,{'LDAPResult',success,[],[],asn1_NOVALUE}},asn1_NOVALUE}}
  2018-10-17 15:34:24.608 [info] <0.711.0> LDAP network traffic: search reply = searchResDone
  2018-10-17 15:34:24.609 [info] <0.376.0> LDAP DN lookup: mrink -> CN=Marc Rink,OU=User,OU=Kleinostheim,DC=ids,DC=net
  2018-10-17 15:34:24.609 [info] <0.710.0> LDAP connecting to servers: ["dc1.ids.net"]
  2018-10-17 15:34:24.610 [info] <0.711.0> LDAP network traffic: bind request = {'BindRequest',3,"CN=Marc Rink,OU=User,OU=Kleinostheim,DC=ids,DC=net",{simple,<<"">>}}
  2018-10-17 15:34:24.612 [info] <0.711.0> LDAP network traffic: bind reply = {ok,{'LDAPMessage',3,{bindResponse,{'BindResponse',success,[],[],asn1_NOVALUE,asn1_NOVALUE}},asn1_NOVALUE}}
  2018-10-17 15:34:24.612 [info] <0.376.0> LDAP bind succeeded: CN=Marc Rink,OU=User,OU=Kleinostheim,DC=ids,DC=net
  2018-10-17 15:34:24.612 [info] <0.376.0> LDAP connecting to servers: ["dc1.ids.net"]
  2018-10-17 15:34:24.612 [info] <0.711.0> LDAP network traffic: bind request = {'BindRequest',3,"[email protected]",{simple,""}}
  2018-10-17 15:34:24.613 [info] <0.711.0> LDAP network traffic: bind reply = {ok,{'LDAPMessage',4,{bindResponse,{'BindResponse',success,[],[],asn1_NOVALUE,asn1_NOVALUE}},asn1_NOVALUE}}
  2018-10-17 15:34:24.614 [info] <0.376.0> LDAP bind succeeded: [email protected]
  2018-10-17 15:34:24.614 [info] <0.376.0> LDAP CHECK: does mrink have tag administrator?
  2018-10-17 15:34:24.614 [info] <0.376.0> LDAP evaluating query: {in_group,"(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"}
  2018-10-17 15:34:24.614 [info] <0.376.0> LDAP evaluating query: {in_group,"(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)","member"}
  2018-10-17 15:34:24.615 [info] <0.376.0> LDAP filling template "(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)" with
  [{username,<<"mrink">>},{user_dn,"CN=Marc Rink,OU=User,OU=Kleinostheim,DC=ids,DC=net"}]
  2018-10-17 15:34:24.615 [info] <0.376.0> LDAP template result: "(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"
  2018-10-17 15:34:24.615 [info] <0.711.0> LDAP network traffic: search request = {'SearchRequest',"(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)",baseObject,derefAlways,0,0,false,{equalityMatch,{'AttributeValueAssertion',"member","CN=Marc Rink,OU=User,OU=Kleinostheim,DC=ids,DC=net"}},["objectClass"]}
  2018-10-17 15:34:24.616 [info] <0.711.0> LDAP network traffic: search reply = {ok,{'LDAPMessage',5,{searchResDone,{'LDAPResult',referral,[],[48,48,48,48,50,48,50,66,58,32,82,101,102,69,114,114,58,32,68,83,73,68,45,48,51,49,48,48,55,69,70,44,32,100,97,116,97,32,48,44,32,49,32,97,99,99,101,115,115,32,112,111,105,110,116,115,10,9,114,101,102,32,49,58,32,39,105,100,115,46,110,101,116,41,39,10,0],["ldaps://ids.net)/(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"]}},asn1_NOVALUE}}
  2018-10-17 15:34:24.617 [error] <0.376.0> * Generic server <0.376.0> terminating
  * Last message in was {submit,#Fun,<0.710.0>,reuse}
  * When Server state == {from,<0.710.0>,#Ref<0.662021440.2018508801.106142>}
  * Reason for termination ==
  * {{case_clause,{ok,{referral,["ldaps://ids.net)/(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"]}}},[{rabbit_auth_backend_ldap,object_exists,3,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,397}]},{rabbit_auth_backend_ldap,evaluate0,4,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,206}]},{rabbit_auth_backend_ldap,'-do_tag_queries/5-lc$^0/1-0-',6,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,708}]},{rabbit_auth_backend_ldap,do_tag_queries,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,706}]},{rabbit_auth_backend_ldap,call_ldap_fun,3,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,542}]},{rabbit_auth_backend_ldap,with_login,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,499}]},{rabbit_auth_backend_ldap,'-with_ldap/3-fun-14-',4,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,469}]},{rabbit_auth_backend_ldap,do_login,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,698}]}]}
  2018-10-17 15:34:24.618 [error] <0.376.0> CRASH REPORT Process <0.376.0> with 1 neighbours exited with reason: no case clause matching {ok,{referral,["ldaps://ids.net)/(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"]}} in rabbit_auth_backend_ldap:object_exists/3 line 397 in gen_server2:terminate/3 line 1166
  2018-10-17 15:34:24.619 [error] <0.710.0> CRASH REPORT Process <0.710.0> with 0 neighbours exited with reason: {{{case_clause,{ok,{referral,["ldaps://ids.net)/(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"]}}},[{rabbit_auth_backend_ldap,object_exists,3,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,397}]},{rabbit_auth_backend_ldap,evaluate0,4,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,206}]},{rabbit_auth_backend_ldap,'-do_tag_queries/5-lc$^0/1-0-',6,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,708}]},{rabbit_auth_backend_ldap,do_tag_queries,5,[{file,"src/rabbit_auth_backe..."},...]},...]},...} in gen_server2:call/3 line 329 in gen_server2:call/3 line 329
  2018-10-17 15:34:24.620 [error] <0.374.0> Supervisor ldap_pool_sup had child 1 started with worker_pool_worker:start_link(ldap_pool) at <0.376.0> exit with reason no case clause matching {ok,{referral,["ldaps://ids.net)/(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"]}} in rabbit_auth_backend_ldap:object_exists/3 line 397 in context child_terminated
  2018-10-17 15:34:24.621 [error] <0.709.0> Ranch listener rabbit_web_dispatch_sup_15672, connection process <0.709.0>, stream 1 had its request process <0.710.0> exit with reason {{{case_clause,{ok,{referral,["ldaps://ids.net)/(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"]}}},[{rabbit_auth_backend_ldap,object_exists,3,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,397}]},{rabbit_auth_backend_ldap,evaluate0,4,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,206}]},{rabbit_auth_backend_ldap,'-do_tag_queries/5-lc$^0/1-0-',6,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,708}]},{rabbit_auth_backend_ldap,do_tag_queries,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,706}]},{rabbit_auth_backend_ldap,call_ldap_fun,3,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,542}]},{rabbit_auth_backend_ldap,with_login,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,499}]},{rabbit_auth_backend_ldap,'-with_ldap/3-fun-14-',4,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,469}]},{rabbit_auth_backend_ldap,do_login,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,698}]}]},{gen_server2,call,[<0.376.0>,{submit,#Fun,<0.710.0>,reuse},infinity]}} and stacktrace [{gen_server2,call,3,[{file,"src/gen_server2.erl"},{line,329}]},{rabbit_auth_backend_ldap,user_login_authentication,2,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,80}]},{rabbit_access_control,try_authenticate,3,[{file,"src/rabbit_access_control.erl"},{line,90}]},{rabbit_access_control,'-check_user_login/2-fun-4-',4,[{file,"src/rabbit_access_control.erl"},{line,75}]},{lists,foldl,3,[{file,"lists.erl"},{line,1263}]},{rabbit_mgmt_util,is_authorized,6,[{file,"src/rabbit_mgmt_util.erl"},{line,191}]},{cowboy_rest,call,3,[{file,"src/cowboy_rest.erl"},{line,1182}]},{cowboy_rest,is_authorized,2,[{file,"src/cowboy_rest.erl"},{line,346}]}]
  ```

Apparently, i have some misconfiguration, but i can't figure out, what's wrong...

Any help is really appriciated

regards
/D

[Docjones]

Oh, and i found another snipped in the crash.log:

2018-10-17 15:34:24 =SUPERVISOR REPORT====
     Supervisor: {local,ldap_pool_sup}
     Context:    child_terminated
     Reason:     {{case_clause,{ok,{referral,["ldaps://ids.net)/(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"]}}},[{rabbit_auth_backend_ldap,object_exists,3,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,397}]},{rabbit_auth_backend_ldap,evaluate0,4,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,206}]},{rabbit_auth_backend_ldap,'-do_tag_queries/5-lc$^0/1-0-',6,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,708}]},{rabbit_auth_backend_ldap,do_tag_queries,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,706}]},{rabbit_auth_backend_ldap,call_ldap_fun,3,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,542}]},{rabbit_auth_backend_ldap,with_login,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,499}]},{rabbit_auth_backend_ldap,'-with_ldap/3-fun-14-',4,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,469}]},{rabbit_auth_backend_ldap,do_login,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,698}]}]}
     Offender:   [{pid,<0.376.0>},{id,1},{mfargs,{worker_pool_worker,start_link,[ldap_pool]}},{restart_type,transient},{shutdown,4294967295},{child_type,worker}]

2018-10-17 15:34:24 =ERROR REPORT====
Ranch listener rabbit_web_dispatch_sup_15672, connection process <0.709.0>, stream 1 had its request process <0.710.0> exit with reason {{{case_clause,{ok,{referral,["ldaps://ids.net)/(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)"]}}},[{rabbit_auth_backend_ldap,object_exists,3,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,397}]},{rabbit_auth_backend_ldap,evaluate0,4,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,206}]},{rabbit_auth_backend_ldap,'-do_tag_queries/5-lc$^0/1-0-',6,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,708}]},{rabbit_auth_backend_ldap,do_tag_queries,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,706}]},{rabbit_auth_backend_ldap,call_ldap_fun,3,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,542}]},{rabbit_auth_backend_ldap,with_login,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,499}]},{rabbit_auth_backend_ldap,'-with_ldap/3-fun-14-',4,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,469}]},{rabbit_auth_backend_ldap,do_login,5,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,698}]}]},{gen_server2,call,[<0.376.0>,{submit,#Fun<rabbit_auth_backend_ldap.18.129106872>,<0.710.0>,reuse},infinity]}} and stacktrace [{gen_server2,call,3,[{file,"src/gen_server2.erl"},{line,329}]},{rabbit_auth_backend_ldap,user_login_authentication,2,[{file,"src/rabbit_auth_backend_ldap.erl"},{line,80}]},{rabbit_access_control,try_authenticate,3,[{file,"src/rabbit_access_control.erl"},{line,90}]},{rabbit_access_control,'-check_user_login/2-fun-4-',4,[{file,"src/rabbit_access_control.erl"},{line,75}]},{lists,foldl,3,[{file,"lists.erl"},{line,1263}]},{rabbit_mgmt_util,is_authorized,6,[{file,"src/rabbit_mgmt_util.erl"},{line,191}]},{cowboy_rest,call,3,[{file,"src/cowboy_rest.erl"},{line,1182}]},{cowboy_rest,is_authorized,2,[{file,"src/cowboy_rest.erl"},{line,346}]}]

[lukebakken]

Hello, thanks for reporting this. Please see https://github.com/rabbitmq/rabbitmq-auth-backend-ldap/issues/97 as that is the repository where this issue will be tracked and fixed.

[lukebakken]

@Docjones - Your LDAP server is returning a referral to another server for that user (docs). We may be able to take these referrals into account in a future version of RabbitMQ, but for the time being you need to configure your LDAP server to not do this, or ensure the user being authenticated does not return a referral as the result of a simple bind.

[Docjones]

@lukebakken - Thanks a lot for the swift answer - just a question: does that mean, the config is basically ok? I will go and reqest my AD admin to have a look at that.

[lukebakken]

I'm pretty sure your RabbitMQ configuration is OK, it's just what the server is returning. I recommend using a tool like ldapsearch (part of OpenLDAP) or ldp.exe (on Windows) to see what happens when you try to do the same search as what is done here:

search request = {'SearchRequest',"(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)",baseObject,derefAlways,0,0,false,{equalityMatch,{'AttributeValueAssertion',"member","CN=Marc Rink,OU=User,OU=Kleinostheim,DC=ids,DC=net"}},["objectClass"]}

The search is, basically, does the member attribute of this group:

(CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net)

contain the following DN:

CN=SW_Entwicklung,OU=Gruppen,OU=Kleinostheim,DC=ids,DC=net

The result of that search is returning the referral.