LDAP-Proxy stopped working

AAuer · June 29, 2020, 3:56pm

Hi,
my LDAP-Proxy stopped working.
First I found out that ignore-search-result-references has to be set to true. That worked for months set to false.

After setting to true, I get this Error:

SubscriptionError('No subscription for your client

I thought, PI is free of charge? Is this because we have more than 50 token active?

cornelinux · June 30, 2020, 5:40am

This Error tells you, that you are using the LDAP Proxy and have more than 50 users with active tokens in your system, which would require a subscription for the LDAP proxy.

Open Source does not mean, that everything works out of the box. Or that everything works. Or that everything is free of charge. Open Source and Costs have nothing to do with each other.
Software is never Free Of Charge. It requires the time of the developers, of you or of your IT employees.
Some peolple claim, that Open Source is even more expensive than proprietary software. I would not say this, but I personally am very happy to pay for certain Open Source software. I am using Open Source due to the vast possibilities and flexibilities. Not only due to costs. Think about why you are using Open Source! Think about why you are using privacyIDEA! Have you read this?

privacyIDEA Server is Open Source. It does not require any subscription.

The privacyIDEA LDAP Proxy is Open Source. But for more than 50 users, you need a subscription.
If you know someone who can create a subscription, you can put whatever meaning you want to into this subscription. (The company I work with puts the meaning of “hey we provide support for you” into this subscription).

AAuer · June 30, 2020, 6:15am

Hi Cornelius,
the problem is, that it is nowhere mentioned, that above 50 tokens the subscription is required.
The proxy stopped working because of ignore-search-result-references. After setting this to true the SubscriptionEror occured.
A little note in the readme should be set, just to avoid out of service times.

We surely will buy the enterprise version, your software is great!

Ngo_Anh_Tuan · May 11, 2021, 4:32am

Hi @AAuer ,

Can you share me the location of " ignore-search-result-references" that you changed from false to true and vice versa?

I just changed “ignore-search-result-references” in config.ini but not affect.

Thanks,
Tuan Ngo

cornelinux · May 13, 2021, 9:06am

Hello @Ngo_Anh_Tuan and welcome to privacyIDEA.

You find it here:

github.com

privacyidea/privacyidea-ldap-proxy/blob/master/example-proxy.ini#L61


# If this is set to `true`, the LDAP proxy will forward search requests to the LDAP backend.
# Mostly useful in conjunction with `bind-service-account`: If both are set to `true`, applications
# may issue search operations after a successful user authentiation.
# If `bind-service-account` is set to false, but `allow-search` is set to true, only the DNs
# in `passthrough-binds` will be able to issue search requests.
allow-search = false
# By default, the LDAP proxy only allows one bind request per connection. For some apps, this may
# be sufficient. However, other apps may reuse a LDAP connection and thus require setting this
# configuration option.
allow-connection-reuse = false
# Currently, ldaptor does not support SEARCH result references which will break
# some apps in combination with AD. This option provides a workaround:
# If it is set to `true`, the LDAP proxy ignores all LDAP SEARCH result references.
# The LDAP Proxy does not send any LDAP SEARCH result references to the application.
ignore-search-result-references = false
# By default, the LDAP Proxy rejects anonymous binds. With the following option, it can be configured
# to forward anonymous binds to the LDAP backend.
forward-anonymous-binds = false

[user-mapping]
# This setting determines the strategy the LDAP proxy uses to determine the username that is sent to privacyIDEA

Ngo_Anh_Tuan · May 13, 2021, 9:35am

Hi,

Thanks for your reply. I think, I changed correct file.

Running

ldap-proxy can be run in the foreground as follows:

twistd -n ldap-proxy -c config.ini

Note: After searching in the forum and read more documents, I fixed all problems and hope that the services will work well, thanks much.

Thanks,
Tuan Ngo