Inedo Community Forums Forums
    • Recent
    • Tags
    • Popular
    • Login

    Welcome to the Inedo Forums! Check out the Forums Guide for help getting started.

    If you are experiencing any issues with the forum software, please visit the Contact Form on our website and let us know!

    Connection issues when configuring LDAP on Linux container

    Scheduled Pinned Locked Moved Support
    36 Posts 3 Posters 95 Views 1 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K Offline
      kichikawa_2913 @rhessinger
      last edited by

      @rhessinger I updated the extension and tried again; same error on the test page, nothing in the Diagnostic Center, and nothing telling in the container logs.

      Openssl commands do work over the port we use.

      1 Reply Last reply Reply Quote 0
      • rhessingerR Offline
        rhessinger inedo-engineer
        last edited by

        Hi @kichikawa_2913,

        I think I have identified the issue. I have just pushed another version of InedoCore, version 1.10.7-CI.2 . Could you update and give that a try? I also added an option to bypass the LDAPS certificate verification. It is something that I would only use while testing. The solution you have with adding your certificates as valid certs is a more secure solution. One last thing to make sure you set is the Domain Controller Host. It can just be set to your domain (ex: domain.network using your steps from above). Linux/Docker does not seem to translate domain URLs the same way windows does.

        Thanks,
        Rich

        Products Engineer, Inedo

        K 1 Reply Last reply Reply Quote 1
        • K Offline
          kichikawa_2913 @rhessinger
          last edited by

          @rhessinger I updated the extension and had to stop/start the container. After those steps the test search using LDAPS worked. I did not use the bypass certificate validation option.

          I'm having issues with switching to LDAP though; I go to Administration -> under Security and Authentication -> click Change User Directory (LDAP) -> enter credentials for AD account added under Administration -> User & Tasks -> Tasks, but when I click the switch button nothing happens. I repeat the steps one or two more times and then the button switches to "Switch to Built-In". I then tried to stop/start the container and it will no longer start up, here are the logs:

          2021-05-15T12:39:28.725672513-04:00 ProGet version is 5.3.28.16.
2021-05-15T12:39:29.217760650-04:00 Current DB schema version is 5.3.28.16.
2021-05-15T12:39:29.226261354-04:00 Starting the messenger...
2021-05-15T12:39:29.233061637-04:00 Messenger endpoint is tcp://localhost:1000
2021-05-15T12:39:29.242384666-04:00 Reading standard license list...
2021-05-15T12:39:29.244161259-04:00 Importing license list into database...
2021-05-15T12:39:29.647671816-04:00 License import complete.
2021-05-15T12:39:29.667862845-04:00 Looking for web app at: /usr/local/proget/web
2021-05-15T12:39:29.681658506-04:00 Initializing Scheduled Job Dispatcher...
2021-05-15T12:39:29.682192589-04:00 Scheduled Job Dispatcher initialized.
2021-05-15T12:39:29.683068656-04:00 Running Scheduled Job Dispatcher...
2021-05-15T12:39:29.695739484-04:00 Checking for scheduled jobs...
2021-05-15T12:39:29.731570206-04:00 Ensuring that all required scheduled jobs are configured...
2021-05-15T12:39:29.894296932-04:00 Scheduled job configuration is correct.
2021-05-15T12:39:30.063317953-04:00 Scheduled Job Dispatcher completed.
2021-05-15T12:39:30.070237930-04:00 info: Microsoft.Hosting.Lifetime[0]
2021-05-15T12:39:30.070237930-04:00       Now listening on: http://[::]:80
2021-05-15T12:39:30.070977279-04:00 info: Microsoft.Hosting.Lifetime[0]
2021-05-15T12:39:30.070977279-04:00       Application started. Press Ctrl+C to shut down.
2021-05-15T12:39:30.070977279-04:00 info: Microsoft.Hosting.Lifetime[0]
2021-05-15T12:39:30.070977279-04:00       Hosting environment: Production
2021-05-15T12:39:30.070977279-04:00 info: Microsoft.Hosting.Lifetime[0]
2021-05-15T12:39:30.070977279-04:00       Content root path: /usr/local/proget
2021-05-15T12:39:32.035847819-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
2021-05-15T12:39:32.035847819-04:00       Request starting HTTP/1.1 GET http://proget.domain.network/ - -
2021-05-15T12:39:32.165785282-04:00 Initializing extensions in /var/proget/extensions...
2021-05-15T12:39:32.210224781-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
2021-05-15T12:39:32.210224781-04:00       Request starting HTTP/1.1 POST http://proget.domain.network/0x44/ProGet.WebApplication/Inedo.ProGet.WebApplication.Controls.Layout.NotificationBar/GetNotifications - 0
2021-05-15T12:39:32.308008757-04:00 Loading AWS extension from /tmp/Inedo/ExtensionCache/37543bedc11b0a94f5a597f2b9f968d2bb2cdcfe/package/net5.0/AWS.dll...
2021-05-15T12:39:32.314608137-04:00 Loading Azure extension from /tmp/Inedo/ExtensionCache/dd663c6c8c191f7b29bfd3b150e0ae51572cc0ba/package/net5.0/Azure.dll...
2021-05-15T12:39:32.318849973-04:00 Loading InedoCore extension from /tmp/Inedo/ExtensionCache/6499179f3ce87cb1c7d2dcadf74fcdbd2023f037/package/net5.0/InedoCore.dll...
2021-05-15T12:39:32.334907387-04:00 Loading Clair extension from /tmp/Inedo/ExtensionCache/2aaf77763c2739acb513738b819f60b190ab5d7f/package/net5.0/Clair.dll...
2021-05-15T12:39:32.337484374-04:00 Loading Sonatype extension from /tmp/Inedo/ExtensionCache/4bf4786f6ff2af66d3de185f9ccf150feaef6690/package/net5.0/Sonatype.dll...
2021-05-15T12:39:32.339735147-04:00 Extensions manager initialization complete.
2021-05-15T12:39:32.677513583-04:00 Configuring web proxy...
2021-05-15T12:39:32.677765044-04:00 Using custom web proxy settings.
2021-05-15T12:39:33.058825925-04:00 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2021-05-15T12:39:33.058825925-04:00       Connection id "0HM8NO02145PI", Request id "0HM8NO02145PI:00000002": An unhandled exception was thrown by the application.
2021-05-15T12:39:33.058825925-04:00       Inedo.ProGet.Web.Security.UserNotFoundException: Exception of type 'Inedo.ProGet.Web.Security.UserNotFoundException' was thrown.
2021-05-15T12:39:33.058825925-04:00          at Inedo.ProGet.WebApplication.ProGetHttpModule.AuthorizeRequestAsync(HttpApplication app) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E130753\Src\ProGet.WebApplication\ProGetHttpModule.cs:line 351
2021-05-15T12:39:33.058825925-04:00          at Inedo.Web.InedoHttpModule.Inedo.Web.IAhWebModule.AuthorizeRequestAsync(HttpApplication app)
2021-05-15T12:39:33.058825925-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:33.058825925-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:33.058825925-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:33.058825925-04:00          at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
2021-05-15T12:39:33.058825925-04:00 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2021-05-15T12:39:33.058825925-04:00       Connection id "0HM8NO02145PJ", Request id "0HM8NO02145PJ:00000002": An unhandled exception was thrown by the application.
2021-05-15T12:39:33.058825925-04:00       Inedo.ProGet.Web.Security.UserNotFoundException: Exception of type 'Inedo.ProGet.Web.Security.UserNotFoundException' was thrown.
2021-05-15T12:39:33.058825925-04:00          at Inedo.ProGet.WebApplication.ProGetHttpModule.AuthorizeRequestAsync(HttpApplication app) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E130753\Src\ProGet.WebApplication\ProGetHttpModule.cs:line 351
2021-05-15T12:39:33.058825925-04:00          at Inedo.Web.InedoHttpModule.Inedo.Web.IAhWebModule.AuthorizeRequestAsync(HttpApplication app)
2021-05-15T12:39:33.058825925-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:33.058825925-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:33.058825925-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:33.058825925-04:00          at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
2021-05-15T12:39:33.064489818-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
2021-05-15T12:39:33.064489818-04:00       Request finished HTTP/1.1 GET http://proget.domain.network/ - - - 500 0 - 1032.2865ms
2021-05-15T12:39:33.064489818-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
2021-05-15T12:39:33.064489818-04:00       Request finished HTTP/1.1 POST http://proget.domain.network/0x44/ProGet.WebApplication/Inedo.ProGet.WebApplication.Controls.Layout.NotificationBar/GetNotifications - 0 - 500 0 - 853.9542ms
2021-05-15T12:39:33.674215099-04:00 Initializing Proxy Configuration Monitor...
2021-05-15T12:39:33.674346204-04:00 Proxy Configuration Monitor initialized.
2021-05-15T12:39:33.674432888-04:00 Running Proxy Configuration Monitor...
2021-05-15T12:39:33.675695760-04:00 Proxy Configuration Monitor completed.
2021-05-15T12:39:36.494675143-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
2021-05-15T12:39:36.494675143-04:00       Request starting HTTP/1.1 GET http://proget.domain.network/ - -
2021-05-15T12:39:36.534387936-04:00 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2021-05-15T12:39:36.534387936-04:00       Connection id "0HM8NO02145PI", Request id "0HM8NO02145PI:00000003": An unhandled exception was thrown by the application.
2021-05-15T12:39:36.534387936-04:00       Inedo.ProGet.Web.Security.UserNotFoundException: Exception of type 'Inedo.ProGet.Web.Security.UserNotFoundException' was thrown.
2021-05-15T12:39:36.534387936-04:00          at Inedo.ProGet.WebApplication.ProGetHttpModule.AuthorizeRequestAsync(HttpApplication app) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E130753\Src\ProGet.WebApplication\ProGetHttpModule.cs:line 351
2021-05-15T12:39:36.534387936-04:00          at Inedo.Web.InedoHttpModule.Inedo.Web.IAhWebModule.AuthorizeRequestAsync(HttpApplication app)
2021-05-15T12:39:36.534387936-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:36.534387936-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:36.534387936-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:36.534387936-04:00          at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
2021-05-15T12:39:36.535779899-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
2021-05-15T12:39:36.535779899-04:00       Request finished HTTP/1.1 GET http://proget.domain.network/ - - - 500 0 - 41.2354ms
2021-05-15T12:39:37.279959202-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
2021-05-15T12:39:37.279959202-04:00       Request starting HTTP/1.1 GET http://proget.domain.network/ - -
2021-05-15T12:39:37.317056142-04:00 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2021-05-15T12:39:37.317056142-04:00       Connection id "0HM8NO02145PI", Request id "0HM8NO02145PI:00000004": An unhandled exception was thrown by the application.
2021-05-15T12:39:37.317056142-04:00       Inedo.ProGet.Web.Security.UserNotFoundException: Exception of type 'Inedo.ProGet.Web.Security.UserNotFoundException' was thrown.
2021-05-15T12:39:37.317056142-04:00          at Inedo.ProGet.WebApplication.ProGetHttpModule.AuthorizeRequestAsync(HttpApplication app) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E130753\Src\ProGet.WebApplication\ProGetHttpModule.cs:line 351
2021-05-15T12:39:37.317056142-04:00          at Inedo.Web.InedoHttpModule.Inedo.Web.IAhWebModule.AuthorizeRequestAsync(HttpApplication app)
2021-05-15T12:39:37.317056142-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:37.317056142-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:37.317056142-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:37.317056142-04:00          at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
2021-05-15T12:39:37.317177003-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
2021-05-15T12:39:37.317177003-04:00       Request finished HTTP/1.1 GET http://proget.domain.network/ - - - 500 0 - 37.5215ms
2021-05-15T12:39:37.674334797-04:00 Initializing Execution Dispatcher...
2021-05-15T12:39:37.675068562-04:00 Checking for orphaned executions...
2021-05-15T12:39:37.679198274-04:00 Execution Dispatcher initialized.
2021-05-15T12:39:37.679268981-04:00 Running Execution Dispatcher...
2021-05-15T12:39:37.705928199-04:00 Checking for executions to dispatch...
2021-05-15T12:39:37.713542381-04:00 Execution Dispatcher completed.
2021-05-15T12:39:38.190999760-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
2021-05-15T12:39:38.190999760-04:00       Request starting HTTP/1.1 GET http://proget.domain.network/ - -
2021-05-15T12:39:38.227968562-04:00 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2021-05-15T12:39:38.227968562-04:00       Connection id "0HM8NO02145PI", Request id "0HM8NO02145PI:00000005": An unhandled exception was thrown by the application.
2021-05-15T12:39:38.227968562-04:00       Inedo.ProGet.Web.Security.UserNotFoundException: Exception of type 'Inedo.ProGet.Web.Security.UserNotFoundException' was thrown.
2021-05-15T12:39:38.227968562-04:00          at Inedo.ProGet.WebApplication.ProGetHttpModule.AuthorizeRequestAsync(HttpApplication app) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E130753\Src\ProGet.WebApplication\ProGetHttpModule.cs:line 351
2021-05-15T12:39:38.227968562-04:00          at Inedo.Web.InedoHttpModule.Inedo.Web.IAhWebModule.AuthorizeRequestAsync(HttpApplication app)
2021-05-15T12:39:38.227968562-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:38.227968562-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:38.227968562-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:38.227968562-04:00          at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
2021-05-15T12:39:38.228269535-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
2021-05-15T12:39:38.228269535-04:00       Request finished HTTP/1.1 GET http://proget.domain.network/ - - - 500 0 - 37.3348ms
2021-05-15T12:39:38.920950517-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
2021-05-15T12:39:38.920950517-04:00       Request starting HTTP/1.1 GET http://proget.domain.network/ - -
2021-05-15T12:39:38.957422036-04:00 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2021-05-15T12:39:38.957422036-04:00       Connection id "0HM8NO02145PI", Request id "0HM8NO02145PI:00000006": An unhandled exception was thrown by the application.
2021-05-15T12:39:38.957422036-04:00       Inedo.ProGet.Web.Security.UserNotFoundException: Exception of type 'Inedo.ProGet.Web.Security.UserNotFoundException' was thrown.
2021-05-15T12:39:38.957422036-04:00          at Inedo.ProGet.WebApplication.ProGetHttpModule.AuthorizeRequestAsync(HttpApplication app) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E130753\Src\ProGet.WebApplication\ProGetHttpModule.cs:line 351
2021-05-15T12:39:38.957422036-04:00          at Inedo.Web.InedoHttpModule.Inedo.Web.IAhWebModule.AuthorizeRequestAsync(HttpApplication app)
2021-05-15T12:39:38.957422036-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:38.957422036-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:38.957422036-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:38.957422036-04:00          at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
2021-05-15T12:39:38.957649105-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
2021-05-15T12:39:38.957649105-04:00       Request finished HTTP/1.1 GET http://proget.domain.network/ - - - 500 0 - 36.7255ms
2021-05-15T12:39:39.678776146-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
2021-05-15T12:39:39.678776146-04:00       Request starting HTTP/1.1 GET http://proget.domain.network/ - -
2021-05-15T12:39:39.715928593-04:00 fail: Microsoft.AspNetCore.Server.Kestrel[13]
2021-05-15T12:39:39.715928593-04:00       Connection id "0HM8NO02145PI", Request id "0HM8NO02145PI:00000007": An unhandled exception was thrown by the application.
2021-05-15T12:39:39.715928593-04:00       Inedo.ProGet.Web.Security.UserNotFoundException: Exception of type 'Inedo.ProGet.Web.Security.UserNotFoundException' was thrown.
2021-05-15T12:39:39.715928593-04:00          at Inedo.ProGet.WebApplication.ProGetHttpModule.AuthorizeRequestAsync(HttpApplication app) in C:\Users\builds\AppData\Local\Temp\InedoAgent\BuildMaster\192.168.44.60\Temp\_E130753\Src\ProGet.WebApplication\ProGetHttpModule.cs:line 351
2021-05-15T12:39:39.715928593-04:00          at Inedo.Web.InedoHttpModule.Inedo.Web.IAhWebModule.AuthorizeRequestAsync(HttpApplication app)
2021-05-15T12:39:39.715928593-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:39.715928593-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:39.715928593-04:00          at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)
2021-05-15T12:39:39.715928593-04:00          at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
2021-05-15T12:39:39.716044421-04:00 info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
2021-05-15T12:39:39.716044421-04:00       Request finished HTTP/1.1 GET http://proget.domain.network/ - - - 500 0 - 37.4269ms

          Seems like there are other portions of the site that aren't using the new functionality?

          1 Reply Last reply Reply Quote 0
          • rhessingerR Offline
            rhessinger inedo-engineer
            last edited by

            Hi @kichikawa_2913,

            I'm going to attempt to recreate your error on my system as well and see if I can find this issue. LDAPS on Docker has not been a popular option with our customers so far due to the complexity in managing the AD certificates. I really appreciate your patience in working through this with us.

            While I try to recreate this, could you try using an incognito browser and see if you are able to load and login? Also, can you try to restart your container again? Also, can you please verify the LDAPS connection is still working with the openssl command again?

            Thanks,
            Rich

            Products Engineer, Inedo

            K 2 Replies Last reply Reply Quote 1
            • K Offline
              kichikawa_2913 @rhessinger
              last edited by kichikawa_2913

              @rhessinger I stopped/started the container again and was able to log in using an AD account from a private browser session and a normal browser session. I ran a shell in the container and ran the openssl commands again without issues.

              1 Reply Last reply Reply Quote 0
              • K Offline
                kichikawa_2913 @rhessinger
                last edited by

                @rhessinger we are at the point of having other users log in to ProGet to test, we are seeing the following messages for users who are part of an AD group that have every Task permission for any feed on their first log in attempt.

                 Logged: 05/17/2021 15:13:35
 Level: Error
 Category: Web
 Message: An error occurred in the web application: Anti-CSRF validation failed because of user mismatch.
 Details: URL: http://proget.domain.network/log-in?ReturnUrl=%2F
Referrer: http://proget.domain.network/log-in?ReturnUrl=%2F
User: user@domain.network
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
Stack trace: at Inedo.Web.Security.AntiCsrfContext.Validate(HttpContext context)
at Inedo.Web.PageFree.SimplePageBase.ValidatePostBackAsync()
at Inedo.Web.PageFree.SimplePageBase.ExecutePageLifeCycleAsync()
at Inedo.Web.PageFree.SimplePageBase.ProcessRequestAsync(HttpContext context)
at Inedo.Web.AhWebMiddleware.InvokeAsync(HttpContext context)

                This was using normal browser instance, not private session. After their first attempt to log in they try again and it takes about 2 or so minutes for them to finally get in authenticated as their AD user.

                1 Reply Last reply Reply Quote 0
                • rhessingerR Offline
                  rhessinger inedo-engineer
                  last edited by

                  Hi @kichikawa_2913,

                  Thanks for the information and I'm glad you can log in now. Let me dig in and see what I can find on these Anti-CSRF errors. Normally these happen because a reverse proxy is not properly forwarding headers. Do you have a reverse proxy (like Nginx or apache) sitting in front of this container? Also, do you know if once they get logged in if ProGet seems to run fine, or does each page request take a while to load?

                  Would you be willing to test this without LDAPS so we can see if it is an LDAPS issue or not?

                  Thanks,
                  Rich

                  Products Engineer, Inedo

                  K 1 Reply Last reply Reply Quote 0
                  • K Offline
                    kichikawa_2913 @rhessinger
                    last edited by

                    @rhessinger we currently do not have any proxy in front of the container, we will eventually have HAProxy.

                    I had another user attempt to log in and it was instant. They also said that after the slow initial log in they were able to browse through the menus just fine.

                    Do you want me to destroy the environment and set it up again to test without LDAPS?

                    1 Reply Last reply Reply Quote 0
                    • rhessingerR Offline
                      rhessinger inedo-engineer
                      last edited by

                      Hi @kichikawa_2913,

                      You should just be able to remove the custom port and uncheck LDAPS then restart your container and that should remove LDAPS from your AD instance.

                      Thanks,
                      Rich

                      Products Engineer, Inedo

                      K 1 Reply Last reply Reply Quote 0
                      • K Offline
                        kichikawa_2913 @rhessinger
                        last edited by

                        @rhessinger disabled LDAPS per your instruction, all users testing were able to log in and navigate around without issues.

                        Re-enabled LDAPS using the same steps, but setting them instead of removing them, users also did not see any issues.

                        1 Reply Last reply Reply Quote 0
                        • rhessingerR Offline
                          rhessinger inedo-engineer
                          last edited by

                          Hi @kichikawa_2913,

                          Did those users still experience the long initial login? Or did that go away?

                          Thanks,
                          Rich

                          Products Engineer, Inedo

                          K 2 Replies Last reply Reply Quote 0
                          • K Offline
                            kichikawa_2913 @rhessinger
                            last edited by

                            @rhessinger The long initial login only happened once, they have not had it since. I even had another user who never logged in attempt with LDAPS enabled again, he received the 403 message on initial attempt but was able to get in on second attempt. Neither one of his attempts were slow.

                            atrippA 1 Reply Last reply Reply Quote 0
                            • atrippA Offline
                              atripp inedo-engineer @kichikawa_2913
                              last edited by

                              @kichikawa_2913 we've reviewed this a bit more as a team, and believe that there are a few things to consider here.

                              At first, it's clear you have a large, "older" Active Directory. There is a tremendous amount of customization one can do to Active Directory, and do enough of them over the years, and you end up with a "older" directory that has layer of layer of compatibility shims. You should see the crazy hacks they had to implement to get MSA accounts working...

                              It's important to note here is the fact that Microsoft Active Directory and .NET (Core) do not play nicely together. It took Microsoft over 10 years to get .NET Framework to work with Active Directory, and it's still really quirky. We've worked-around as many of the bugs as we can.

                              Microsoft is still trying to get .NET Core on Linux to work properly with Active Directory, but it's got a very long way to go as you're seeing. There are so many strange behaviors we've already had to work-around (like methods sometimes returning strings, sometimes returning byte arrays) -- and these behaviors will just come with new versions of their library.

                              For all we know, the crazy "2 or so minutes" to do a login query could be a parsing error in their library? Or something timing out in their network code, but not logging an error? We saw all that in .NET Framework. In any case, we can only guess because their library provides no diagnostic information for us to use.

                              At this point, you should open a support ticket to Microsoft. This is the only way we can see how to identify why you have a "2 minute or so" delay to run a basic login query.

                              The code we have is really, really simple. It follows all of Microsoft's guidelines, and it'd be super-simple for you to reproduce the exact problems for them to show them. They have some advanced monitoring tools that can detect exactly what crazy stuff is happening between the query and Active Directory.

                              We can't do this, because we don't have access to your directory. It's unique to your setup and
                              configuration, somehow.

                              Alternatively, just use Windows instead. It will be significantly cheaper in the long-run (I suspect we've already burned through a lifetime's worth of licensing fees diagnosing this problem). Microsoft is still years away from even having the support infrastructure to help their customers with Linux problems, so any time there's a slight problem on Microsoft's end (SQL Server, .NET Core) , it will be "DIY" -- which really means, spend a lot of your time fixing quirks on their software.

                              K 1 Reply Last reply Reply Quote 0
                              • K Offline
                                kichikawa_2913 @atripp
                                last edited by

                                @atripp I'm okay with the problem shifting over to Microsoft, I was just happy to help with anything that can be resolved on your end. Ultimately, we want to use SAML, but because that's only available to use with an actual Enterprise license I needed another way to get a feel on how administering permissions felt with ProGet.

                                I appreciate the time put into this and I'm glad I could help resolve some issues. @rhessinger has been super responsive and great to work with, thank you!

                                1 Reply Last reply Reply Quote 0
                                • K Offline
                                  kichikawa_2913 @rhessinger
                                  last edited by

                                  @rhessinger do you have an ETA on an actual release for the LDAP fixes?

                                  1 Reply Last reply Reply Quote 0
                                  • rhessingerR Offline
                                    rhessinger inedo-engineer
                                    last edited by

                                    Hi @kichikawa_2913,

                                    I just released this extension to production now. Please let me know if you don't see an official release.

                                    Thanks,
                                    Rich

                                    Products Engineer, Inedo

                                    K 1 Reply Last reply Reply Quote 1
                                    • K Offline
                                      kichikawa_2913 @rhessinger
                                      last edited by

                                      @rhessinger Looks like version 1.10.7 is the new version correct?

                                      1 Reply Last reply Reply Quote 0
                                      • rhessingerR Offline
                                        rhessinger inedo-engineer
                                        last edited by

                                        Hi @kichikawa_2913,

                                        I'm sorry for not including that in my previous comment. You are correct 1.10.7 is the new version of the InedoCore extension that includes these fixes for LDAP and LDAPS on Docker.

                                        Thanks,
                                        Rich

                                        Products Engineer, Inedo

                                        K 1 Reply Last reply Reply Quote 1
                                        • K Offline
                                          kichikawa_2913 @rhessinger
                                          last edited by

                                          @rhessinger we upgraded to the most recent version of ProGet using the Docker image by following these steps:

                                          1. Pull new image.
                                          2. Stop current container.
                                          3. Create new container using new image with a new name.
                                          4. Make sure CA certs are present in the container and made sure OS identifies them.
                                          5. Load ProGet web UI.
                                          6. Attempt to log in, getting incorrect credentials error.
                                          7. Attempt to log in with an admin user we manually created in the Built-In directory, same error.

                                          To resolve this; I had to bring back the old container, log in using AD, switch to Built-In directory for auth, stop old container, start new version container, log in with admin account under Built-In directory, go to Administration, update the InedoCore extension to most recent, and enable LDAP directory.

                                          Doesn't seem like ProGet reaches out for most recent extensions or the default installed version of the InedoCore extension should be 1.10.7. We shouldn't have this issue going forward, but I can see this being an issue later if an extension resolves issues that provide a major functionality.

                                          Another solution I guess that could work would be to manually download all extensions, put them in a directory on the host, and mount a volume that maps to the default extensions directory. I didn't try this out though.

                                          1 Reply Last reply Reply Quote 0
                                          • rhessingerR Offline
                                            rhessinger inedo-engineer
                                            last edited by

                                            Hi @kichikawa_2913,

                                            Sorry, this is actually expected. When we release our products, they include the extensions that were released at the time of the product release. In this case, I released this version of InedoCore after we did the product release.

                                            If you look at our documentation for upgrading your docker image, the command includes --volumes-from=proget-old. This will auto migrate the previous volumes created from the previous version of ProGet and that will keep the updated extension (as long as the previous extensions is newer than the included extension version).

                                            Also, in Administration -> Advanced Settings, you can change Extensions.ExtensionsPath to a mapped path and that will also do the same thing (if the version in this directory is newer than the included) and give you easier access to the extension files.

                                            Thanks,
                                            Rich

                                            Products Engineer, Inedo

                                            1 Reply Last reply Reply Quote 1

                                            Hello! It looks like you're interested in this conversation, but you don't have an account yet.

                                            Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.

                                            With your input, this post could be even better 💗

                                            Register Login
                                            • 1
                                            • 2
                                            • 2 / 2
                                            • First post
                                              Last post
                                            Inedo Website Home • Support Home • Code of Conduct • Forums Guide • Documentation