Get OpenLDAP running with Mealie

[saschabrockel]

I'm very happy with Mealie but I would like to create some kind of cooking knowledge database with Mealie and for that they need access and I'm not able to establish a connection to my OpenLDAP server. I have done it for several services but here I'm not able to fix my config.

My config:

LDAP_AUTH_ENABLED=true
LDAP_SERVER_URL=ldap://192.168.178.29
LDAP_TLS_INSECURE=false
LDAP_TLS_CACERTFILE=null
LDAP_ENABLE_STARTTLS=false
LDAP_BASE_DN=dc=domain,dc=de
LDAP_QUERY_BIND=null
LDAP_QUERY_PASSWORD=null
# I tried a query bind because I don't have anonymous access but this didn't help
#LDAP_QUERY_BIND=cn=admin,dc=domain,dc=de
#LDAP_QUERY_PASSWORD=ABC1234
LDAP_USER_FILTER=(&(|(objectclass=inetOrgPerson)))
LDAP_ADMIN_FILTER=(memberOf=cn=admin,dc=sascha-brockel,dc=de)
LDAP_ID_ATTRIBUTE=uid
LDAP_MAIL_ATTRIBUTE=mail
LDAP_NAME_ATTRIBUTE=cn

I will just see this error log in the Docker container:

INFO:     127.0.0.1:52642 - "POST /api/auth/token HTTP/1.1" 500 Internal Server Error
ERROR:    Exception in ASGI application
Traceback (most recent call last):
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/uvicorn/protocols/http/httptools_impl.py", line 436, in run_asgi
    result = await app(  # type: ignore[func-returns-value]
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/uvicorn/middleware/proxy_headers.py", line 78, in __call__
    return await self.app(scope, receive, send)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/fastapi/applications.py", line 276, in __call__
    await super().__call__(scope, receive, send)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/applications.py", line 122, in __call__
    await self.middleware_stack(scope, receive, send)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/middleware/errors.py", line 184, in __call__
    raise exc
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/middleware/errors.py", line 162, in __call__
    await self.app(scope, receive, _send)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/middleware/gzip.py", line 24, in __call__
    await responder(scope, receive, send)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/middleware/gzip.py", line 44, in __call__
    await self.app(scope, receive, self.send_with_gzip)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/middleware/exceptions.py", line 79, in __call__
    raise exc
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/middleware/exceptions.py", line 68, in __call__
    await self.app(scope, receive, sender)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/fastapi/middleware/asyncexitstack.py", line 21, in __call__
    raise e
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/fastapi/middleware/asyncexitstack.py", line 18, in __call__
    await self.app(scope, receive, send)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/routing.py", line 718, in __call__
    await route.handle(scope, receive, send)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/routing.py", line 276, in handle
    await self.app(scope, receive, send)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/routing.py", line 66, in app
    response = await func(request)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/fastapi/routing.py", line 237, in app
    raw_response = await run_endpoint_function(
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/fastapi/routing.py", line 165, in run_endpoint_function
    return await run_in_threadpool(dependant.call, **values)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/starlette/concurrency.py", line 41, in run_in_threadpool
    return await anyio.to_thread.run_sync(func, *args)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/anyio/to_thread.py", line 31, in run_sync
    return await get_asynclib().run_sync_in_worker_thread(
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/anyio/_backends/_asyncio.py", line 937, in run_sync_in_worker_thread
    return await future
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/anyio/_backends/_asyncio.py", line 867, in run
    result = context.run(func, *args)
  File "/app/mealie/routes/auth/auth.py", line 63, in get_token
    user = authenticate_user(session, email, password)  # type: ignore
  File "/app/mealie/core/security/security.py", line 178, in authenticate_user
    return user_from_ldap(db, email, password)
  File "/app/mealie/core/security/security.py", line 68, in user_from_ldap
    conn.set_option(ldap.OPT_X_TLS_NEWCTX, 0)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/ldap/ldapobject.py", line 698, in set_option
    return self._ldap_call(self._l.set_option,option,invalue)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/ldap/ldapobject.py", line 128, in _ldap_call
    result = func(*args,**kwargs)
ValueError: option error

[cmintey]

Do you have ldaps enabled on your OpenLDAP server? If not, then you should set LDAP_TLS_INSECURE=true and just remove the LDAP_TLS_CACERTFILE option instead of setting it null

[saschabrockel]

Okay, you were right. That helped to get an error message at least.

Now I always get the following error:

  File "/app/mealie/core/security/security.py", line 76, in user_from_ldap
    conn.simple_bind_s(settings.LDAP_QUERY_BIND, settings.LDAP_QUERY_PASSWORD)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/ldap/ldapobject.py", line 249, in simple_bind_s
    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/ldap/ldapobject.py", line 543, in result3
    resp_type, resp_data, resp_msgid, decoded_resp_ctrls, retoid, retval = self.result4(
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/ldap/ldapobject.py", line 553, in result4
    ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
  File "/opt/pysetup/.venv/lib/python3.10/site-packages/ldap/ldapobject.py", line 128, in _ldap_call
    result = func(*args,**kwargs)
ldap.INVALID_DN_SYNTAX: {'msgtype': 97, 'msgid': 1, 'result': 34, 'desc': 'Invalid DN syntax', 'ctrls': [], 'info': 'invalid DN'}

Because I see the bind variables here which are set to null currently, is that the reason? Because I literally tried all different DN's.

I'm using LDAP_BASE_DN=ou=users,dc=xyz,dc=de and I think it should be right.

[saschabrockel]

Okay, I can say it was the bind credentials. It works now! Thank you for your help and the hint!