issues with sitedefault.yaml example file

[juergenschroeder]

Hi all,

if I take the yaml default file from

https://github.com/sassoftware/viya-ark/blob/master/playbooks/ldap-validator/sitedefault_sample_openldap.yml

I find two issues.
First: the port is given as a string port: '389', which results in a python error. it should just be a number, port: 389

Second: the last line specifying the administrator
sas.identities:
administrator: 'your_user_id'

results in a validation error using open LDAP for any user specified

2021-11-24 02:33:05,159 - ldap_validator.py[line:273] - DEBUG: LDAP Query: search_base=ou=user,dc=ldap,dc=localdomain, search_filter=(&(objectClass=user)(sAMAccountName
=ldapadm))verify=True
2021-11-24 02:33:05,160 - ldap_validator.py[line:277] - ERROR: LDAP search failed with the following error: invalid class in objectClass attribute: user

looking at the python code in ldap_validator.py at line 200 the search string hard coded to

searchstring = '(&(objectClass=user)(sAMAccountName=' + ldap_defaultadmin_user + '))'**
if (not perform_ldap_query(ldap_logger, ldap_server_host,  ldap_user_basedn, searchstring, True)):
    failTestSuite(ldap_logger)

these objects are only found in active directory but not in open LDAP

So my question is, are they needed, and / or is it only working using AD?

my sitedefault.yaml looks like the following

config:
application:
sas.identities.providers.ldap.connection:
host: 'centosmaster.localdomain'
port: 389
url: 'ldap://${sas.identities.providers.ldap.connection.host}:${sas.identities.providers.ldap.connection.port}'
anonymousBind: 'false'
userDN: "cn=ldapadm,dc=ldap,dc=localdomain"
password: ""
sas.identities.providers.ldap.group:
accountId: 'name'
baseDN: "ou=groups,dc=ldap,dc=localdomain"
createdDate: 'createTimestamp'
distinguishedName: 'none'
member: 'member'
modifiedDate: 'modifyTimestamp'
objectClass: 'groupOfNames'
objectFilter: '(objectClass=groupOfNames)'
searchFilter: 'dn={0}'
sas.identities.providers.ldap.user:
accountId: 'uid'
baseDN: "ou=user,dc=ldap,dc=localdomain"
createdDate: 'createTimestamp'
distinguishedName: 'none'
memberOf: 'memberOf'
modifiedDate: 'modifyTimestamp'
objectClass: 'inetOrgPerson'
objectFilter: '(objectClass=inetOrgPerson)'
searchFilter: 'uid={0}'
sas.identities:
administrator: 'ldapadm'

which I call with the following command

python3 viya-ark.py ldap_validator -s ../sysPrep/sitedefault.yaml -d

[erharb]

The sample sitedefault yaml URL referenced is from the Viya 3 version of Viya ARK, but the python tool reference by this issue is for Viya 4 version of Viya ARK which does not provide a sample sitedefault yaml file. I assume the Viya 3 sample version is different because it used in Ansible playbooks. I think the expectation of the Viya 4 ARK is that you use the sample sitedefault included in your order generated manifests.

[juergenschroeder]

Will it work with open LDAP then? or just with AD?

[markha73]

Currently, the script only supports AD. I will take a look at what changes are needed to provide support for OpenLDAP.

[AlissaSchleich]

We have opened a request to support OpenLDAP.