[IGN-13784, IGN-13799, IGN-13846, IGN-14121] AD and Postgres issues on 8.3 Upgrade

Ignition 8.3 Early Access
21

BluegelMarius -

Is it possible that your config has a role search base defined and your role(s) fall outside the search base? For example if you have this config:

roleSearchBase: ou=orgunit,dc=acme,dc=org

and your LDAP user has:

memberOf: cn=role1,dc=acme,dc=org

the role will not be returned in 8.3 as it falls outside the role search base.

2 Likes
22

no I checked this. Both had been correctly configured in 8.1 and I am also able to get the roles into the email attribute if I set this to "memberOf".

23

The AD concern with the User Role Name Attribute field erroneously mapping to the User Name Attribute field has been fixed, and will be available starting with Beta4.

2 Likes
24

Just upgraded to the 8.3.0-rc1 to see if the Postgres issue is resolved and it seems to be unchanged. I canā€™t get mutual TLS authenticaion to work to the database no matter what I do. I know this thread is marked as solved on account of the AD issues being resolved. These should have probably been two threads for the two issues. Should I start another for the ongoing Postgres issue? Is there any update on the progress to replicate/resolve that?

25

I donā€™t see that anyone ever actually opened a ticket for the POSTGRES issue. I have done so now and alerted the relevant development team.

26

@mquinn - What happens if you remove the leading and trailing double quotes? I am also suspicious about the leading question mark character.

27

I canā€™t get mutual TLS authenticaion to work to the database no matter what I do

We are looking into this and want to confirm what we are seeing is what you are running into. In attempting to reproduce this, I am not seeing quotes being added but I am working on getting a copy you provided earlier.

What I am seeing is there is a behavior change from 8.1 ā†’ 8.3 where:

  1. A username is provided,
  2. A password isnā€™t set

The username isnā€™t being sent with the connection request. This is causing the client cert authentication to occur with the username of the user Ignition is running as.

Can you please try the following:

  1. If quotes are added to the beginning and end of your connection properties, please remove them and all escaping.
  2. Set an embedded password of a single space and save the connection.

Garth

28

I tried with the embedded password of a single space and the connection is valid. Thatā€™s using this connection string:

?ssl=true;sslmode=verify-full;sslrootcert=/etc/step/certs/root_ca.crt;sslcert=/etc/step/certs/ssl-cert.pem;sslkey=/etc/step/certs/ssl-cert.key.pk8

I assume that the devs can fix it so that the correct username gets sent.

29

Thank you for confirming that this works. We will have a fix for that issue but it likely will not come until 8.3.1. I just wanted to confirm that there isn't anything that we might have missed.

Garth