slurm-web using openldap but can't work

[emalovelife]

i have some trouble in using your slurm-web. When i configure authentication with openldap, and i use user/password as authentication, the login web page always says " ERROR,Authentication error: Invalid user or password"
However, i use /usr/libexec/slurm-web/slurm-web-ldap-check command, it runs ok, here's the answer
INFO ⸬ Running slurm-web-ldap-check
Found 2 user(s) in LDAP directory:

• hslurm (hello_slurm) [acoustic, physic]
• jgreen (jim_green) [acoustic, biology]

then I'll paste some configuration in gateway.ini

[authentication]
enabled=yes
method=ldap

[ldap]
uri=ldap://192.169.1.225
bind_dn=cn=admin,dc=s5,dc=localdomain
bind_password=slap123
user_base=ou=People,dc=s5,dc=localdomain
group_base=ou=Group,dc=s5,dc=localdomain
user_class=posixAccount

Through the openldap.log I knew the difference, but I don't know why the web page can't use the same procedure as the test command slurm-web-ldap-check
Here's the slurm-web-ldap-check log message:
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 fd=13 ACCEPT from IP=172.19.129.231:55372 (IP=0.0.0.0:389)
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=0 BIND dn="cn=admin,dc=s5,dc=localdomain" method=128
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=0 BIND dn="cn=admin,dc=s5,dc=localdomain" mech=SIMPLE bind_ssf=0 ssf=0
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=0 RESULT tag=97 err=0 qtime=0.000054 etime=0.004250 text=
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=1 SRCH base="ou=People,dc=s5,dc=localdomain" scope=2 deref=0 filter="(objectClass=posixAccount)"
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=1 SRCH attr=uid
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000033 etime=0.001014 nentries=2 text=
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=2 SRCH base="cn=hello_slurm,ou=People,dc=s5,dc=localdomain" scope=0 deref=0 filter="(objectClass=posixAccount)"
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=2 SRCH attr=cn gidNumber
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=2 SEARCH RESULT tag=101 err=0 qtime=0.000084 etime=0.000493 nentries=1 text=
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=3 SRCH base="ou=Group,dc=s5,dc=localdomain" scope=2 deref=0 filter="(&(|(objectClass=posixGroup)(objectClass=groupOfNames))(|(memberUid=hslurm)(member=cn=hello_slurm,ou=people,dc=s5,dc=localdomain)(gidNumber=500)))"
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=3 SRCH attr=cn
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=3 SEARCH RESULT tag=101 err=0 qtime=0.000067 etime=0.000414 nentries=2 text=
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=4 SRCH base="cn=jim_green,ou=People,dc=s5,dc=localdomain" scope=0 deref=0 filter="(objectClass=posixAccount)"
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=4 SRCH attr=cn gidNumber
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=4 SEARCH RESULT tag=101 err=0 qtime=0.000028 etime=0.000208 nentries=1 text=
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=5 SRCH base="ou=Group,dc=s5,dc=localdomain" scope=2 deref=0 filter="(&(|(objectClass=posixGroup)(objectClass=groupOfNames))(|(memberUid=jgreen)(member=cn=jim_green,ou=people,dc=s5,dc=localdomain)(gidNumber=501)))"
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=5 SRCH attr=cn
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=5 SEARCH RESULT tag=101 err=0 qtime=0.000019 etime=0.000277 nentries=2 text=
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 op=6 UNBIND
Jun 21 15:27:48 s5 slapd[534541]: conn=1049 fd=13 closed

While the login web page has the log message:
Jun 21 15:29:14 s5 slapd[534541]: conn=1050 fd=13 ACCEPT from IP=172.19.129.231:60966 (IP=0.0.0.0:389)
Jun 21 15:29:14 s5 slapd[534541]: conn=1050 op=0 BIND dn="uid=jgreen,ou=People,dc=s5,dc=localdomain" method=128
Jun 21 15:29:14 s5 slapd[534541]: conn=1050 op=0 RESULT tag=97 err=49 qtime=0.000055 etime=0.000669 text=
Jun 21 15:29:14 s5 slapd[534541]: conn=1050 op=1 UNBIND
Jun 21 15:29:14 s5 slapd[534541]: conn=1050 fd=13 closed

Obviously, the web login has less procedure than the test command, it didn't use the data that i configure in the gateway.ini such as "bind_dn=cn=admin,dc=s5,dc=localdomain
bind_password=slap123", i don't know why

i even tried
user_fullname_attribute=cn
group_name_attribute=cn

and tried fullname in login box, still can't work

here's my openldap ldif dumpfile

LDIF Export for dc=s5,dc=localdomain

Server: Local LDAP Server (127.0.0.1)

Search Scope: sub

Search Filter: (objectClass=*)

Total Entries: 9

Generated by phpLDAPadmin (http://phpldapadmin.sourceforge.net) on June 19, 2024 6:27 am

Version: 1.2.6.6

version: 1

##Entry 1: dc=s5,dc=localdomain
dn: dc=s5,dc=localdomain
dc: s5
objectclass: top
objectclass: domain

##Entry 2: cn=admin,dc=s5,dc=localdomain
dn: cn=admin,dc=s5,dc=localdomain
cn: admin
description: LDAP Manager
objectclass: organizationalRole

##Entry 3: ou=Group,dc=s5,dc=localdomain
dn: ou=Group,dc=s5,dc=localdomain
objectclass: organizationalUnit
ou: Group

##Entry 4: cn=acoustic,ou=Group,dc=s5,dc=localdomain
dn: cn=acoustic,ou=Group,dc=s5,dc=localdomain
cn: acoustic
gidnumber: 501
memberuid: hslurm
objectclass: posixGroup
objectclass: top

##Entry 5: cn=biology,ou=Group,dc=s5,dc=localdomain
dn: cn=biology,ou=Group,dc=s5,dc=localdomain
cn: biology
gidnumber: 503
memberuid: jgreen
objectclass: posixGroup
objectclass: top

##Entry 6: cn=physic,ou=Group,dc=s5,dc=localdomain
dn: cn=physic,ou=Group,dc=s5,dc=localdomain
cn: physic
gidnumber: 502
memberuid: hslurm
objectclass: posixGroup
objectclass: top

##Entry 7: ou=People,dc=s5,dc=localdomain
dn: ou=People,dc=s5,dc=localdomain
objectclass: organizationalUnit
ou: People

##Entry 8: cn=hello_slurm,ou=People,dc=s5,dc=localdomain
dn: cn=hello_slurm,ou=People,dc=s5,dc=localdomain
cn: hello_slurm
gidnumber: 500
givenname: hello
homedirectory: /home/users/hslurm
loginshell: /usr/sbin/nologin
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
sn: slurm
uid: hslurm
uidnumber: 1001
userpassword: 123456

##Entry 9: cn=jim_green,ou=People,dc=s5,dc=localdomain
dn: cn=jim_green,ou=People,dc=s5,dc=localdomain
cn: jim_green
gidnumber: 501
givenname: jim
homedirectory: /home/users/jgreen
loginshell: /usr/sbin/nologin
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
sn: Green
uid: jgreen
uidnumber: 1002
userpassword: 123456

[emalovelife]

Here's the author's reply, but i still can't fixed it, i doubt the web login code don't work as the test command well, is anybody tried this, can others give me a detailed configuration

Thank you for contacting us, I'm glad you are interested in Slurm-web and you started testing!

Do you have a Github account? If yes, I invite you to ask technical questions on the community channel at this URL:
https://github.com/rackslab/Slurm-web/discussions/categories/q-a

This way, other people will benefit from the answers.

Your sldapd logs indicates:

Jun 21 15:29:14 s5 slapd[534541]: conn=1050 op=0 RESULT tag=97 err=49 qtime=0.000055 etime=0.000669 text=
^^^^^^
In OpenLDAP, error 49 means "Invalid credentials". This either means the user dn "uid=jgreen,ou=People,dc=s5,dc=localdomain" or the password is wrong. Do you know what is the dn of this user entry in your LDAP directory?

For more useful information about authentication logic in Slurm-web logs, you can enable debug messages in gateway.ini:

[service]
debug=yes
debug_flags=
slurmweb
rfl

Then restart the gateway service and checkout the logs.

You can also find more information about Slurm-web logs in troubleshooting guide: https://docs.rackslab.io/slurm-web/misc/troubleshooting.html

Best regards,
Rémi

[rezib]

Hello @emalovelife,

The dn of the user entries in your LDAP directory use the cn attribute. This is not yet supported in Slurm-web 3.0.0, this limitation was reported in #305. A fix has been developed and integrated, it will be released with Slurm-web 3.1.0 (probably next week).

Then, in order to support your LDAP tree, you will need to upgrade to Slurm-web 3.1.0 and set this parameter in your gateway.ini:

[ldap]
user_name_attribute = cn

Then you will be able to login with logins jim_green or hello_slurm and their passwords.

[luckask3]

@rezib I have a question.
Is possible to run Jobs through the slurm-web interface? I did not find this functionality or any related theme in the documentation.

[rezib]

Is possible to run Jobs through the slurm-web interface? I did not find this functionality or any related theme in the documentation.

It is in the roadmap: #281

Rackslab is looking for sponsor to fund the development of this feature, would your organization like to participate?

[luckask3]

I wish that were possible, but I can't answer that for you.

I am a little new to this, so please pardon my ignorance.
I have some doubts regarding user authentication to my slurm cluster to run jobs, since it is not possible to run jobs through slurm-web I will have to find another way to perform authentication.
The documentation is not very clear about using LDAP accounts.
Saw somewhere in the list about using UsePAM=1 and copying or creating a softlink for slurm PAM module under /etc/pam.d . But it didn't work for me.
I am bereft of ideas at present. My question is how is it possible to perform authentication so that a user can perform tasks in my cluster trough ssh. Do you have any tutorial or documentation that can help me with this?

[rezib]

I am sorry but I don't do Slurm support in this channel. If you need help to setup a cluster with Slurm, SSH and LDAP, Rackslab offers professional services in HPC, feel free to contact us if you want a quotation.

[emalovelife]

I still haven't quit very well how phpldap's directory and subdirectory policy works.

By default, there is a cn=admin already created, within this default cn I created the ou=group with its respective groups and the ou=people with its respective users pointing to their groups. Is this structure correct?

+--> dc=dpihpc,dc=mao,dc=org,dc=br (1)
  +--> cn=admin (2)
  | +--> ou=group (3)
  | | ---> cn=admins
  | | ---> cn=biology
  | | ---> cn=others
  | | ---> Create new entry here
  | +--> ou=people (3)
  | | ---> cn=lucas.borges
  | | ---> cn=test.others
  | | ---> cn=test.slurm

seems in your ldif file, People and Group are the same level with admin, however your layout picture show that People and Group are under admin. while in my configuration, they are in the same level.

[emalovelife]

in fact it's like this, the users are under People, the editor does not show what i mean
`
dc=s5,dc=localdomain
|
|--ou=Group
| |-- cn=acoustic
| |-- cn=admins
| |-- cn=biology
|--ou=People
| |-- cn=hello_slurm (in biology)
| |-- cn=jim_green (in acoustic)
| |-- cn=system_admin(in admins)

`

[luckask3]

Thank you @emalovelife I applied a similar structure to my settings.