# LDAP Configuration issue inside container

**URL:** <https://forums.percona.com/t/ldap-configuration-issue-inside-container/27291>\
**Category:** Percona Server for MongoDB\
**Tags:** percona, mongodb\
**Created:** [December 21, 2023, 7:32am UTC](https://forums.percona.com/t/ldap-configuration-issue-inside-container/27291 "2023-12-21T07:32:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Iliterallyneedhelp](https://avatars.discourse-cdn.com/v4/letter/i/9d8465/32.png) [@Iliterallyneedhelp](https://forums.percona.com/u/Iliterallyneedhelp)\
**Post date:** [December 21, 2023, 7:32am UTC](https://forums.percona.com/t/ldap-configuration-issue-inside-container/27291/1 "2023-12-21T07:32:33Z")

</div>

Hi,  
I’m trying to set up LDAP for recently created Percona Server for MongoDB but I’m still struggling with some issues  
I’ve been following this doc:

> **[Percona Server for MongoDB 6.0 - Set up LDAP authentication with SASL](https://docs.percona.com/percona-server-for-mongodb/6.0/sasl-auth.html#__tabbed_2_2)**
>
> This document describes an example configuration
> suitable only to test out the external authentication functionality
> in a non-production environment.
> Use common sense to adapt these guidelines to your production environment.

I’m using official PSMDB image downloaded with

```auto
docker.io/percona/percona-server-mongodb:7.0.2

```

I’m following all required commands step by step:

```auto
sudo yum install -y cyrus-sasl
sudo sed -i -e s/^MECH=pam/MECH=ldap/g /etc/sysconfig/saslauthd 

```

My handmade `/etc/saslauthd.conf` file looks like this:

```auto
ldap_servers: ldap://subdomain.domain.top-level-domain:389
ldap_mech: PLAIN
ldap_search_base: OU=my-ou,DC=subdomain,DC=domain,DC=top-level-domain
ldap_bind_dn: CN=ldap-user,CN=users,OU=my-ou,DC=subdomain,DC=domain,DC=top-level-domain
ldap_password: 'my-password'

```

I’m unable to use systemctl inside container so I had to run saslauthd with the one of commands below:

```auto
saslauthd -a ldap
saslauthd -d -a ldap

```

```auto
sudo chmod 755 /run/saslauthd

```

It’s weird as sasl group does not exist while I tried to add this:

```auto
sudo usermod -a -G sasl mongod

```

At last I’m testing the connection with test command:

```auto
testsaslauthd -u ldap-user -p my-password -f /var/run/saslauthd/mux

```

The error below is going to be displayed instantly right after executing test command:

```auto
0: NO "authentication failed"

```

As for me it’s strange as I need to define auth method in command although it has been set in /etc/saslauthd.conf before. Moreover it seems like a config is being ignored completely by the command

I’ve been testing my ldap connection with ldapsearch - it’s fine. It’s been also tested in local Ubuntu environment. Although the systemctl is available here, I’m still getting the same error.

Could somebody advise please what’s wrong?  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![Iliterallyneedhelp](https://avatars.discourse-cdn.com/v4/letter/i/9d8465/32.png) [@Iliterallyneedhelp](https://forums.percona.com/u/Iliterallyneedhelp)\
**Post date:** [December 28, 2023, 12:47pm UTC](https://forums.percona.com/t/ldap-configuration-issue-inside-container/27291/2 "2023-12-28T12:47:47Z")

</div>

Please halp, there’re my logs.

```auto
 : attempting a read lock on slot: 77
:[login=me] [service=imap] [realm=]: not found, update pending
: attempting to release lock on slot: 77
: acquired accept lock
 Authentication failed for me: Bind to ldap server failed (invalid user/password or insufficient access) (-7)
                 : auth failure: [user=me] [service=imap] [realm=] [mech=ldap] [reason=Unknown]
                 : response: NO

```

Updated config:

```auto
ldap_servers: ldap://subdomain.domain.top-level-domain:389
ldap_mech: PLAIN
ldap_search_base: OU=my-ou,DC=subdomain,DC=domain,DC=top-level-domain
ldap_filter: (sAMAccountName=%u)
ldap_bind_dn: CN=ldap-admin-user,OU=my-ou,DC=subdomain,DC=domain,DC=top-level-domain
ldap_password: "my password"
ldap_debug: -1

```

/etc/default/saslauthd

```auto
MECHANISMS="ldap"
START=yes
DESC="SASL Authentication Daemon"
NAME="saslauthd"
MECH_OPTIONS=""
THREADS=5
OPTIONS="-c -V -m /var/run/saslauthd -O /etc/saslauthd.conf"

```

I have built image of OpenLDAP server in container and this one works perfectly, unfortunately I need LDAP directly from AD to be working as well

---

<div class="post-metadata">

**Author:** ![Iliterallyneedhelp](https://avatars.discourse-cdn.com/v4/letter/i/9d8465/32.png) [@Iliterallyneedhelp](https://forums.percona.com/u/Iliterallyneedhelp)\
**Post date:** [December 29, 2023, 9:33am UTC](https://forums.percona.com/t/ldap-configuration-issue-inside-container/27291/3 "2023-12-29T09:33:18Z")

</div>

I got it at last. The issue is a password including some special characters like @, #, $ etc. inside saslauthd.conf file. For example, you cannot use quotation marks like this as it’s not going to work

```auto
ldap_password: "my-password"

```

Another account has been used for auth process that has no special characters, just letters and digits

```auto
ldap_password: normalpassword2137

```