Description:
Network connectivity problems
Impact
Login page loads successfully
LDAP‑based users cannot authenticate
Non‑LDAP users (for example, the local
adminuser) can still log in
How to recognise it
LDAP user login fails with UI error: 504 Gateway Time‑out
Non‑LDAP users authenticate successfully
On the Image Artist User Federation page, clicking Test connection returns:
Error when trying to connect to LDAP: ‘CommunicationError’
What to do
Investigate network connectivity between the Image Artist host and the external LDAP provider, including:
DNS resolution
Firewall rules
Routing / VPN connectivity
LDAP port accessibility
No Image Artist configuration changes are required unless instructed by the LDAP or network team.
Invalid LDAP TLS certificate
Image Artist can authenticate users against an external LDAP directory over TLS. Authentication fails when the LDAP server’s TLS certificate is missing, expired, invalid, or in an unsupported format in the Image Artist (more specifically, Keycloak) container trust store.
Impact
Login page loads successfully
LDAP‑based users cannot authenticate
Non‑LDAP users (for example, the local
adminuser) can still log in
How to recognise it
LDAP-based user login fails with UI error: Unexpected error when handling authentication request to identity provider
Non-LDAP users authenticate successfully
SImA_keycloaklog contains:
Error when authenticating to LDAP: simple bind failed: <ldap_domain>:<ldap_port>: [Root exception is ... unable to find valid certification path to requested target]To view the Keycloak log interactively use:
$ docker service logs -f SImA_keycloakAlternatively you can obtain a full set of log files, as described here.
What to do
Import a suitable LDAP TLS certificate into the Image Artist container stack.
Refer to: Image Artist: How do I update the LDAP CA certificate?
Important Note
Image Artist does not support LDAP TLS certificate bundles
If a bundle is provided, only the first certificate is imported
Use a single individual certificate (typically the issuing CA certificate)
Comments
0 comments
Article is closed for comments.