Why can I no longer log in to Columbus using my LDAP user credentials?

Created
October 08, 2021 23:08

Date Posted: 2021-08-20
Product: Columbus

Problem:

Solution:

PROBLEM:

LDAP user cannot log in to Columbus. The following error appears in the /var/log/columbus/Blitz-0.log

-----
Exception thrown while checking password for:columbus_user ome.conditions.ValidationException: DNs don't match 'old_Distinguished_Name' and 'new_Distinguished_Name'
-----

Where...
    columbus_user is the name (LDAP cn) of the columbus user account encountering login problems
    old_Distinguished_Name is the Distinguished Name as stored in the Columbus database
    new_Distinguished_Name is the Distinguished Name as stored in LDAP

CAUSE:

The users Distinguished Name (DN) as reported by LDAP does not match what is stored in the Columbus database.

The Columbus database does not automatically detect changes made to the Distinguished Name (DN).

https://www.openmicroscopy.org/community/viewtopic.php?f=5&t=7535
http://www.openmicroscopy.org/community/viewtopic.php?f=5&t=5254

SOLUTION:

Force Columbus to update the stored DN via the omero 'setdn' CLI option. You should use the columbus OS user to issue the command...

$ su columbus -
$ /usr/local/PerkinElmerCTG/Columbus/bin/omero ldap setdn columbus_user 'new_Distinguished_Name'

Note: When prompted for a username and password use the Columbus web interface admin user ("root") credentials, which are not the same as the operating system root account credentials.