# Error -- failed to map user , OOD and Shibboleth authentication

**URL:** <https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577>\
**Category:** Get Help\
**Tags:** question\
**Created:** [July 8, 2021, 5:35am UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577 "2021-07-08T05:35:34Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![nsimbi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nsimbi/32/765_2.png) [@nsimbi](https://discourse.openondemand.org/u/nsimbi)\
**Post date:** [July 8, 2021, 5:35am UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/1 "2021-07-08T05:35:34Z")

</div>

Hello Support,  
This seems to be a common issue with Open On Demand but I haven’t come across a definitive solution.  
I note however that i am using shibboleth authentication and have setup Open On Demand authentication following this guide to the letter,  
[Shibboleth — Open OnDemand 2.0.5 documentation](https://osc.github.io/ood-documentation/latest/authentication/shibboleth.html)

I am able to authenticate to with my Shibboleth 3.4.7 Identity Provider, But i get an error,  
Error – failed to map user (user@tld.tld.tld)

Kindly help with a workaround , because I haven’t found a solution from the recently posted identical issues.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 13, 2021, 6:44pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/2 "2021-07-13T18:44:10Z")

</div>

Hi and welcome! Sorry for the delay.

You’re trying to map the user `user@some-email.edu` to just `user`. This is done through regular expressions and the `user_map_cmd` in versions 1.8 and below and `user_map_match` in versions 2.0 and above.

Here are the docs for the same, let us know if you have any questions on those 2 fields.  
[https://osc.github.io/ood-documentation/latest/reference/files/ood-portal-yml.html](https://osc.github.io/ood-documentation/latest/reference/files/ood-portal-yml.html)

---

<div class="post-metadata">

**Author:** ![nsimbi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nsimbi/32/765_2.png) [@nsimbi](https://discourse.openondemand.org/u/nsimbi)\
**Post date:** [July 16, 2021, 9:58am UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/3 "2021-07-16T09:58:07Z")

</div>

Hello Jeff,  
I have reviewed the documentation and changed to `user_map_match: '^([^@]+)@tld.ac.ug$'`  
I mapped `user_env: null` such that it obtains values from `REMOTE_USER` CGI variables.

However I am still getting the same error with user mapping and users dont get redirected to the OOD dashboard.

Are there any missing pieces of this in other parts of the documentation and in terms of user provisioning and roles mapping.

When I check the logs under `/var/log/ondemand-nginx/ood/` both access and error log files are empty. Could you comment on logging setup or where the actual logs are being kept.

I have pasted all the configs I have in the file **/etc/ood/config/ood\_portal.yml**

```auto
--- 
auth: 
  - "AuthType shibboleth"
  - "ShibRequestSetting requireSession 1"
  - "RequestHeader edit* Cookie \"(^_shibsession_[^;]*(;\\s*)?|;\\s*_shibsession_[^;]*)\" \"\""
  - "RequestHeader unset Cookie \"expr=-z %{req:Cookie}\""
  - "Require valid-user"
map_fail_uri: null
register_root: /var/www/ood/register
register_uri: /register
user_env: null
user_map_match: "^([^@]+)@tld.ac.ug$"

```

Kindly suggest any further modifications I should make to solve this.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 16, 2021, 3:23pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/4 "2021-07-16T15:23:19Z")

</div>

What version of OnDemand are you using?

First, I’d get rid of `user_env: null`. If you’re using the default then just comment that out or don’t use it. Actually forcing it to `null` could be the issue.

If that’s not the issue, I’d still just get rid of it because it may lead to further confusion later on down the road.

The next thing I’d look at is the regular expression `"^([^@]+)@tld.ac.ug$"` and how it’s being formatted from yaml → the apache config. You’ve listed here the `ood_portal.yml`, what does it show up as in the `ood-portal.conf`? You may need to use single quotes here for safety - there’s a similar issue on this discourse about single and double quotes and how it affects yaml.

I quickly tested that regex using `ood_auth_map.regex` in 1.8 and in lua for 2.0 and they both work out OK. So it’s not the regex directly but maybe some formatting issue interpolating it from YAML into the commands.

Lastly you could set `lua_log_level: 'debug'` and you’ll start to see log messages like this in your apache logs (though they’ll likely indicate what we already know - you’re mapping user@email =\> user@email).

```auto
[Fri Jul 16 15:17:25.331560 2021] [lua:debug] [pid 54:tid 140649550563072] @/opt/ood/mod_ood_proxy/lib/ood/user_map.lua(21): [client 127.0.0.1:46224] Mapped 'jeff@localhost' => 'jeff'

```

---

<div class="post-metadata">

**Author:** ![nsimbi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nsimbi/32/765_2.png) [@nsimbi](https://discourse.openondemand.org/u/nsimbi)\
**Post date:** [July 20, 2021, 5:16pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/5 "2021-07-20T17:16:23Z")

</div>

Hello Jeff,  
Thanks for the replies and recommendations,  
[ood-portal.yml](https://discourse.openondemand.org/uploads/short-url/8aHGJ8PnlLA4BaLXQTsdYIun5Gs.yml) (3.9 KB)

I got rid of `user_env: null` but that didnt solve the issue. I also enabled the lua logs but still didn’t see anything in the httpd logs that point to the root cause.

FYI, I am running version 2.0 of OnDemand.

For further troubleshooting I have attached a copy of the OOD configuration file, `ood_portal.yml`

Kindly look through to see if something is misconfigured.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 20, 2021, 7:29pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/6 "2021-07-20T19:29:52Z")

</div>

Sorry - did you modify the file you uploaded? Your comments indicate it’s `tld.ac.ug` but the file has `tld.tld.tld`? It may be as simple as running the ood\_portal\_generator to update the ood-portal.conf file from the yaml input you’ve given.

```nohighlight
  # Authenticated-user to system-user mapping configuration
  #
  SetEnv OOD_USER_MAP_MATCH "^([^@]+)@tld.tld.tld$"

```

---

<div class="post-metadata">

**Author:** ![nsimbi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nsimbi/32/765_2.png) [@nsimbi](https://discourse.openondemand.org/u/nsimbi)\
**Post date:** [July 20, 2021, 7:44pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/7 "2021-07-20T19:44:35Z")

</div>

I modified it just for upload. But the generated file has proper FQDN,

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 20, 2021, 7:52pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/8 "2021-07-20T19:52:29Z")

</div>

hmmmm, OK what do `lua:debug` log entires say?

Are they similar to this? It’s mapping and email address to the same email address?

```auto
Mapped 'jeff@example.edu' => 'jeff@example.edu'

```

---

<div class="post-metadata">

**Author:** ![nsimbi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nsimbi/32/765_2.png) [@nsimbi](https://discourse.openondemand.org/u/nsimbi)\
**Post date:** [July 21, 2021, 7:30am UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/9 "2021-07-21T07:30:02Z")

</div>

No Jeff,  
I do not have such an error logged.

Below are the last few lines of the httpd error log file, `/var/log/httpd/error.log` after enabling `lua: debug` logs

```auto
[lua:debug] [pid 47922:tid 140039799392000] lua_request.c(1842): [client 196.43.137.4:56653] AH01486: request_rec->dispatching subprocess_env -> apr table
 [lua:debug] [pid 47922:tid 140039799392000] lua_request.c(1842): [client 196.43.137.4:56653] AH01486: request_rec->dispatching subprocess_env -> apr table
 [mod_shib:error] [pid 47922:tid 140039790999296] [client 196.43.137.4:56655] Blocked unacceptable redirect location., referer: https://login.ace.ac.ug/
 [lua:debug] [pid 47922:tid 140039715464960] lua_request.c(1842): [client 205.185.115.135:60830] AH01486: request_rec->dispatching subprocess_env -> apr table, referer: http://137.63.194.16:80/admin/login.asp
 [lua:debug] [pid 47922:tid 140039715464960] lua_request.c(1842): [client 205.185.115.135:60830] AH01486: request_rec->dispatching subprocess_env -> apr table, referer: http://137.63.194.16:80/admin/login.asp
 [lua:debug] [pid 47922:tid 140039715464960] lua_request.c(1842): [client 205.185.115.135:60830] AH01486: request_rec->dispatching subprocess_env -> apr table, referer: http://137.63.194.16:80/admin/login.asp

```

If I need to look at a different set of logs, you can also let me know.  
I also upgraded to the latest version of `OnDemand, v2.0.13` but the same error persists.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 21, 2021, 1:59pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/10 "2021-07-21T13:59:21Z")

</div>

Yea I would grep for `Mapped` in that file. That directory is the right location, and any `*error.log` is the right place (you may have `my_servername_error.log` )

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 30, 2021, 1:55pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/11 "2021-07-30T13:55:57Z")

</div>

Does grepping for Mapped in `/var/log/httpd/error.log` (or `error_<servername>.log`) show anything useful?

---

<div class="post-metadata">

**Author:** ![nsimbi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nsimbi/32/765_2.png) [@nsimbi](https://discourse.openondemand.org/u/nsimbi)\
**Post date:** [August 2, 2021, 6:52am UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/12 "2021-08-02T06:52:43Z")

</div>

There is no record showing any `mapping or Mapped` string anywhere in the server logs.

---

<div class="post-metadata">

**Author:** ![nsimbi](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nsimbi/32/765_2.png) [@nsimbi](https://discourse.openondemand.org/u/nsimbi)\
**Post date:** [August 2, 2021, 9:42am UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/13 "2021-08-02T09:42:46Z")

</div>

Hello Jeff,  
I was able to succeed with the Shibboleth Authentication. I tore down everything and re-installed OOD version 2.0.13 and configured following the tips from this discourse. I am able to authenticate and view the dashboard. Thanks for your help.

1. However other users are unable to access the dashboard.  
They get an error, ` Home directory not found`

2. Is there a part in the documentation where level of authorization is configured. In that not everyone should be able to configure, add, modify or even delete the HPC clusters or hosts. (Still, I am using Shibboleth as the authentication type)

Thanks.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [August 2, 2021, 1:19pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/14 "2021-08-02T13:19:45Z")

</div>

OK - well good to hear it’s at least better now.

1. This is expected. Something out of bounds needs to create a HOM directory for these users. Here are docs on how to show a custom page for this error. If they, say, ssh somewhere will they get a HOME directory created? Or is there something else going on like you need to mount more home shares?

[https://osc.github.io/ood-documentation/latest/customization.html#custom-error-page-for-missing-home-directory-on-launch](https://osc.github.io/ood-documentation/latest/customization.html#custom-error-page-for-missing-home-directory-on-launch)

1. Most things in OOD are based of POSIX file permissions on the host. Documentation may take this for granted a bit. Cluster’s are viewable though `/etc/ood/config/clusters.d` files. Just make sure they’re readable by everyone and writeable only by root - and there’s your authorization. Same with apps `/var/www/ood`, or app config files in `/etc/config/apps`. Note we have some automation packages that’ll set file permissions accordingly.

---

<div class="post-metadata">

**Author:** ![westburg.2](https://avatars.discourse-cdn.com/v4/letter/w/0ea827/32.png) [@westburg.2](https://discourse.openondemand.org/u/westburg.2)\
**Post date:** [May 26, 2022, 3:42pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-ood-and-shibboleth-authentication/1577/15 "2022-05-26T15:42:50Z")

</div>