Nginx bind to passenger.sock failed with LDAP authentication

[laud337]

Hello,

We can authenticate with plain .htpasswd authentication, but we get the following errors when authenticating with LDAP:

We have tried removing /var/run/ondemand-nginx/laud/passenger.sock file, but the nginx error from above still occurs. Are there nginx processes we need to stop/restart after removing the passenger.sock file? Please advise how we can resolve the errors above.

Thanks in advance

[tdockendorf (Trey Dockendorf)]

Do not remove socket files manually, that could leave the PUN in a weird state. Instead try to use this:

/opt/ood/nginx_stage/sbin/nginx_stage nginx_clean -f -u laud

Have you tried OnDemand 1.8 with Dex and LDAP? That might yield better results. As for why you see that in the first place, it’s hard to say. I found a few older threads with similar errors maybe useful. It looks like could be issue with LDAP configuration or user not mapping correctly to local OOD system. Does the user laud exist when you do getent passwd laud from the OnDemand host?

LDAP authentication issues - user not found

use this config AuthLDAPSearchAsUser on instead of AuthLDAPBindDN someTestUser AuthLDAPBindPassword someTestPassword Maybe it could be your AuthLDAPBindDN that is the issue? I mean if you’re binding to a different base DN than the rest of your users? You’re sure they have this attribute, name? Can you show us the entire config? Feel free to obfuscate things with ‘host’ and ‘a’ ‘b’ ‘c’ and so on. With LDAP, there is always some very simple reason things fail. I would suggest these thi…

Error -- nginx: Address already in use

Hey guys, We had or have the same issue. FYI, Our IDAM path for OOD is convoluted, ie. AD creds with IPA, sssd, pwath and a module in Apache (cannot remember it’s name) and some users were created in AD by central IT with spaces in their name. In our case (a few years ago) to fix the usernames up the unix team had to remap usernames in IPA to short names so the user now has a long username from AD and a short name and unix UID for Linux. They can SSH into hosts with either of the…

[laud337]

Yes, getent passwd laud returns the user account and the account exists on our host.

After running /opt/ood/nginx_stage/sbin/nginx_stage nginx_clean -f -u laud, we still get same the nginx bind errors from above.

Does dex only work with OnDemand version 1.8? We currently have OnDemand 1.7 installed.

[tdockendorf (Trey Dockendorf)]

We have only tested Dex with OnDemand 1.8. In theory you could download the ondemand-dex RPM from OnDemand 1.8 repos and install with 1.7 if you had appropriate ood_portal.yml and setup mod_auth_openidc outside OnDemand, but honestly it would be easier to just upgrade to OnDemand 1.8.

Have you tried something like lsof /var/run/ondemand-nginx/laud/passenger.sock when you get those errors to see if anything registers as using that socket?