# Problem with user mapping

**URL:** <https://discourse.openondemand.org/t/problem-with-user-mapping/2501>\
**Category:** Get Help\
**Created:** [February 27, 2023, 10:44pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501 "2023-02-27T22:44:55Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![jjackzhn](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jjackzhn/32/1507_2.png) [@jjackzhn](https://discourse.openondemand.org/u/jjackzhn)\
**Post date:** [February 27, 2023, 10:44pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/1 "2023-02-27T22:44:55Z")

</div>

Host OS: RHEL 8.4  
OOD deployed with Puppet OOD module

I’m setting up OOD to authenticate through ACCESS and I’m having an issue with user mapping. After going through ACCESS, I get an error instead of being sent to the dashboard.

```auto
### Puppet config
openondemand::oidc_remote_user_claim: "eppn"
openondemand::user_map_cmd: "/opt/ood/ood_auth_map/bin/ood_auth_map.mapfile -f /sw/admin/grid-security/oauth-mapfile.cron"

```

It appears the OOD is receiving the user claim (eppn) correctly, from the error message:

```auto
Error -- failed to map user (yanzhan2@ncsa.illinois.edu)

```

And the mapping script works properly on its own (I’m using the OOD shipped script):

```auto
# /opt/ood/ood_auth_map/bin/ood_auth_map.mapfile -f /sw/admin/grid-security/oauth-mapfile.cron 'yan
zhan2@ncsa.illinois.edu'
yanzhan2

```

And I’m not seeing anything in HTTPD error logs.

Could you suggest where else I might look and what could be the issue here?

Thanks,  
Yan

---

<div class="post-metadata">

**Author:** ![jjackzhn](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jjackzhn/32/1507_2.png) [@jjackzhn](https://discourse.openondemand.org/u/jjackzhn)\
**Post date:** [February 27, 2023, 11:28pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/2 "2023-02-27T23:28:41Z")

</div>

I saw [Issue using user\_map\_cmd](https://discourse.openondemand.org/t/issue-using-user-map-cmd/2497) and tried to do some debugging:

```auto
  elseif user_map_cmd ~= nil then
    r:debug("mapping command: " .. user_map_cmd .. " '" .. (remote_user) .. "'")
    local handle = io.popen(user_map_cmd .. " '" .. (remote_user) .. "'")
    sys_user = handle:read()
    handle:close()
  end

```

It still isn’t matching for me…

```auto
[Mon Feb 27 17:27:20.540467 2023] [lua:debug] [pid 40959] @/opt/ood/mod_ood_proxy/lib/ood/user_map.lua(17): [client 73.246.209.138:50567] mapping command: /opt/ood/ood_auth_map/bin/ood_auth_map.mapfile -f /sw/admin/grid-security/oauth-mapfile.cron 'yanzhan2@ncsa.illinois.edu'
[Mon Feb 27 17:27:20.602247 2023] [lua:debug] [pid 40959] @/opt/ood/mod_ood_proxy/lib/ood/user_map.lua(24): [client 73.246.209.138:50567] Mapped 'yanzhan2@ncsa.illinois.edu' => '' [61.771 ms]

```

```auto
# /opt/ood/ood_auth_map/bin/ood_auth_map.mapfile -f /sw/admin/grid-security/oauth-mapfile.cron 'yanzhan2@ncsa.illinois.edu'
yanzhan2

```

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [February 28, 2023, 2:05am UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/3 "2023-02-28T02:05:33Z")

</div>

Hi and welcome!

Your timing is excellent! Remote user is being URL encoded, so what’s being passed during the actual execution is not `yanzhan2@ncsa.illinois.edu` but is in fact `yanzhan2%40ncsa.illinois.edu`.

I’ve updated our 2.1 documentation and will update our latest documentation tomorrow (2-28).

---

<div class="post-metadata">

**Author:** ![jjackzhn](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jjackzhn/32/1507_2.png) [@jjackzhn](https://discourse.openondemand.org/u/jjackzhn)\
**Post date:** [February 28, 2023, 4:16pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/4 "2023-02-28T16:16:19Z")

</div>

I’m using 2.0.28 and it appears that the mapping script doesn’t support the encoded string:

```auto
# /opt/ood/ood_auth_map/bin/ood_auth_map.mapfile -f /sw/admin/grid-security/test/grid-mapfile.yanzhan2_test 'yanzhan2%40ncsa.illinois.edu'

# cat /sw/admin/grid-security/test/grid-mapfile.yanzhan2_test
"yanzhan2%40ncsa.illinois.edu" yanzhan2

```

I then made my own script to parse the encoded string:

```auto
# /opt/ood/custom/ood-gridmap.py 'yanzhan2%40ncsa.illinois.edu'
yanzhan2

```

But I still can’t get it to match:

```auto
[Tue Feb 28 10:04:14.429398 2023] [lua:debug] [pid 41291] @/opt/ood/mod_ood_proxy/lib/ood/user_map.lua(15): [client 141.142.146.144:61117] Mapping command: /opt/ood/custom/ood-gridmap.py 'yanzhan2%40ncsa.illinois.edu'
[Tue Feb 28 10:04:14.448394 2023] [lua:debug] [pid 41291] @/opt/ood/mod_ood_proxy/lib/ood/user_map.lua(22): [client 141.142.146.144:61117] Mapped 'yanzhan2@ncsa.illinois.edu' => '' [18.989 ms]

```

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [February 28, 2023, 4:26pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/5 "2023-02-28T16:26:52Z")

</div>

I would say

- It’s good to use your own mapping script. We stopped shipping our own, and it’s unclear how long `ood_auth_map.mapfile` has worked and indeed if it even continues to work.
- Check `/var/log/httpd24-httpd/error_log` for any errors that script may throw. I’m thinking loading/library errors from python. The environment this is executed under is limited in the sense that it may not have all the things you’ve loaded in a shell environment.
- Use the syslogger if you can to print any errors or debug information to `journalctl`.

---

<div class="post-metadata">

**Author:** ![jjackzhn](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jjackzhn/32/1507_2.png) [@jjackzhn](https://discourse.openondemand.org/u/jjackzhn)\
**Post date:** [February 28, 2023, 4:51pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/6 "2023-02-28T16:51:52Z")

</div>

Okay, I tried logging to syslog and found that the script didn’t finish.  
Script:

```auto
#!/bin/python3
mapfile="/sw/admin/grid-security/oauth-mapfile.cron"

import sys
import syslog
syslog.syslog("importing urllib")
import urllib.parse as urlparse

syslog.syslog("finished import")

inputuser=urlparse.unquote(sys.argv[1])

syslog.syslog("input user: "+inputuser)

usermapping=dict(authuser="",mapped="")

for line in open(mapfile,'r'):
    (authuser,mapped) = line.split()
    usermapping[authuser.strip("\"")]=mapped

syslog.syslog("finished reading "+str(len(usermapping))+" entries")

if inputuser in usermapping:
    print(usermapping[inputuser])
    syslog.syslog("mapped "+inputuser+" to "+usermapping[inputuser])
else:
    print("")
    syslog.syslog("unable to map "+inputuser)

```

Logs:

```auto
Feb 28 10:45:22 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[42122]: importing urllib
Feb 28 10:45:22 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[42122]: finished import
Feb 28 10:45:22 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[42122]: input user: yanzhan2@ncsa.illinois.edu

```

So looks like it didn’t have problems loading libraries but for some reason stopped at the for loop loading the mapfile. Is there a memory restriction here?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [February 28, 2023, 5:10pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/7 "2023-02-28T17:10:57Z")

</div>

I don’t think so. I just tested against just over 3,000 entries. I’d guess there’s some sort of error it encountered. Is there anything in `/var/log/httpd24-httpd/error_log`? If not, add a `try` and `except` block and log the error.

```auto
Feb 28 17:08:47 97b05dc2ed01 /test.py[733]: importing urllib
Feb 28 17:08:47 97b05dc2ed01 /test.py[733]: finished import
Feb 28 17:08:47 97b05dc2ed01 /test.py[733]: input user: jeff@localhost
Feb 28 17:08:47 97b05dc2ed01 /test.py[733]: finished reading 3017 entries
Feb 28 17:08:47 97b05dc2ed01 /test.py[733]: mapped jeff@localhost to jeff

```

---

<div class="post-metadata">

**Author:** ![jjackzhn](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jjackzhn/32/1507_2.png) [@jjackzhn](https://discourse.openondemand.org/u/jjackzhn)\
**Post date:** [February 28, 2023, 5:18pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/8 "2023-02-28T17:18:35Z")

</div>

I’m not sure what the equivalent of /var/log/httpd24-httpd/error\_log on RHEL 8 is but I’m not seeing any errors in /var/log/httpd/\_error\_ssl.log.

Let me see if I can catch anything with a try-except.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [February 28, 2023, 5:21pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/9 "2023-02-28T17:21:26Z")

</div>

Sorry, I can never tell who’s on what system. It would be `/var/log/httpd/error_log`. Just `error_log` with no extension or ssl or hostname in the filename.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [February 28, 2023, 5:28pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/10 "2023-02-28T17:28:06Z")

</div>

Also I’m finding that `/opt/ood/ood_auth_map/bin/ood_auth_map.mapfile` does continue to work, although just with the test file I generated - 3,000 users generated from random strings. So there could be something I’m missing in the test file generation.

---

<div class="post-metadata">

**Author:** ![jjackzhn](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jjackzhn/32/1507_2.png) [@jjackzhn](https://discourse.openondemand.org/u/jjackzhn)\
**Post date:** [February 28, 2023, 5:32pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/11 "2023-02-28T17:32:28Z")

</div>

Ah… maybe it’s our config but I don’t have an “error\_log” without hostname. My Lua messages go to the log file with the hostname.

As for try-except - it looks like it failed on the first entry:

```auto
Feb 28 11:23:12 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43339]: importing urllib
Feb 28 11:23:12 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43339]: finished import
Feb 28 11:23:12 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43339]: input user: yanzhan2@ncsa.illinois.edu
Feb 28 11:23:12 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43339]: failed to read mapping
Feb 28 11:23:12 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43339]: finished reading 2 entries
Feb 28 11:23:12 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43339]: unable to map yanzhan2@ncsa.illinois.edu

```

Maybe there is some kind of restriction on Apache on our end. There are 1800 entries and it runs fine on its own, as you tested:

```auto
Feb 28 11:31:46 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43661]: importing urllib
Feb 28 11:31:46 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43661]: finished import
Feb 28 11:31:46 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43661]: input user: yanzhan2@ncsa.illinois.edu
Feb 28 11:31:46 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43661]: finished reading 1800 entries
Feb 28 11:31:46 ood-test.delta.internal.ncsa.edu /ood-gridmap.py[43661]: mapped yanzhan2@ncsa.illinois.edu to yanzhan2

```

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [February 28, 2023, 5:41pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/12 "2023-02-28T17:41:55Z")

</div>

Got it, yea it’s likely encoding like the `LANG` environment variable is `C_ASCII` - that’s not right, I’m blanking on what the bad/old encoding LANG could be, but you’d see it in a crontab output. in any case, it’s not UTF-8.

Try forcing `utf-8` encoding here when you’re rading the file.

```python
for line in open(mapfile,'r', encoding="utf-8"):

```

---

<div class="post-metadata">

**Author:** ![jjackzhn](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jjackzhn/32/1507_2.png) [@jjackzhn](https://discourse.openondemand.org/u/jjackzhn)\
**Post date:** [February 28, 2023, 5:43pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/13 "2023-02-28T17:43:37Z")

</div>

I found out why 🤦‍♂️ It failed at the line to open the mapfile. Likely a permission issue.

Edit: permission issue indeed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [August 27, 2023, 5:43pm UTC](https://discourse.openondemand.org/t/problem-with-user-mapping/2501/14 "2023-08-27T17:43:56Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.