Request for Guidance on Open OnDemand Setup with LDAP and Custom HPC Configuration

Get Help
,
1

Dear Open OnDemand Team,

We are currently working on deploying Open OnDemand on our HPC infrastructure at TIFR, Mumbai. While we have successfully installed the base system, we are facing some challenges integrating it with our existing LDAP authentication setup and customizing it to suit our user environment.

We have already tried the following:

  • Installed Open OnDemand as per official documentation.
  • Confirmed system users are resolved via LDAP.
  • NGINX and systemd services are running, but the user login fails silently.

Some issues and queries we would like your guidance on:

  1. LDAP Integration: Are there recommended practices or configuration snippets for OOD integration with a central LDAP directory?
  2. Debugging Login Issues: What logs and diagnostic steps do you suggest to trace failed user logins (currently no .ondemand-nginx folder is created in home directory)?
  3. Portal Customization: We would also like to eventually tailor the user dashboard and integrate specific HPC apps. What is the best way to plan this in phases?

We would appreciate any guidance, example configurations, or community pointers that could help streamline the process. Please let us know if any additional information would help in diagnosing the issue.

Thank you for your valuable work on OOD.

Best regards,
Anilkumar Naik

2

Hi and welcome!

LDAP support isn’t directly documented because it’s not secure. I would try to dissuade you from using this in production.

That said, there’s plenty of apache documentation for the same. You could increase the logging for that component with something like this (or with trace1 or similar):

LogLevel mod_authnz_ldap:debug

That said, you could try ondemand-dex for OIDC logins that can tie into your LDAP just like apache does. You would still need to debug the LDAP query, but OIDC would give you a lot more security around your authentication than the apache LDAP module.

3

Hello,

We are setting up Open OnDemand on RHEL 9.6, and recently enabled Dex (OIDC) with LDAP and HTTPS support. We’re seeing an Internal Server Error (500) when accessing:

https://oodtest.res.in and redirects to https://oodtest.res.in/pun/sys/dashboard

However:

https://oodtest.res.in/dex/.well-known/openid-configuration loads fine and gives the expected login page.
Apache (httpd) is running and listens on port 443.
/opt/ood/ood-portal-generator/sbin/update_ood_portal runs successfully.
No specific error is visible in /var/log/httpd/error_log or journalctl -u httpd -f.
User home directories are mounted correctly from NFS (/ghome -> /home), and exist.
We use the following OOD config:

yaml
servername: “oodtest.res.in”
port: 443

ssl:
cert: “/etc/pki/tls/certs/ailab.crt”
key: “/etc/pki/tls/private/ailab.key”

dex:
issuer: “https://oodtest.res.in/dex”
client_id: “ondemand-client”
client_secret: “secret”
redirect_uri: “https://oodtest.res.in/oidc”
connectors:
- type: ldap
id: ldap
name: “LDAP”
config:
host: auth.goolge.com:389
insecureNoSSL: true
bindDN: “uid=binduser,ou=People,dc=tifr,dc=res,dc=in”
bindPW: “xxxx”
userSearch:
baseDN: ou=People,dc=tifr,dc=res,dc=in
filter: “(objectClass=posixAccount)”
username: uid
idAttr: uid
emailAttr: mail
nameAttr: gecos
preferredUsernameAttr: uid
groupSearch:
baseDN: ou=Groups,dc=tifr,dc=res,dc=in
filter: “(objectClass=posixGroup)”
userMatchers:
- userAttr: DN
groupAttr: member
nameAttr: cn

What we’ve tried:

  • Re-generated portal config (update_ood_portal)
  • Restarted Apache and Dex
  • Checked NGINX stage logs under /var/log/ondemand-nginx/*
  • Verified that /home/anilkumar exists
  • SSL works fine — verified with curl -vk https://oodtest.res.in

Is there any other place where Open OnDemand logs auth/session startup issues (e.g., PAM, NGINX stage)?
What else can we try to trace this Internal Server Error?

Thanks,
Anilkumar

4

Did you check /var/log/ondemand-nginx/$USER/error.log? Every user has their own log file so I’d check your specific user’s error.log here.

5

We’re getting “Internal Server Error” immediately when opening https://oodtest.res.in — no login page is shown.

As suggested, we checked /var/log/ondemand-nginx/$USER/error.log, but no per-user logs are being created at all.

Since the error happens before any user login, and no user logs exist, we suspect the issue is at the global OOD or Apache config level.

Any advice on how to debug this stage would help.

Thanks,
Anilkumar

6

Oh I see - then you may find something in /var/log/httpd. Maybe it’s not in the generic error_log but some other log like <hostname>_error.log or similar. Maybe even try greping for 500 across all files to see something.

If you can’t login at all, then there’s some issue with dex + apache integration and the information should be there in the apache logs.

7

after adding below config to file /etc/httpd/conf.d/ood-portal.conf

<Location /dex/>
Require all granted
AuthType None

got the below error:

https://exampleurl/dex/auth/ldap?client_id=ondemand-client&nonce=8e_OAdLTNHCLsH_lzzGkICEFxcKVp7J2f7uwrztBNuA&redirect_uri=https%3A%2F%2Failab.tifr.res.in%2Foidc&response_type=code&scope=openid+profile+email&state=iGtneV2iW_7FNrDM9g6fNO8Hv1A

Bad Request

Unregistered redirect_uri (“https://eaxmpleurl.res.in/oidc”).

8

This topic may provide some insight into that issue