Can't join Active Directory,Failed to validate bind credentials: [EFAULT] timed out

[anodos]

I tried that command and the middleware service never came back up and I couldn't access the server anymore, I had to re-install it.

Yes, that's the reason why I specified backing up the original file. You should also do hotpatching through an SSH session (so that you don't cut your feet out from under yourself).

 

[glossjorge]

I did backup the original file, I was doing it via ssh, but when the service did not come back, I lost ssh connection, so I went to the server directly and it did not let me do anything with it.

 

[uri]

Same problem after update to 11.3u1. Downgrade impossible because of zfs update.
But if I make fresh install, make all settings restart and then try to join to domain - it's woks! But it works only before restart!
this solution https://www.ixsystems.com/community...redentials-efault-timed-out.82235/post-572017 don't work for me!
Any ideas or maybe U2?

 

[ram777]

Finalized fix is here: https://raw.githubusercontent.com/f...ewared/middlewared/plugins/activedirectory.py
Back up and replace /usr/local/lib/python3.7/site-packages/middlewared/plugins/activedirectory.py with the version linked above, and then restart the FreeNAS middleware. service middlewared onerestart

I replaced activedirectory.py with the last version you give us. I restarted Freenas machine . Connecting to AD still does not work : Failed to validate bind credentials: [EFAULT] timed out

 

[anodos]

I replaced activedirectory.py with the last version you give us. I restarted Freenas machine . Connecting to AD still does not work : Failed to validate bind credentials: [EFAULT] timed out

PM me a copy of /var/log/middlewared.log. validate_credentials() in the updated version doesn't make any socket calls (it just performs a kinit). Sounds like a mis-applied patch.

 

[hemlock]

I'm using the LDAP directory service, updated to version 11.3-U1 and also grabed the most recent activedirectory.py file I am getting this error message whenever I try connecting to the ad server.

Code:

Error: Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py", line 621, in port_is_listening
    s.connect((host, port))
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py", line 586, in do_update
    await self.middleware.call('ldap.ldap_validate', new)
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1127, in call
    app=app, pipes=pipes, job_on_progress_cb=job_on_progress_cb, io_thread=True,
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1077, in _call
    return await methodobj(*args)
  File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py", line 488, in ldap_validate
    await self.middleware.call('ldap.port_is_listening', host, int(port), data['dns_timeout'])
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1127, in call
    app=app, pipes=pipes, job_on_progress_cb=job_on_progress_cb, io_thread=True,
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1091, in _call
    return await run_method(methodobj, *args)
  File "/usr/local/lib/python3.7/site-packages/middlewared/utils/run_in_thread.py", line 10, in run_in_thread
    return await self.loop.run_in_executor(self.run_in_thread_executor, functools.partial(method, *args, **kwargs))
  File "/usr/local/lib/python3.7/site-packages/middlewared/utils/io_thread_pool_executor.py", line 25, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py", line 625, in port_is_listening
    raise CallError(e)
middlewared.service_exception.CallError: [EFAULT] timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 130, in call_method
    io_thread=False)
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1077, in _call
    return await methodobj(*args)
  File "/usr/local/lib/python3.7/site-packages/middlewared/service.py", line 302, in update
    f'{self._config.namespace}.update', self, self.do_update, [data]
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1077, in _call
    return await methodobj(*args)
  File "/usr/local/lib/python3.7/site-packages/middlewared/schema.py", line 961, in nf
    return await f(*args, **kwargs)
  File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py", line 588, in do_update
    raise ValidationError('ldap_update', str(e))
middlewared.service_exception.ValidationError: [EFAULT] ldap_update: [EFAULT] timed out

 

[anodos]

I'm using the LDAP directory service, updated to version 11.3-U1 and also grabed the most recent activedirectory.py file I am getting this error message whenever I try connecting to the ad server.

Code:

Error: Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py", line 621, in port_is_listening
    s.connect((host, port))
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py", line 586, in do_update
    await self.middleware.call('ldap.ldap_validate', new)
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1127, in call
    app=app, pipes=pipes, job_on_progress_cb=job_on_progress_cb, io_thread=True,
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1077, in _call
    return await methodobj(*args)
  File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py", line 488, in ldap_validate
    await self.middleware.call('ldap.port_is_listening', host, int(port), data['dns_timeout'])
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1127, in call
    app=app, pipes=pipes, job_on_progress_cb=job_on_progress_cb, io_thread=True,
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1091, in _call
    return await run_method(methodobj, *args)
  File "/usr/local/lib/python3.7/site-packages/middlewared/utils/run_in_thread.py", line 10, in run_in_thread
    return await self.loop.run_in_executor(self.run_in_thread_executor, functools.partial(method, *args, **kwargs))
  File "/usr/local/lib/python3.7/site-packages/middlewared/utils/io_thread_pool_executor.py", line 25, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py", line 625, in port_is_listening
    raise CallError(e)
middlewared.service_exception.CallError: [EFAULT] timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 130, in call_method
    io_thread=False)
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1077, in _call
    return await methodobj(*args)
  File "/usr/local/lib/python3.7/site-packages/middlewared/service.py", line 302, in update
    f'{self._config.namespace}.update', self, self.do_update, [data]
  File "/usr/local/lib/python3.7/site-packages/middlewared/main.py", line 1077, in _call
    return await methodobj(*args)
  File "/usr/local/lib/python3.7/site-packages/middlewared/schema.py", line 961, in nf
    return await f(*args, **kwargs)
  File "/usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py", line 588, in do_update
    raise ValidationError('ldap_update', str(e))
middlewared.service_exception.ValidationError: [EFAULT] ldap_update: [EFAULT] timed out

LDAP and AD are separate plugins.

 

[hemlock]

LDAP and AD are separate plugins.

Gotcha, that makes sense. I should have realized that. However it seems like I'm experiencing the same issues as the people using the Active Directory Plugin. Is there anything obvious that I'm just completely missing when using the LDAP plugin?

 

[hemlock]

I reverted to 11.2-U7 boot environment and was able to connect using LDAP @anodos As soon as i switch back to 11.3-U1 boot environment i have the same time out error message now. I've downloaded all the most recent patches.

 

[anodos]

I reverted to 11.2-U7 boot environment and was able to connect using LDAP @anodos As soon as i switch back to 11.3-U1 boot environment i have the same time out error message now. I've downloaded all the most recent patches.

If you're getting a socket timeout for the LDAP plugin, you can increase the value of the DNS timeout. It's also used in the socket.connect() call that is returning the error. Maybe bump both timeout values to 30 seconds from 10.

 

[hemlock]

If you're getting a socket timeout for the LDAP plugin, you can increase the value of the DNS timeout. It's also used in the socket.connect() call that is returning the error. Maybe bump both timeout values to 30 seconds from 10.

Okay tried 30 seconds same time out with socket.connect() returning the error. Tried 60 seconds also, same thing. Do i need to have the hostname have the netbios name in it like this netbios\ad-hostname thats how i currently have it.

 

[hemlock]

If i set the timeouts high enough the operation just times out.

 

[uri]

@anodos hello! have you any suggestions about losing connection to AD after restart, that I mentioned earlier?

 

[anodos]

@anodos hello! have you any suggestions about losing connection to AD after restart, that I mentioned earlier?

You can test this WIP fix here: https://github.com/freenas/freenas/...ewared/middlewared/plugins/activedirectory.py

clone boot environment, replace /usr/local/lib/python3.7/site-packages/middlewared/plugins/activedirectory.py with it and "service middlewared onerestart".

 

[hemlock]

Currently the LDAP plugin just times out even if i set the timeout for ldap and dns to a higher number. If there is something I can do to help troubleshoot this I'm all ears. We are using Azure Active Directory, like I said this all works whenever I revert back to 11.2 however because of various reason I can't stay on that version. The settings I'm using are all identical from 11.2 to 11.3 @anodos

 

[hemlock]

Currently the LDAP plugin just times out even if i set the timeout for ldap and dns to a higher number. If there is something I can do to help troubleshoot this I'm all ears. We are using Azure Active Directory, like I said this all works whenever I revert back to 11.2 however because of various reason I can't stay on that version. The settings I'm using are all identical from 11.2 to 11.3 @anodos View attachment 36245

So when I change settings to point at a internal server not using ssl it works just fine.

 

[anodos]

So when I change settings to point at a internal server not using ssl it works just fine.

As I've already mentioned, this particular forum thread is about issues involving AD. You're using the LDAP plugin. There are several bugfixes related to the LDAP plugin in the 11.3-stable branch on github. https://raw.githubusercontent.com/f...e/src/middlewared/middlewared/plugins/ldap.py. You can try cloning your boot environment, replacing /usr/local/lib/python3.7/site-packages/middlewared/plugins/ldap.py with the version attached, and then issuing "service middlewared onerestart". If your problem persists and you don't see a corresponding bug ticket in our bug tracker, you are welcome to file one there.

 

[hemlock]

Thanks sorry for being annoying

 

[anodos]

Thanks sorry for being annoying

It's not annoying. You can also start a new forums thread and tag me there.

 

[uri]

You can test this WIP fix here: https://github.com/freenas/freenas/...ewared/middlewared/plugins/activedirectory.py

clone boot environment, replace /usr/local/lib/python3.7/site-packages/middlewared/plugins/activedirectory.py with it and "service middlewared onerestart".

Hello @anodos , I've tried this steps on monday, but after restart freenas gui become unreachable! or you have updated for this file after 2 march?