After UCS restore can't login

Hi,

I had to recover our secondary server from a backup created 20 days ago.

After this, I’m unable to sign in with ANY user to the web interface, and only root works over ssh.

The error I’m getting on GUI is:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/univention/management/console/ldap.py", line 188, in getter
    raise KeyError()
KeyError

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/tornado/web.py", line 1595, in _execute
    result = yield result
  File "/usr/lib/python3/dist-packages/tornado/gen.py", line 1133, in run
    value = future.result()
  File "/usr/lib/python3/dist-packages/univention/management/console/resources.py", line 496, in post
    result = await session.authenticate(self.request.body_arguments)
  File "/usr/lib/python3/dist-packages/univention/management/console/session.py", line 151, in authenticate
    self.set_credentials(**result.credentials)
  File "/usr/lib/python3/dist-packages/univention/management/console/session.py", line 175, in set_credentials
    self._search_user_dn()
  File "/usr/lib/python3/dist-packages/univention/management/console/session.py", line 186, in _search_user_dn
    lo = get_machine_connection(write=False)[0]
  File "/usr/lib/python3/dist-packages/univention/management/console/ldap.py", line 144, in get_machine_connection
    return connection()
  File "/usr/lib/python3/dist-packages/univention/management/console/ldap.py", line 200, in _decorated
    kwargs[loarg], kwargs[poarg] = lo, po = getter()
  File "/usr/lib/python3/dist-packages/univention/management/console/ldap.py", line 190, in getter
    conn = connection()
  File "/usr/lib/python3/dist-packages/univention/management/console/ldap.py", line 101, in connection
    return _getMachineConnection(**kwargs)
  File "/usr/lib/python3/dist-packages/univention/admin/uldap.py", line 176, in getMachineConnection
    lo = univention.uldap.getMachineConnection(start_tls, decode_ignorelist=decode_ignorelist, ldap_master=ldap_master)
  File "/usr/lib/python3/dist-packages/univention/uldap.py", line 199, in getMachineConnection
    return access(host=server, port=port, base=ucr['ldap/base'], binddn=ucr['ldap/hostdn'], bindpw=bindpw, start_tls=start_tls, decode_ignorelist=decode_ignorelist, reconnect=reconnect)
  File "/usr/lib/python3/dist-packages/univention/uldap.py", line 298, in __init__
    self.__open(ca_certfile)
  File "/usr/lib/python3/dist-packages/univention/uldap.py", line 400, in __open
    self.bind(self.binddn, self.bindpw)
  File "/usr/lib/python3/dist-packages/univention/uldap.py", line 215, in _decorated
    return func(self, *args, **kwargs)
  File "/usr/lib/python3/dist-packages/univention/uldap.py", line 312, in bind
    self.lo.simple_bind_s(self.binddn, self.bindpw)
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 1215, in simple_bind_s
    res = self._apply_method_s(SimpleLDAPObject.simple_bind_s,*args,**kwargs)
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 1197, in _apply_method_s
    return func(self,*args,**kwargs)
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 444, in simple_bind_s
    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 749, in result3
    resp_ctrl_classes=resp_ctrl_classes
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 756, in result4
    ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 329, in _ldap_call
    reraise(exc_type, exc_value, exc_traceback)
  File "/usr/lib/python3/dist-packages/ldap/compat.py", line 44, in reraise
    raise exc_value
  File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 313, in _ldap_call
    result = func(*args,**kwargs)
ldap.INVALID_CREDENTIALS: {'desc': 'Invalid credentials'}

What do I do to get server accept LDAP credentials?

You will probably have to rejoin the server to the domain. Sounds like machine secrets changed, listener - notifier out of sync, something like that.

Mastodon