openSUSE admin

After changing the port to reflect LDAPS and removing a bogus freeipa.infra.opensuse.org entry from /etc/hosts I was able to get https://beans.opensuse.org/matomo/ to no longer refuse my login, but instead to load forever upon pressing "Sign In" ("forever" = few minutes until it returns "504 Gateway Time-out").

This works (using the login configured in config.ini.php):

matomo (matomo):~ # ldapsearch -xH ldaps://freeipa.infra.opensuse.org -WD uid=widehat,cn=users,cn=accounts,dc=infra,dc=opensuse,dc=org uid=crameleon  memberOf|grep matomo
Enter LDAP Password:
memberOf: cn=matomo-user,cn=groups,cn=accounts,dc=infra,dc=opensuse,dc=org

I tried to find application logs, but there doesn't seem to be anything printed anywhere, besides the HTTP requests in the Apache httdp access log.

These are my changes:

matomo (matomo):~ # diff config.ini.old /etc/matomo/config.ini.php
212,213c212,213
< hostname = "ldaps://freeipa.infra.opensuse.org/"
< port = 389
---
> hostname = "freeipa.infra.opensuse.org"
> port = 636
226a227,231
> [log]
> log_writeres[] = file
> logger_file_path = /var/log/matomo/matomo.log
> ; ERROR, WARN, INFO, DEBUG
> log_level = DEBUG

I also tried changing the log options directly in global.ini.php but with no luck. Neither the default nor the custom file are populated - even after going as far as touch-ing the file with 666 permissions. No entries in the audit log and no luck with "log_writeres[] = syslog" either.

Handing issue back to the queue.

ddemaio wrote:

I'm getting a Error: Wrong username and/or password. with login to beans.opensuse.org The https://freeipa.infra.opensuse.org/ advisement doesn't seem to change this. I don't think the systems are connected. I think the login is independent. Image attached. hellcp might be able to solve. lvogt set it up.

UPDATE: Looks like Additional knowledge gained since this update. With openSUSE infra move, it is likely the network or system config might be causing access issues. Need someone with physical access to machine in Prague is needed to verify/fix problem. Seeing if mcaj can help.

Hi Doug,

thanks a lot for the hint. I now have the logs and will investigate further.

I resolved the issue, it is now possible to log in again.

Note though that this is not permanent - we want to decommission FreeIPA soon, and I will have to migrate Matomo to use our Heroes OIDC instead of the Heroes LDAP.

crameleon wrote in #note-10:

I resolved the issue, it is now possible to log in again.

Note though that this is not permanent - we want to decommission FreeIPA soon, and I will have to migrate Matomo to use our Heroes OIDC instead of the Heroes LDAP.

Thank you!!! It works.