Could not create LDAP object 'cn=super_admins,dc=webadm' (member: value #0 invalid per syntax)

Richard Palo

unread,

Apr 28, 2025, 11:07:12 AMApr 28

to RCDevs Security

First time user here with the latest webadm-2.4.3-1-x64.sh

Running with openldap, after installing webadm and launching https://localhost/admin

using 'cn=Manager,dc=mydomain,dc=com' as the proxy to set things up, I can't seem to get some webadm groups:

(mydomain.com is fictitious)

In the logfile

```

[2025-04-28 11:47:11] [127.0.0.1:53274] [Admin:6TJN6S5Z] Could not create LDAP object 'cn=super_admins,dc=webadm,dc=mydomain,dc=com' (member: value #0 invalid per syntax)
[2025-04-28 11:47:32] [127.0.0.1:40814] [Admin:6TJN6S5Z] Could not create LDAP object 'cn=super_admins,dc=webadm,dc=mydomain,dc=com' (member: value #0 invalid per syntax)
```

tried logging out and back in, but could no longer use cn=Manager, as now it wants me to log in as a user. I try my own account, but the message then is:

```

[2025-04-28 16:08:35] [127.0.0.1:50468] [Admin] Login failed for 'uid=richard,ou=People,dc=mydomain,dc=com' (user not in super admins or other admins)
```

what incantation is needed to create the needed webadm admin groups?

thx in advance

Spyridon Gouliarmis (RCDevs)

unread,

Apr 28, 2025, 11:19:58 AMApr 28

to RCDevs Security

Maybe there's some weirdness in the first member of the super_admins group it's trying to create. I'm curious as to what goes over the wire, either set the log level to something that shows the LDAP queries sent (16/BER ?), or sniff the trafic with a nice UI (like Wireshark), while you use your OpenLDAP instance over 389 without StartTLS (that's set up in /opt/webadm/conf/servers.xml).

In any case, you might get unstuck here by manually adding "uid=richard,ou=People,dc=mydomain,dc=com" to the value of super_admins in /opt/webadm/conf/webadm.conf.

Restart the webadm service after changing either of these files.

Richard Palo

unread,

Apr 28, 2025, 11:44:53 AMApr 28

to RCDevs Security

That's better (though I had to yank the dc= bits as they are apparently defaulted, perhaps via 'ldap_treebase' )

```

[2025-04-28 17:37:38] [127.0.0.1:40336] [Admin:LQMBHG4O] Login success for 'uid=richard,ou=People,dc=mydomain,dc=com' (super admin)
[2025-04-28 17:37:39] [127.0.0.1:40336] [Admin:LQMBHG4O] WebADM super admins are not setup
[2025-04-28 17:37:54] [127.0.0.1:36046] [Admin:LQMBHG4O] Could not create LDAP object 'cn=super_admins,dc=webadm,dc=mydomain,dc=com' (member: value #0 invalid per syntax)

```

Everything is 'ok' but:

```

Checking WebADM super admins
Checking super admin 'uid=richard'... Ok
Checking super admin 'cn=manager'... Ok
Checking super admin 'cn=super_admins'... Missing

```

when I click on ' Create WebADM super admin groups ' button just underneath

I get the message " Creating admin group cn=super_admins,dc=webadm,dc=mydomain,dc=com... Failed"

I'll see if I can fiddle with the log verbosity...

Thanks thus far!

cheers

Richard Palo

unread,

Apr 28, 2025, 11:48:25 AMApr 28

to RCDevs Security

> Maybe there's some weirdness in the first member of the super_admins group it's trying to create. I'm curious as to what goes over the wire, either set the log level to something that shows the LDAP queries sent (16/BER ?), or sniff the trafic with a nice UI (like Wireshark), while you use your OpenLDAP instance over 389 without StartTLS (that's set up in /opt/webadm/conf/servers.xml).

By the way, for testing I'm using ldaps on a separate server...

On Monday, April 28, 2025 at 5:19:58 PM UTC+2 Spyridon Gouliarmis (RCDevs) wrote:

Spyridon Gouliarmis (RCDevs)

unread,

Apr 28, 2025, 11:55:37 AMApr 28

to RCDevs Security

If you mean you don't have ownership of the OpenLDAP instance, and it doesn't allow plain LDAP, you can always start an stunnel to port 636 and connect locally as if it was a normal LDAP server. That's a lot of gymnastics though.

Semi-related, we have pre-packaged version of OpenLDAP meant to work well with WebADM. It's "slapd" on our repos, and also available as a self extractible on our downloads page.

Richard Palo

unread,

Apr 28, 2025, 11:59:45 AMApr 28

to RCDevs Security

Here's with debug logging... not much news...

```

[2025-04-28 17:51:11] [127.0.0.1:60066] [DEBUG:378576:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:11] [127.0.0.1:60066] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (RootDSE)
[2025-04-28 17:51:11] [127.0.0.1:60066] [DEBUG:378576:ldap_frm.php:debug_log] LDAP search: (objectclass=webadmconfig) (dc=MountPoints,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:11] [127.0.0.1:60066] [DEBUG:378576:ldap_frm.php:debug_log] LDAP search: (objectclass=webadmconfig) (dc=Domains,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:11] [127.0.0.1:60066] [DEBUG:378576:ldap_frm.php:debug_log] LDAP search: (objectclass=webadmconfig) (dc=Clients,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:11] [127.0.0.1:60066] [DEBUG:378576:ldap_frm.php:debug_log] LDAP search: (objectclass=webadmconfig) (dc=Reports,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:11] [127.0.0.1:60066] [DEBUG:378576:ldap_frm.php:debug_log] LDAP search: (objectclass=webadmconfig) (dc=OptionSets,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:11] [127.0.0.1:60066] [DEBUG:378576:ldap_frm.php:debug_log] LDAP search: (objectclass=webadmconfig) (dc=AdminRoles,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:12] [127.0.0.1:60066] [DEBUG:378576:ldap_frm.php:debug_log] LDAP search: (objectclass=webadmconfig) (dc=WebApps,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:12] [127.0.0.1:60066] [DEBUG:378576:ldap_frm.php:debug_log] LDAP search: (objectclass=webadmconfig) (dc=WebSrvs,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:12] [127.0.0.1:60066] [DEBUG:378576] Process execution time: 0.898 seconds
[2025-04-28 17:51:12] [127.0.0.1:60066] [DEBUG:378576] Starting Admin process
[2025-04-28 17:51:12] [127.0.0.1:60066] [DEBUG:378576] Process execution time: 0.002 seconds
[2025-04-28 17:51:14] [127.0.0.1:60066] [DEBUG:378576] Starting Admin process
[2025-04-28 17:51:14] [127.0.0.1:60066] [DEBUG:378576:watchd_frm.php:debug_log] Watchd Session server: Session Server 1
[2025-04-28 17:51:14] [127.0.0.1:60066] [DEBUG:378576] Process execution time: 0.004 seconds
[2025-04-28 17:51:32] [127.0.0.1:45164] [DEBUG:378577] Starting Admin process
[2025-04-28 17:51:32] [127.0.0.1:45164] [DEBUG:378577:watchd_frm.php:debug_log] Watchd Session server: Session Server 1
[2025-04-28 17:51:32] [127.0.0.1:45164] [DEBUG:378577:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:32] [127.0.0.1:45164] [DEBUG:378577:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:32] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (uid=richard,ou=People,dc=mydomain,dc=com)
[2025-04-28 17:51:32] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=manager,dc=mydomain,dc=com)
[2025-04-28 17:51:32] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=super_admins,dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:32] [127.0.0.1:45164] [Admin] Could not read LDAP object 'cn=super_admins,dc=webadm,dc=mydomain,dc=com' (No such object)
[2025-04-28 17:51:32] [127.0.0.1:45164] [Admin] Could not get super admin members for group 'cn=super_admins,dc=webadm,dc=mydomain,dc=com'
[2025-04-28 17:51:32] [127.0.0.1:45164] [Admin:EN2H7DO7] Login success for 'uid=richard,ou=People,dc=mydomain,dc=com' (super admin)
[2025-04-28 17:51:32] [127.0.0.1:45164] [DEBUG:378577:watchd_frm.php:debug_log] Watchd SQL server: SQL Server 1
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:sql_frm.php:debug_log] SQL query: INSERT INTO "Admin" ("Time","Session","Text","DN","Source","Type") VALUES (?,?,?,?,?,?)
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:sql_frm.php:debug_log] > Param #1: 2025-04-28 17:51:32
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:sql_frm.php:debug_log] > Param #2: EN2H7DO7
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:sql_frm.php:debug_log] > Param #3: Logged in with DN as super admin
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:sql_frm.php:debug_log] > Param #4: uid=richard,ou=People,dc=mydomain,dc=com
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:sql_frm.php:debug_log] > Param #5: 127.0.0.1
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:sql_frm.php:debug_log] > Param #6: INFO
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577] Process execution time: 1.157 seconds
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577] Starting Admin process
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=manager,dc=mydomain,dc=com)
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:33] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) ()
[2025-04-28 17:51:34] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (uid=richard,ou=People,dc=mydomain,dc=com)
[2025-04-28 17:51:34] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=manager,dc=mydomain,dc=com)
[2025-04-28 17:51:34] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=super_admins,dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:34] [127.0.0.1:45164] [Admin:EN2H7DO7] WebADM super admins are not setup
[2025-04-28 17:51:34] [127.0.0.1:45164] [DEBUG:378577] Process execution time: 0.611 seconds
[2025-04-28 17:51:34] [127.0.0.1:45164] [DEBUG:378577] Starting Admin process
[2025-04-28 17:51:34] [127.0.0.1:45164] [DEBUG:378577:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:34] [127.0.0.1:45190] [DEBUG:378576] Starting Admin process
[2025-04-28 17:51:34] [127.0.0.1:45190] [DEBUG:378576:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:34] [127.0.0.1:45180] [DEBUG:378578] Starting Admin process
[2025-04-28 17:51:34] [127.0.0.1:45180] [DEBUG:378578:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
<snip users>
[2025-04-28 17:51:36] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45180] [DEBUG:378578:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=Manager,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=Manager,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45180] [DEBUG:378578:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=Manager,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=Manager,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=Manager,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45180] [DEBUG:378578:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=Manager,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45180] [DEBUG:378578:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45180] [DEBUG:378578:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (ou=Group,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (ou=Group,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45180] [DEBUG:378578:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (ou=Group,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45164] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (ou=Group,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (ou=Group,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45180] [DEBUG:378578:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (ou=Group,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45164] [DEBUG:378577:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:36] [127.0.0.1:45164] [DEBUG:378577] Process execution time: 2.116 seconds
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=manager,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45180] [DEBUG:378578] Process execution time: 2.139 seconds
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) ()
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (uid=richard,ou=People,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=manager,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=super_admins,dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:36] [127.0.0.1:45190] [DEBUG:378576:watchd_frm.php:debug_log] Watchd SQL server: SQL Server 1
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=Domains,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=Clients,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=Reports,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=WebApps,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=WebSrvs,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=OptionSets,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=AdminRoles,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=MountPoints,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576] Process execution time: 4.221 seconds
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576] Starting Admin process
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576:watchd_frm.php:debug_log] Watchd Session server: Session Server 1
[2025-04-28 17:51:38] [127.0.0.1:45190] [DEBUG:378576] Process execution time: 0.001 seconds
[2025-04-28 17:51:44] [127.0.0.1:33182] [DEBUG:378577] Starting Admin process
[2025-04-28 17:51:44] [127.0.0.1:33182] [DEBUG:378577:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:44] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (uid=richard,ou=people,dc=mydomain,dc=com)
[2025-04-28 17:51:44] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=manager,dc=mydomain,dc=com)
[2025-04-28 17:51:44] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=super_admins,dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:44] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:44] [127.0.0.1:33182] [Admin:EN2H7DO7] Could not create LDAP object 'cn=super_admins,dc=webadm,dc=mydomain,dc=com' (member: value #0 invalid per syntax)
[2025-04-28 17:51:44] [127.0.0.1:33182] [DEBUG:378577:watchd_frm.php:debug_log] Watchd SQL server: SQL Server 1
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577:sql_frm.php:debug_log] SQL query: INSERT INTO "Admin" ("Time","Session","Text","DN","Source","Type") VALUES (?,?,?,?,?,?)
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577:sql_frm.php:debug_log] > Param #1: 2025-04-28 17:51:44
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577:sql_frm.php:debug_log] > Param #2: EN2H7DO7
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577:sql_frm.php:debug_log] > Param #3: Could not create Admin group 'cn=super_admins,dc=webadm,dc=mydomain,dc=com'
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577:sql_frm.php:debug_log] > Param #4: uid=richard,ou=People,dc=mydomain,dc=com
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577:sql_frm.php:debug_log] > Param #5: 127.0.0.1
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577:sql_frm.php:debug_log] > Param #6: ERROR
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577] Process execution time: 1.062 seconds
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577] Starting Admin process
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577:watchd_frm.php:debug_log] Watchd Session server: Session Server 1
[2025-04-28 17:51:45] [127.0.0.1:33182] [DEBUG:378577] Process execution time: 0.001 seconds
[2025-04-28 17:51:49] [127.0.0.1:33182] [DEBUG:378577] Starting Admin process
[2025-04-28 17:51:49] [127.0.0.1:33182] [DEBUG:378577:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:49] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=manager,dc=mydomain,dc=com)
[2025-04-28 17:51:49] [127.0.0.1:33182] [DEBUG:378577:watchd_frm.php:debug_log] Watchd LDAP server: LDAP Server
[2025-04-28 17:51:49] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) ()
[2025-04-28 17:51:49] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (uid=richard,ou=People,dc=mydomain,dc=com)
[2025-04-28 17:51:49] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=manager,dc=mydomain,dc=com)
[2025-04-28 17:51:49] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (cn=super_admins,dc=webadm,dc=mydomain,dc=com)
[2025-04-28 17:51:49] [127.0.0.1:33182] [DEBUG:378577:watchd_frm.php:debug_log] Watchd SQL server: SQL Server 1
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=Domains,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=Clients,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=Reports,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=WebApps,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=WebSrvs,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=OptionSets,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=AdminRoles,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577:ldap_frm.php:debug_log] LDAP read: (objectclass=*) (dc=MountPoints,dc=WebADM,dc=mydomain,dc=com)
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577] Process execution time: 2.305 seconds
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577] Starting Admin process
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577:watchd_frm.php:debug_log] Watchd Session server: Session Server 1
[2025-04-28 17:51:51] [127.0.0.1:33182] [DEBUG:378577] Process execution time: 0.001 seconds

```

BTW, we use

```

$ slapd -V
@(#) $OpenLDAP: slapd 2.6.9 (Nov 30 2024 20:26:14) $
```

Richard Palo

unread,

Apr 28, 2025, 12:06:34 PMApr 28

to RCDevs Security

On Monday, April 28, 2025 at 5:55:37 PM UTC+2 Spyridon Gouliarmis (RCDevs) wrote:

If you mean you don't have ownership of the OpenLDAP instance, and it doesn't allow plain LDAP, you can always start an stunnel to port 636 and connect locally as if it was a normal LDAP server. That's a lot of gymnastics though.

Semi-related, we have pre-packaged version of OpenLDAP meant to work well with WebADM. It's "slapd" on our repos, and also available as a self extractible on our downloads page.

We allow clear text on localhost of the server, but SSL/TLS on network... webadm doesn't seem to like running on our server because it's already running nginx but webadm tries to load up apache.

Do you have a dev note on proxying via nginx and using php-legacy directly on the same machine? probably much easier...

Spyridon Gouliarmis (RCDevs)

unread,

Apr 28, 2025, 12:21:14 PMApr 28

to RCDevs Security

> Here's with debug logging... not much news...

I meant, debug logs on the OpenLDAP side, something like "loglevel BER" in slapd.conf.

> @(#) $OpenLDAP: slapd 2.6.9 (Nov 30 2024 20:26:14) $

Our latest slapd, which we run most of our tests on, is based on 2.6.9. But perhaps there's some missing schema, or some attribute is wrong in webadm.conf: depending on the LDAP directory, the value of group_oclasses might change, for example, and there's also objects.xml, which tells WebADM how to interpret a particular LDAP attribute, where some subtler bugs could lie. Can you give the output of grep _oclass /opt/webadm/conf/webadm.conf ?

> We allow clear text on localhost of the server, but SSL/TLS on network... webadm doesn't seem to like running on our server because it's already running nginx but webadm tries to load up apache.

Do you have a dev note on proxying via nginx and using php-legacy directly on the same machine? probably much easier...

Depends on how much you insist on taking the usual TCP ports. If you can't get a VM without nginx hogging 443, there's always docker, and WebADM has already been run in containers by some clients (you'll be in small minority though).

We don't have anything nginx-specific, but we have a tuned Apache whose purpose is to only reverse-proxy WebADM. You can install it (package "waproxy"), leave the systemd service disabled, and examine /opt/waproxy/lib/httpd.ini to see exactly how we do it in production.

I'm not sure if php-legacy would bother WebADM, we ship our own PHP runtime, and everything is launched with the appropriate LD_LIBRARY_PATH pointing inside /opt/webadm/, etc. The software depends on the kernel, the glibc, bash & some of the GNU tools, not much more.

Spyridon Gouliarmis (RCDevs)

unread,

Apr 28, 2025, 12:24:03 PMApr 28

to RCDevs Security

My bad, there's also the possiblity of changing the ports WebADM uses. Check the env vars containing _PORT_ in /opt/webadm/bin/webadm, and redefine any you like in /opt/webadm/conf/webadm.env (doesn't exist by default).

Richard Palo

unread,

Apr 28, 2025, 12:27:58 PMApr 28

to RCDevs Security

On Monday, April 28, 2025 at 6:21:14 PM UTC+2 Spyridon Gouliarmis (RCDevs) wrote:

Our latest slapd, which we run most of our tests on, is based on 2.6.9. But perhaps there's some missing schema, or some attribute is wrong in webadm.conf: depending on the LDAP directory, the value of group_oclasses might change, for example, and there's also objects.xml, which tells WebADM how to interpret a particular LDAP attribute, where some subtler bugs could lie. Can you give the output of grep _oclass /opt/webadm/conf/webadm.conf ?

```

# grep _oclass /opt/webadm/conf/webadm.conf
container_oclasses      "container", "organizationalUnit", "organization", "domain", "locality", \
# user_oclasses is used to build the LDAP search filter with 'Domain' auth_mode.
user_oclasses           "user", "person", "inetOrgPerson", "account", "posixAccount"
group_oclasses          "group", "groupOfNames", "groupOfUniqueNames", "groupOfURLs", "posixGroup"
# webadm_account_oclasses and the 'group' objectclass to the webadm_group_oclasses.
webadm_account_oclasses "webadmAccount"
webadm_group_oclasses   "webadmGroup"
webadm_config_oclasses "webadmConfig"
```

Spyridon Gouliarmis (RCDevs)

unread,

Apr 28, 2025, 12:48:01 PMApr 28

to RCDevs Security

I've talked to the devs, and they tell me the code likely tries to create an empty group, which OpenLDAP does not allow. Our own distribution has a modified schema that allows this (aligning with AD).

The next versions of WebADM might just not create an empty group for super admins, and just display a non-fatal failure if it doesn't exist. They're still deliberating.

In your case, just create the group manually (the WebADM interface itself allows you to do this), or remove it from webadm.conf and just leave your user, so the setup script is happy.

Richard Palo

unread,

Apr 28, 2025, 1:03:48 PMApr 28

to RCDevs Security

On Monday, April 28, 2025 at 6:48:01 PM UTC+2 Spyridon Gouliarmis (RCDevs) wrote:

I've talked to the devs, and they tell me the code likely tries to create an empty group, which OpenLDAP does not allow. Our own distribution has a modified schema that allows this (aligning with AD).

The next versions of WebADM might just not create an empty group for super admins, and just display a non-fatal failure if it doesn't exist. They're still deliberating.

In your case, just create the group manually (the WebADM interface itself allows you to do this), or remove it from webadm.conf and just leave your user, so the setup script is happy.

Indeed, deleting the line 'cn=super_admins...' from super_admins gets over it and now I get the 'home' screen upon login.

Thanks, I'll tinker now with the ports to see how it goes...

Reply all

Reply to author

Forward