Help with "Connection reset by peer (os error 104)" error

[Alumni1506]

I'm attempting to get LLDAP to work with Duo Authenticator proxy. With the product, it is possible to do a one way sync from openldap to the proxy server. My intention is to use Duo's service to provide 2fa for jellyfin.
The issue that I am having is that i keep getting the following error and I'm not sure how to fix it?
🚨 [error]: [LDAPS] Service Error: while handling incoming messages: while receiving LDAP op: Connection reset by peer (os error 104)

[nitnelave]

Hi! I don't know the details of your system or how you configured it, but I'm willing to bet that you configured duo to hit the LDAPS port, but speaking plain (unencrypted) LDAP.

[Alumni1506]

I tried. IP:3890 with plain Authentication type and Clear transport type. Also tried IP:6360, with plain Authentication type and LDAPS transportation type (generated a self certified cert). Both yield the same error mentioned above for what ever reason.

The Duo Authentication Proxy - Is an on-premises software service that will allow a Directory Sync to send queries to on-premises Microsoft AD or Open LDAP directories. Before using Linux I thought I confirm the system works using windows. I've been able to get the Duo Authentication Proxy manager to connect with LLDAPS but the sycning part

[nitnelave]

Have a look at this thread, another user managed to make it work with Duo : https://www.answeroverflow.com/m/1179334907546320896

[Alumni1506]

I had a look which led me to enabling debug mode in duo. I get the following

2023-12-29T22:43:25.144192+0000 [Uninitialized] C->S LDAPMessage(id=7, value=LDAPBindRequest(version=3, dn='ro_admin', auth='****', sasl=False), controls=None)
2023-12-29T22:43:25.233195+0000 [LdapSyncClientProtocol,DI38CGJVGCR5YBEFSXMZ,client] C<-S LDAPMessage(id=7, value=LDAPBindResponse(resultCode=64, errorMessage=b'Missing DN value'), controls=None)
2023-12-29T22:43:25.233972+0000 [duoauthproxy.lib.log#critical] LDAP bind failed
	Traceback (most recent call last):
	  File "twisted\internet\defer.pyc", line 1101, in _runCallbacks
	    
	  File "twisted\internet\defer.pyc", line 2092, in gotResult
	    
	  File "twisted\internet\defer.pyc", line 1993, in _inlineCallbacks
	    
	  File "twisted\python\failure.pyc", line 518, in throwExceptionIntoGenerator
	    
	--- <exception caught here> ---
	  File "duoauthproxy\modules\drpc_plugins\ldap_base.pyc", line 320, in _ldap_search_base
	    
	  File "twisted\internet\defer.pyc", line 1993, in _inlineCallbacks
	    
	  File "twisted\python\failure.pyc", line 518, in throwExceptionIntoGenerator
	    
	  File "duoauthproxy\lib\ldap\client.pyc", line 863, in perform_bind
	    
	  File "twisted\internet\defer.pyc", line 1997, in _inlineCallbacks
	    
	  File "duoauthproxy\lib\ldap\client.pyc", line 618, in perform_bind_plain
	    
	ldaptor.protocols.ldap.ldaperrors.LDAPNamingViolation: namingViolation: Missing DN value

It seems to be saying I am missing a DN valve but I have tried the follow

DC=example,DC=com (which should the correct DN as it contains both users and groups)
OU=people,DC=example,DC=com

[Alumni1506]

Figured it out.

The user name requested in Duo needs to be the full DN for ro_admin i.e uid=ro_admin,ou=people,dc=example,dc=com
I was only putting ro_admin which the validation system for duo says is correct but in fact is not.

[nitnelave]

Amazing! Could you maybe submit a configuration guide for duo, so that the next person doesn't have to figure this out all over again (with their amazing error messages about the connection getting dropped...)

[Alumni1506]

One last thing, I'm getting the error
Selected group "jellyfin-users" is missing required attribute: entrydn
Is there a way to add the above attribute?

Duo's documentation mentions the following

Copied from https://duo.com/docs/ldapsync#prerequisites:

Synced groups must have the groupOfNames object class.
Synced groups must list their members by DN (directoryName) via themember attribute.
Synced groups must have a cn attribute, used as the Duo group name after import.
Synced users must have the organizationalPerson object class.

Users:

Synced users or admins must list group memberships by DN using the memberOf attribute (via the [memberOf overlay](http://www.openldap.org/software/man.cgi?query=slapo-memberof&sektion=5&apropos=0&manpath=OpenLDAP+2.4-Release)).
Synced users or admins must have the organizationalPerson object class.
Synced groups must also have the attributes entrydn (used as the distinguished name) and entryuuid (the user unique identifier).

[nitnelave]

It's a bit weird that they're asking for entrydn instead of just using dn.

Can you open an issue? That should be fairly simple to add.

[Alumni1506]

That's done now, see entry #780

[Alumni1506]

And fixed! Can you try with the latest version?

Just attempted the sync with no luck. I posted the log for the sync attempt on issue #780. Shall i move it here or keep it as it is?