# LDAP deactivated: why?
**URL:** https://community.zammad.org/t/ldap-deactivated-why/14743
**Category:** Technical assistance
**Created:** [June 26, 2024, 9:26am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743 "2024-06-26T09:26:56Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@fluca1978](https://community.zammad.org/u/fluca1978)
#### Post date: [June 26, 2024, 9:26am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/1 "2024-06-26T09:26:56Z")
Using Zammad 6.3.1, I configured the LDAP integration as shown in [https://admin-docs.zammad.org/en/latest/system/integrations/ldap/manage.html](https://admin-docs.zammad.org/en/latest/system/integrations/ldap/manage.html). During the configuration, the system has shown examples of extracted attributed correctly.
It worked for a while, resulting in:
```auto
LDAP user to Zammad user (66331):
Users: 0 created, 0 updated, 0 untouched, 66331 skipped, 0 failed, 0 deactivated
```
and in fact in the integration panel the LDAP source results `Info: Sync cancelled. Ldap integration deactivated. Activate via the switch.` and cannot be reactivated. There should be a configuration problem, but how can I figure it out?
---
### Author:  [@fluca1978](https://community.zammad.org/u/fluca1978)
#### Post date: [June 27, 2024, 11:39am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/2 "2024-06-27T11:39:24Z")
Uhm, I’ve destroyed and recreated the LDAP source from scratch, but now the progress bar in the UI is not moving at all, and in the logs I found a lot of entries as follows:
````auto
I, [2024-06-27T13:35:52.092283#508-150200] INFO -- : Started GET "/api/v1/integration/ldap/job_start?_=1719487875703" for 192.169.3.51 at 2024-06-27 13:35:52 +0200
I, [2024-06-27T13:35:52.096271#508-150200] INFO -- : Processing by Integration::LdapController#job_start_index as JSON
```
I've around 6500 entries in LDAP, but after more than 30 minutes the progress bar has not moved at all, and there is no response (neither the error of the original post).
I suspect the system is in an unknown state, since if I click on the closing 'X' on the progress bar window (after 30 minutes or so), the Zammad UI works, but I see that there are no LDAP sources even if there is an alert to restart synchronization that has been disabled.
Ideas about what to dig?
````
---
### Author:  [@fluca1978](https://community.zammad.org/u/fluca1978)
#### Post date: [June 27, 2024, 11:56am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/3 "2024-06-27T11:56:14Z")
Argh! After a while, I realized that the above log entries were generated by the UI in order to update the progress bar, and have nothing to do with the real LDAP activity.
However, I’m not able to see any related activity in the logs.
---
### Author:  [@fliebe92](https://community.zammad.org/u/fliebe92)
#### Post date: [June 27, 2024, 12:03pm UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/4 "2024-06-27T12:03:22Z")
When the import is not started at all, please, check your background worker.
---
### Author:  [@fluca1978](https://community.zammad.org/u/fluca1978)
#### Post date: [June 27, 2024, 1:57pm UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/5 "2024-06-27T13:57:48Z")
I’ve made the synchronization work the first time, and in the end I got `29 users created`.
Fine, but in `Settings` → `Users` there is nothing.
Then I entered again in the `settings` → `Integrations` and in the LDAP panel I’ve
```auto
Last sync
06/27/2024 3:55 pm - 06/27/2024 3:55 pm
Info: Sync cancelled. Ldap integration deactivated. Activate via the switch.
```
and _no log entries_ at all. If I click on the sync button, after a few seconds I got again the message that the sync is deactivated.
How can I dig into this?
---
### Author:  [@skip](https://community.zammad.org/u/skip)
#### Post date: [June 27, 2024, 4:08pm UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/6 "2024-06-27T16:08:52Z")
Have you tried to set the Zammad log do debug?
`vi /opt/zammad/config/environments/production.rb`
Change `config.log_level = :info` to `config.log_level = :debug`
restart zammad and see if there is more information in the log file
Once done, turn it back to `:info`
And another thing, install and set up `logrotate` since the log does not automatically rotate or compress, here is the [task for ansible](https://codeberg.org/antonionardella/ansible-zammad/src/branch/main/distributed/ansible/roles/zammad-custom/tasks/logrotate.yml)
---
### Author:  [@MrGeneration](https://community.zammad.org/u/MrGeneration)
#### Post date: [June 27, 2024, 4:17pm UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/7 "2024-06-27T16:17:30Z")
> [@skip](#):
>
> install and set up `logrotate` since the log does not automatically rotate or compress
That’s new to me for package installations. I’ve never seen a package installation that doesn’t rotate log files.
Also, suggesting debug logging within a productive installation is a bad idea. You will miss all relevant information if the system is under load.
---
### Author:  [@skip](https://community.zammad.org/u/skip)
#### Post date: [June 27, 2024, 4:47pm UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/8 "2024-06-27T16:47:00Z")
> [@MrGeneration](#):
>
> Also, suggesting debug logging within a productive installation is a bad idea. You will miss all relevant information if the system is under load.
I am always open to read and learn about the better solution
And I also act according to Cunningham’s law 😉
---
### Author:  [@skip](https://community.zammad.org/u/skip)
#### Post date: [June 27, 2024, 4:59pm UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/9 "2024-06-27T16:59:10Z")
BTW, not sure where it is written that we are talking about a production system either 🤓
---
### Author:  [@MrGeneration](https://community.zammad.org/u/MrGeneration)
#### Post date: [June 27, 2024, 5:15pm UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/10 "2024-06-27T17:15:28Z")
Alright. You got this skip. We have a thread sonewhere here on how to debug ldap connections. Possibly outdated by now nit sure. Good luck. 😉
---
### Author:  [@skip](https://community.zammad.org/u/skip)
#### Post date: [June 27, 2024, 5:25pm UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/11 "2024-06-27T17:25:02Z")
I love treasure hunts! 🏴☠️
Who knows what one can find arrr 🦜
> [@Problems LDAP Agent-Sync - disabled users](https://community.zammad.org/t/problems-ldap-agent-sync-disabled-users/4770/6):
>
> I’m sorry, you’re right. For the full debugging experience, put the following into e.g. ldap\_debug.rb into /opt/zammad : # redirect app logging Rails.logger = Logger.new('debug.log').tap do |logger| logger.level = :debug end ActiveRecord::Base.logger = Rails.logger.clone ImportJob.create(name: 'Import::Ldap', payload: {}).start require 'mixin/rails\_logger' module Mixin module RailsLogger def self.logger @logger ||= Logger.new(log\_to).tap do |logger| logger.level = :d…
---
### Author:  [@skip](https://community.zammad.org/u/skip)
#### Post date: [June 27, 2024, 5:25pm UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/12 "2024-06-27T17:25:55Z")
🤩
> [@LDAP Sync - Error Log File](https://community.zammad.org/t/ldap-sync-error-log-file/3771/2):
>
> You can temporary use a debug log which -might- help to find the user being affected. Normally Zammad recognizes duplicate users, I guess you have two LDAP users with the same mail address. For the debug log, take a look at this answer from Thorsten:
---
### Author:  [@fluca1978](https://community.zammad.org/u/fluca1978)
#### Post date: [July 2, 2024, 6:56am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/13 "2024-07-02T06:56:55Z")
While I’m trying to run the application program from the other thread, I enabled the debug log for a while and found the following:
```auto
I, [2024-07-01T15:34:33.444554#48972-149480] INFO -- : Parameters: {"limit"=>"50", "_"=>"1719840542534", "facility"=>"ldap"}
D, [2024-07-01T15:34:33.456166#48972-149480] DEBUG -- : HttpLog Load (0.2ms) SELECT "http_logs".* FROM "http_logs" WHERE "http_logs"."facility" = $1 ORDER BY "http_logs"."created_at" DESC LIMIT $2 [["facility", "ldap"], ["LIMIT", 50]]
I, [2024-07-01T15:34:35.910093#48972-149540] INFO -- : Started GET "/api/v1/integration/ldap/job_start?_=1719840542535" for 155.185.3.51 at 2024-07-01 15:34:35 +0200
I, [2024-07-01T15:34:35.914167#48972-149540] INFO -- : Processing by Integration::LdapController#job_start_index as JSON
D, [2024-07-01T15:34:35.920847#48972-149540] DEBUG -- : Permission Load (0.1ms) SELECT "permissions".* FROM "permissions" WHERE "permissions"."name" = $1 LIMIT $2 [["name", "admin.integration.ldap"], ["LIMIT", 1]]
D, [2024-07-01T15:34:35.922076#48972-149540] DEBUG -- : Permission Exists? (0.6ms) SELECT 1 AS one FROM "permissions" INNER JOIN "permissions_roles" ON "permissions"."id" = "permissions_roles"."permission_id" INNER JOIN "roles" ON "permissions_roles"."role_id" = "roles"."id" INNER JOIN "roles_users" ON "roles"."id" = "roles_users"."role_id" WHERE "roles_users"."user_id" = $1 AND "roles"."active" = $2 AND "permissions"."active" = $3 AND "permissions"."name" IN ($4, $5, $6) LIMIT $7 [["user_id", 3], ["active", true], ["active", true], ["name", "admin"], ["name", "admin.integration"], ["name", "admin.integration.ldap"], ["LIMIT", 1]]
D, [2024-07-01T15:34:35.924581#48972-149540] DEBUG -- : ImportJob Load (0.1ms) SELECT "import_jobs".* FROM "import_jobs" WHERE "import_jobs"."name" = $1 AND "import_jobs"."dry_run" = $2 AND "import_jobs"."finished_at" IS NULL ORDER BY "import_jobs"."started_at" DESC, "import_jobs"."id" DESC LIMIT $3 [["name", "Import::Ldap"], ["dry_run", false], ["LIMIT", 1]]
```
Apparently, if I get it right, it is blaming about a missing permission, but I’m using the administrator account, so what am I really missing? The documentation does not talk about any particular permission needed before the integration is configured.
---
### Author:  [@fliebe92](https://community.zammad.org/u/fliebe92)
#### Post date: [July 3, 2024, 5:58am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/14 "2024-07-03T05:58:05Z")
Hi @fluca1978. I cannot see any error in your log.
---
### Author:  [@fluca1978](https://community.zammad.org/u/fluca1978)
#### Post date: [July 3, 2024, 6:16am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/15 "2024-07-03T06:16:04Z")
@fliebe92 I was confused from the log message `Permission Exists?` thinking it was an error message, now I understand it stands for something like “check if the permission exists”.
So, any suggestion on what to search for to understand why the integration job seems to complete succsfully but users are not listed in the available users/groups?
---
### Author:  [@MrGeneration](https://community.zammad.org/u/MrGeneration)
#### Post date: [July 3, 2024, 10:19am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/16 "2024-07-03T10:19:23Z")
The catchphrase `ERROR` is usually a very pointing one. Not sure if that applies here as well.
---
### Author:  [@fluca1978](https://community.zammad.org/u/fluca1978)
#### Post date: [July 3, 2024, 10:32am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/17 "2024-07-03T10:32:27Z")
After a better inspection, I found the following errors while doing the initial LDAP synchronization:
```auto
I, [2024-07-03T12:01:55.494663#505-149100] INFO -- : Skipping. No Role assignment found for login 'bvalmori'
I, [2024-07-03T12:01:55.498363#505-149100] INFO -- : Skipping. No Role assignment found for login 'francr'
I, [2024-07-03T12:01:55.501636#505-149100] INFO -- : Skipping. No Role assignment found for login 'dfish'
...
I, [2024-07-03T12:01:55.514668#505-149100] INFO -- : 2024-07-03T12:01:55+0200: [Worker(host:zammad-test pid:505)] Job AsyncImportJob [61989e27-8a4d-469b-b792-a8a7386245b4] from DelayedJob(default) with arguments: [{"_aj_globalid"=>"gid://zammad/ImportJob/11"}] (id=71) (queue=default) COMPLETED after 321.7847
```
Therefore, I suspect that even if the dialog at the end of the synchronization reports that 29 users and 29 groups have been created, these are somehow in a bad state and hence not visible.
Now, I double checked and the configuration for the LDAP integration selects the correct LDAP group (where the 29 users are) and assigns the `agent` profile.
Also, the UI does not show any “Recent Log” and does not mention any skipped user (`skipped: 0`).
---
### Author:  [@fluca1978](https://community.zammad.org/u/fluca1978)
#### Post date: [July 8, 2024, 11:46am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/18 "2024-07-08T11:46:23Z")
I’m still at the point I cannot understand what is going wrong with my LDAP integration.
I started a fresh installation of zammad, so all clean data.
I did the configuration of the LDAP source, that completed with (apparently) detecting users and groups, but then the integration is deactivated.
_No recent logs are shown in the UI_.
Digging into the database, I can provide you the following:
```auto
$ sudo -u postgres psql -c 'select name, started_at, finished_at, result from import_jobs;' -x zammad | cat -
-[RECORD 1]-----------------------------------------------------------------------------
name | Import::Ldap
started_at | 2024-07-08 11:14:32.094
finished_at | 2024-07-08 11:22:32.871
result | --- +
| skipped: 0 +
| created: 66183 +
| updated: 1 +
| unchanged: 0 +
| failed: 0 +
| deactivated: 0 +
| sum: 66184 +
| total: 66184 +
| role_ids: +
| 3: +
| skipped: 0 +
| created: 66154 +
| updated: 1 +
| unchanged: 0 +
| failed: 0 +
| deactivated: 0 +
| sum: 66155 +
| total: 0 +
| 2: +
| skipped: 0 +
| created: 29 +
| updated: 0 +
| unchanged: 0 +
| failed: 0 +
| deactivated: 0 +
| sum: 29 +
| total: 0 +
|
-[RECORD 2]-----------------------------------------------------------------------------
name | Import::Ldap
started_at | 2024-07-08 11:23:28.952
finished_at | 2024-07-08 11:23:28.956
result | --- +
| info: Sync cancelled. Ldap integration deactivated. Activate via the switch.+
|
-[RECORD 3]-----------------------------------------------------------------------------
name | Import::Ldap
started_at | 2024-07-08 11:32:40.791
finished_at | 2024-07-08 11:32:40.798
result | --- +
| info: Sync cancelled. Ldap integration deactivated. Activate via the switch.+
|
-[RECORD 4]-----------------------------------------------------------------------------
name | Import::Ldap
started_at | 2024-07-08 11:33:37.651
finished_at | 2024-07-08 11:33:37.656
result | --- +
| info: Sync cancelled. Ldap integration deactivated. Activate via the switch.+
|
-[RECORD 5]-----------------------------------------------------------------------------
name | Import::Ldap
started_at | 2024-07-08 11:34:02.657
finished_at | 2024-07-08 11:34:02.663
result | --- +
| info: Sync cancelled. Ldap integration deactivated. Activate via the switch.+
|
-[RECORD 6]-----------------------------------------------------------------------------
name | Import::Ldap
started_at | 2024-07-08 11:34:50.099
finished_at | 2024-07-08 11:34:50.109
result | --- +
| info: Sync cancelled. Ldap integration deactivated. Activate via the switch.+
|
```
The table `users` contains 3 rows, in the UI there is nothing showing “imported” users and groups. I don’t have any particular log entry that I can see in the logs, neither errors:
```auto
$ sudo tail -f /var/log/zammad/production.log | grep -i error
```
shows nothing for all the LDAP integration phase, even when clicking on the sync-now button.
I’ve then tried to create the following Ruby file:
```auto
$ sudo cat /opt/zammad/ldap.rb
require 'mixin/rails_logger'
module Mixin
module RailsLogger
def self.logger
@logger ||= Logger.new(log_to).tap do |logger|
logger.level = :debug
end
end
def self.log_to
# STDOUT
'/var/log/zammad/ldap.log'
end
end
end
print( "Starting" )
ImportJob.create(name: 'Import::Ldap').start
print( "endingg" )
```
Assuming I’m not a ruby developer, I launched it as:
```auto
$ sudo -u zammad zammad run rails r ldap.rb
Startingendingg
```
Nothing appears, and there is no such a file like `ldap.log`.
I really need some advice because I’m stuck on this.
---
### Author:  [@system](https://community.zammad.org/u/system)
#### Post date: [July 15, 2024, 11:46am UTC](https://community.zammad.org/t/ldap-deactivated-why/14743/19 "2024-07-15T11:46:35Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.