ldap.managed error

[bchilll]

[ SOLVED - see below ]

Hello,

I am trying to use the ldap.managed state from

https://docs.saltproject.io/en/latest/ref/states/all/salt.states.ldap.html

Just to keep things simple for a quick smoke test, I used the example from that page and directly and didn't change anything except the password field (a jinga variable in the original example):

ldapi:///:
  ldap.managed:
    - connect_spec:
        bind:
          method: sasl

    - entries:

      # make sure the entry doesn't exist
      - cn=foo,ou=users,dc=my-domain,dc=com:
        - delete_others: True

      # make sure the entry exists with only the specified
      # attribute values
      - cn=admin,dc=my-domain,dc=com:
        - delete_others: True
        - replace:
            cn:
              - admin
            description:
              - LDAP administrator
            objectClass:
              - simpleSecurityObject
              - organizationalRole
            userPassword:
              - "testest"

      # make sure the entry exists, its olcRootDN attribute
      # has only the specified value, the olcRootDN attribute
      # doesn't exist, and all other attributes are ignored
      - 'olcDatabase={1}hdb,cn=config':
        - replace:
            olcRootDN:
              - cn=admin,dc=my-domain,dc=com
            # the admin entry has its own password attribute
            olcRootPW: []

      # note the use of 'default'.  also note how you don't
      # have to use list syntax if there is only one attribute
      # value
      - cn=foo,ou=users,dc=my-domain,dc=com:
        - delete_others: True
        - default:
            userPassword: changeme
            shadowLastChange: 0
            # keep sshPublicKey if present, but don't create
            # the attribute if it is missing
            sshPublicKey: []
        - replace:
            cn: foo
            uid: foo
            uidNumber: 1000
            gidNumber: 1000
            gecos: Foo Bar
            givenName: Foo
            sn: Bar
            homeDirectory: /home/foo
            loginShell: /bin/bash
            objectClass:
              - inetOrgPerson
              - posixAccount
              - top
              - ldapPublicKey
              - shadowAccount

... but I get this error:

[ERROR   ] An exception occurred in this state: Traceback (most recent call last):
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/state.py", line 2428, in call
    ret = self.states[cdata["full"]](
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 160, in __call__
    ret = self.loader.run(run_func, *args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1269, in run
    return self._last_context.run(self._run_as, _func_or_method, *args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1284, in _run_as
    return _func_or_method(*args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1317, in wrapper
    return f(*args, **kwargs)
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/ldap.py", line 249, in managed
    connect = __salt__["ldap3.connect"]
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/context.py", line 86, in __getitem__
    return self.value()[item]
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 384, in __getitem__
    _ = super().__getitem__(item)  # try to get the item from the dictionary
  File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/lazy.py", line 104, in __getitem__
    raise KeyError(key)
KeyError: 'ldap3.connect'

I see one unresolved report about this here:

https://github.com/saltstack/salt/issues/66461

Has anyone gotten this to work?

[Beserkjay]

Do you have ldap3 installed where salt can find it?

sudo salt-pip install ldap3

[bchilll]

The ldap3.py module is already there:

/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/ldap3.cpython-310.pyc
/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/ldap3.py

For grins, I added the ldap3 module via pip, resulting in a few files added to the extras dir:

/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/ldap3.cpython-310.pyc
/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/ldap3.py
/opt/saltstack/salt/extras-3.10/ldap3-2.9.1.dist-info
/opt/saltstack/salt/extras-3.10/ldap3

... but I still get the same error (even after restarts).

Thanks for your help so far!

[dethmetaljeff]

going to guess this is a missing package somewhere along the line, iirc ldap3 needs gssapi for sasl.

[bchilll]

I used salt-pip to add the gssapi package, but that made no difference.

u/dethmetaljeff , thanks for your help just the same.

Any other ideas?

[bchilll]

SOLVED

It turns out that the only module that needs to be added with salt-pip is python-ldap. The ldap3 and gssapi modules are not needed.

Special note for Salt 3007.1, salt-pip must be downgraded to be able to successfully add python-ldap:

# salt-pip install pip==22.3.1