Sooo I added my LDAP directory, and had the great idea of enabling it for login to the console.
Except apparently that broke my ability to login with my admin@local account. And it doesn’t seem to be accepting any of the domain logins at the moment. Is there a way to fix this from CLI somehow, or am I fraked and need to rebuild?
Not fraked, no rebuild needed. It sounds like the directory got set as the server default (“Make it the server default” in the guide). That sends admin@local to the directory too, and if the directory connection isn’t right, nobody gets in.
To get back in, put the server in recovery mode. Add these to the server’s environment (the systemd EnvironmentFile, or -e for Docker) and restart:
INBUXA_RECOVERY_MODE=1
INBUXA_RECOVERY_ADMIN=admin:<a temporary password>
In recovery mode the mail ports stay closed and only plain HTTP on port 8080 comes up. From the server itself, put sign-in back on the internal directory:
curl -u 'admin:<password>' -H 'Content-Type: application/json' http://127.0.0.1:8080/jmap/ -d '{"using":["urn:ietf:params:jmap:core","urn:inbuxa:jmap:registry"],"methodCalls":[["x:Authentication/set",{"update":{"singleton":{"directoryId":null}}},"0"]]}'
If you also moved your domain to the directory, find its id and clear that too:
curl -u 'admin:<password>' -H 'Content-Type: application/json' http://127.0.0.1:8080/jmap/ -d '{"using":["urn:ietf:params:jmap:core","urn:inbuxa:jmap:registry"],"methodCalls":[["x:Domain/get",{"properties":["name","directoryId"]},"0"]]}'
curl -u 'admin:<password>' -H 'Content-Type: application/json' http://127.0.0.1:8080/jmap/ -d '{"using":["urn:ietf:params:jmap:core","urn:inbuxa:jmap:registry"],"methodCalls":[["x:Domain/set",{"update":{"<domain id>":{"directoryId":null}}},"0"]]}'
Then take both variables out and restart. admin@local should work again, and you can test the directory connection in the guide before moving anything to it.
Oh thank goodness. Thank you. Lol that was silly of me. Alright, thank you, I’m back in.
Okay silly Directory related question. How do I tell inbuxa to accept a self signed directory cert? Assuming another environment variable but?
Not silly at all. There’s no inbuxa variable for it. inbuxa checks the directory’s certificate against the system’s trusted CAs, so the clean fix is to trust your CA on the server: add it to the system trust store (update-ca-certificates on Debian/Ubuntu, update-ca-trust on Fedora/RHEL) and restart inbuxa. In Docker, mount a CA bundle that includes it and point SSL_CERT_FILE at it. That file replaces the default list, so it needs the public CAs in it too.
If you just want it working, the LDAP directory has an “Allow invalid certificates” setting in the console. That turns off certificate checking for the directory entirely, so I’d only use it on a network you trust.
Hmm, alright. Appreciated.
Finally got logging in with the domain to work, and now have functional domain access. Turns out I had some quickly-resolved tech debt laying around that gave me a hard time.
The new docs look excellent, by the way.
Probably going to have some incoming feature requests shortly, as a heads up!
Glad it’s all working, and thanks for the kind words on the docs. Send the feature requests whenever. Support with a feature-request tag gets them onto the tracker.
everything should look amazeballs now, just finished rethemeing everything in a test of hotdog-cms. pretty happy with the results.
[chefs kiss] looks excellent. love it all.