Add LDAP with sftpgo-plugin-auth

[vdobrv]

Good day

Ubuntu 22.04
SFTPGO 2.6.2 - latest
sftpgo-plugin-auth - latest

I'm trying to connect LDAP
But for some reason there's a permissions error
Although I've already tried all possible permissions
Please tell me what could be wrong?

sftpgo.json - didn't touch

my conf
nano /etc/sftpgo/env.d/sftpgo-plugin-auth

SFTPGO_PLUGIN_AUTH_LDAP_URL="ldap://ldap.domain.local:389"
SFTPGO_PLUGIN_AUTH_LDAP_BASE_DN="dc=domain,dc=local"
SFTPGO_PLUGIN_AUTH_LDAP_BIND_DN="cn=sftpgo,ou=sftpgo,ou=service,ou=domain-users,dc=domain,dc=local"
SFTPGO_PLUGIN_AUTH_LDAP_USERNAME="sftpgo"
SFTPGO_PLUGIN_AUTH_LDAP_PASSWORD="sftpgo"
SFTPGO_PLUGIN_AUTH_LDAP_SEARCH_QUERY="(&(objectClass=user)(sAMAccountName=%username%))"
#SFTPGO_PLUGIN_AUTH_PRIMARY_GROUP_PREFIX="sftpgo"
#SFTPGO_PLUGIN_AUTH_REQUIRE_GROUPS=true
SFTPGO_PLUGIN_AUTH_SKIP_TLS_VERIFY=1
SFTPGO_PLUGIN_AUTH_CACHE_TIME=60
SFTPGO_PLUGINS__0__TYPE=auth
SFTPGO_PLUGINS__0__AUTH_OPTIONS__SCOPE=5
SFTPGO_PLUGINS__0__CMD="/etc/sftpgo/plugins/sftpgo-plugin-auth"
SFTPGO_PLUGINS__0__ARGS="serve"
SFTPGO_PLUGINS__0__AUTO_MTLS=1

my error

Aug 18 17:21:43 sftpgo systemd[1]: Started SFTPGo Server.
░░ Subject: A start job for unit sftpgo.service has finished successfully
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ A start job for unit sftpgo.service has finished successfully.
░░
░░ The job identifier is 10546.
Aug 18 17:21:43 sftpgo sudo[27146]: pam_unix(sudo:session): session closed for user root
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"info","time":"2024-08-18T17:21:43.401","sender":"service","message":"starting SFTPGo 2.6.2-636a1c2c-2024-06-21T17:21:25Z +metrics +azblob +gcs +s3 +bolt +mysql +pgsql +sqlite -unixcrypt +portable, config dir: /etc/sftpgo, config file: , log max size: 10 log max backups: 5 log max age: 28 log level: debug, log compress: false, log utc time: false, load data from: \"\", grace time: 0 secs"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"info","time":"2024-08-18T17:21:43.402","sender":"config","message":"set env vars from file \"/etc/sftpgo/env.d/sftpgo-plugin-auth\""}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.408","sender":"config","message":"config file used: '\"/etc/sftpgo/sftpgo.json\"', config loaded: {Common:{IdleTimeout:15 UploadMode:0 Actions:{ExecuteOn:[] ExecuteSync:[] Hook:} SetstatMode:0 RenameMode:0 ResumeMaxSize:0 TempPath: ProxyProtocol:0 ProxyAllowed:[] ProxySkipped:[] StartupHook: PostConnectHook: PostDisconnectHook: DataRetentionHook: MaxTotalConnections:0 MaxPerHostConnections:20 AllowListStatus:0 AllowSelfConnections:0 DefenderConfig:{Enabled:false Driver:memory BanTime:30 BanTimeIncrement:50 Threshold:15 ScoreInvalid:2 ScoreValid:1 ScoreLimitExceeded:3 ScoreNoAuth:0 ObservationTime:30 EntriesSoftLimit:100 EntriesHardLimit:150 LoginDelay:{Success:0 PasswordFailed:1000}} RateLimitersConfig:[{Average:0 Period:1000 Burst:1 Type:2 Protocols:[SSH FTP DAV HTTP] GenerateDefenderEvents:false EntriesSoftLimit:100 EntriesHardLimit:150}] Umask: ServerVersion: Metadata:{Read:0} idleTimeoutAsDuration:0 idleLoginTimeout:0 defender:<nil> allowList:<nil> rateLimitersList:<nil> proxyAllowed:[] proxySkipped:[]} ACME:{Email: KeyType:4096 CertsPath:/var/lib/sftpgo/certs CAEndpoint:https://acme-v02.api.letsencrypt.org/directory Domains:[] RenewDays:30 HTTP01Challenge:{Port:80 WebRoot: ProxyHeader:} TLSALPN01Challenge:{Port:0} accountConfigPath: accountKeyPath: lockPath: tempDir:} SFTPD:{Bindings:[{Address: Port:2022 ApplyProxyConfig:true}] MaxAuthTries:0 HostKeys:[] HostCertificates:[] HostKeyAlgorithms:[] KexAlgorithms:[] MinDHGroupExchangeKeySize:2048 Ciphers:[] MACs:[] PublicKeyAlgorithms:[] TrustedUserCAKeys:[] RevokedUserCertsFile: LoginBannerFile: EnabledSSHCommands:[md5sum sha1sum sha256sum cd pwd scp] KeyboardInteractiveAuthentication:true KeyboardInteractiveHook: PasswordAuthentication:true certChecker:<nil> parsedUserCAKeys:[]} FTPD:{Bindings:[{Address: Port:0 ApplyProxyConfig:true TLSMode:0 TLSSessionReuse:0 CertificateFile: CertificateKeyFile: MinTLSVersion:12 ForcePassiveIP: PassiveIPOverrides:[] PassiveHost: ClientAuthType:0 TLSCipherSuites:[] PassiveConnectionsSecurity:0 ActiveConnectionsSecurity:0 IgnoreASCIITransferType:0 Debug:false ciphers:[]}] BannerFile: CertificateFile: CertificateKeyFile: CACertificates:[] CARevocationLists:[] ActiveTransfersPortNon20:true DisableActiveMode:false EnableSite:false HASHSupport:0 CombineSupport:0 PassivePortRange:{Start:50000 End:50100} acmeDomain:} WebDAVD:{Bindings:[{Address: Port:0 EnableHTTPS:false CertificateFile: CertificateKeyFile: MinTLSVersion:12 ClientAuthType:0 TLSCipherSuites:[] Protocols:[] Prefix: ProxyAllowed:[] ClientIPProxyHeader: ClientIPHeaderDepth:0 DisableWWWAuthHeader:false allowHeadersFrom:[]}] CertificateFile: CertificateKeyFile: CACertificates:[] CARevocationLists:[] Cors:{AllowedOrigins:[] AllowedMethods:[] AllowedHeaders:[] ExposedHeaders:[] AllowCredentials:false Enabled:false MaxAge:0 OptionsPassthrough:false OptionsSuccessStatus:0 AllowPrivateNetwork:false} Cache:{Users:{ExpirationTime:0 MaxSize:50} MimeTypes:{Enabled:true MaxSize:1000 CustomMappings:[]}} acmeDomain:} ProviderConf:{Driver:sqlite Name:/var/lib/sftpgo/sftpgo.db Host: Port:0 Username: Password: SSLMode:0 DisableSNI:false TargetSessionAttrs: RootCert: ClientCert: ClientKey: ConnectionString: SQLTablesPrefix: TrackQuota:2 PoolSize:0 UsersBaseDir:/srv/sftpgo/data Actions:{ExecuteOn:[] ExecuteFor:[] Hook:} ExternalAuthHook: ExternalAuthScope:0 PreLoginHook: PostLoginHook: PostLoginScope:0 CheckPasswordHook: CheckPasswordScope:0 UpdateMode:0 PasswordHashing:{BcryptOptions:{Cost:10} Argon2Options:{Memory:65536 Iterations:1 Parallelism:2} Algo:bcrypt} PasswordValidation:{Admins:{MinEntropy:0} Users:{MinEntropy:0}} PasswordCaching:true DelayedQuotaUpdate:0 CreateDefaultAdmin:false NamingRules:5 IsShared:0 Node:{Host: Port:0 Proto:http} BackupsPath:/srv/sftpgo/backups} HTTPDConfig:{Bindings:[{Address: Port:80 EnableWebAdmin:true EnableWebClient:true EnableRESTAPI:true EnabledLoginMethods:0 EnableHTTPS:false CertificateFile: CertificateKeyFile: MinTLSVersion:12 ClientAuthType:0 TLSCipherSuites:[] Protocols:[] ProxyAllowed:[] ClientIPProxyHeader: ClientIPHeaderDepth:0 HideLoginURL:0 RenderOpenAPI:true OIDC:{ClientID: ClientSecret: ClientSecretFile: ConfigURL: RedirectBaseURL: UsernameField: RoleField: ImplicitRoles:false Scopes:[openid profile email] CustomFields:[] InsecureSkipSignatureCheck:false Debug:false provider:<nil> verifier:<nil> providerLogoutURL: oauth2Config:<nil>} Security:{Enabled:false AllowedHosts:[] AllowedHostsAreRegex:false HostsProxyHeaders:[] HTTPSRedirect:false HTTPSHost: HTTPSProxyHeaders:[] STSSeconds:0 STSIncludeSubdomains:false STSPreload:false ContentTypeNosniff:false ContentSecurityPolicy: PermissionsPolicy: CrossOriginOpenerPolicy: proxyHeaders:[]} Branding:{WebAdmin:{Name: ShortName: LogoPath: FaviconPath: DisclaimerName: DisclaimerPath: DefaultCSS:[] ExtraCSS:[]} WebClient:{Name: ShortName: LogoPath: FaviconPath: DisclaimerName: DisclaimerPath: DefaultCSS:[] ExtraCSS:[]}} allowHeadersFrom:[]}] TemplatesPath:templates StaticFilesPath:static OpenAPIPath:openapi WebRoot: CertificateFile: CertificateKeyFile: CACertificates:[] CARevocationLists:[] SigningPassphrase: SigningPassphraseFile: TokenValidation:0 MaxUploadFileSize:0 Cors:{AllowedOrigins:[] AllowedMethods:[] AllowedHeaders:[] ExposedHeaders:[] AllowCredentials:false Enabled:false MaxAge:0 OptionsPassthrough:false OptionsSuccessStatus:0 AllowPrivateNetwork:false} Setup:{InstallationCode: InstallationCodeHint:Installation code} HideSupportLink:false acmeDomain:} HTTPConfig:{Timeout:20 RetryWaitMin:2 RetryWaitMax:30 RetryMax:3 CACertificates:[] Certificates:[] SkipTLSVerify:false Headers:[] customTransport:<nil>} CommandConfig:{Timeout:30 Env:[] Commands:[]} KMSConfig:{Secrets:{URL: MasterKeyPath: MasterKeyString: masterKey:}} MFAConfig:{TOTP:[{Name:Default Issuer:SFTPGo Algo:sha1 algo:0}]} TelemetryConfig:{BindPort:0 BindAddress:127.0.0.1 EnableProfiler:false AuthUserFile: CertificateFile: CertificateKeyFile: TLSCipherSuites:[] MinTLSVersion:12 Protocols:[]} PluginsConfig:[{Type:auth NotifierOptions:{FsEvents:[] ProviderEvents:[] ProviderObjects:[] LogEvents:[] RetryMaxTime:0 RetryQueueMaxSize:0} KMSOptions:{Scheme: EncryptedStatus:} AuthOptions:{Scope:5} Cmd:/etc/sftpgo/plugins/sftpgo-plugin-auth Args:[[redacted]] SHA256Sum: AutoMTLS:true EnvPrefix: EnvVars:[] kmsID:0}] SMTPConfig:{Host: Port:587 From: User: Password: AuthType:0 Encryption:0 Domain: TemplatesPath:templates Debug:0 OAuth2:{Provider:0 Tenant: ClientID: ClientSecret: RefreshToken: mu:<nil> config:<nil> accessToken:<nil>}}}"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"info","time":"2024-08-18T17:21:43.409","sender":"kms","message":"secret provider registered for scheme: \"local\", encrypted status: \"Secretbox\""}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"info","time":"2024-08-18T17:21:43.409","sender":"kms","message":"secret provider registered for scheme: \"builtin\", encrypted status: \"AES-256-GCM\""}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.409","sender":"dataprovider_sqlite","message":"sqlite database handle created, connection string: \"file:/var/lib/sftpgo/sftpgo.db?cache=shared&_foreign_keys=1\""}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.410","sender":"dataprovider_sqlite","message":"sql database is up to date, current version: 29"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.410","sender":"dataprovider_sqlite","message":"absolute backup path \"/srv/sftpgo/backups\""}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.410","sender":"plugins","message":"initialize"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.413","sender":"dataprovider_sqlite","message":"delayed quota update loop started, wait time: 0s"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.413","sender":"dataprovider_sqlite","message":"delayed quota update loop ended, wait time: 0s"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.427","sender":"plugins","message":"no match for plugin process /etc/sftpgo/plugins/sftpgo-plugin-auth"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.427","sender":"plugins","message":"create new auth plugin \"/etc/sftpgo/plugins/sftpgo-plugin-auth\""}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.427","sender":"plugins","message":"adding env vars with prefix \"SFTPGO_PLUGIN_AUTH_\" for plugin \"/etc/sftpgo/plugins/sftpgo-plugin-auth\""}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.427","sender":"plugins","message":"additional env vars for plugin \"/etc/sftpgo/plugins/sftpgo-plugin-auth\": []"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"info","time":"2024-08-18T17:21:43.427","sender":"plugins.auth","message":"configuring client automatic mTLS"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"debug","time":"2024-08-18T17:21:43.443","sender":"plugins","message":"unable to get rpc client for auth plugin \"/etc/sftpgo/plugins/sftpgo-plugin-auth\": fork/exec /etc/sftpgo/plugins/sftpgo-plugin-auth: permission denied"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"warn","time":"2024-08-18T17:21:43.444","sender":"plugins","message":"unable to create auth plugin: fork/exec /etc/sftpgo/plugins/sftpgo-plugin-auth: permission denied, config {Type:auth NotifierOptions:{FsEvents:[] ProviderEvents:[] ProviderObjects:[] LogEvents:[] RetryMaxTime:0 RetryQueueMaxSize:0} KMSOptions:{Scheme: EncryptedStatus:} AuthOptions:{Scope:5} Cmd:/etc/sftpgo/plugins/sftpgo-plugin-auth Args:[serve] SHA256Sum: AutoMTLS:true EnvPrefix: EnvVars:[] kmsID:0}"}
Aug 18 17:21:43 sftpgo sftpgo[27150]: {"level":"error","time":"2024-08-18T17:21:43.444","sender":"service","message":"unable to initialize plugin system: fork/exec /etc/sftpgo/plugins/sftpgo-plugin-auth: permission denied"}
Aug 18 17:21:43 sftpgo systemd[1]: sftpgo.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ An ExecStart= process belonging to unit sftpgo.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Aug 18 17:21:43 sftpgo systemd[1]: sftpgo.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: http://www.ubuntu.com/support
░░
░░ The unit sftpgo.service has entered the 'failed' state with result 'exit-code'.
Aug 18 17:21:48 sftpgo sudo[27189]:     root : TTY=pts/1 ; PWD=/etc/sftpgo ; USER=root ; COMMAND=/usr/bin/journalctl -xe
Aug 18 17:21:48 sftpgo sudo[27189]: pam_unix(sudo:session): session opened for user root(uid=0) by dobroadmin(uid=0)

What I tried

sudo chmod 755 /etc/sftpgo/plugins/sftpgo-plugin-auth
sudo chmod 755 /etc/sftpgo/plugins
sudo chmod 755 /etc/sftpgo
sudo chown sftpgo:sftpgo /etc/sftpgo/plugins/sftpgo-plugin-auth
sudo chmod +x /etc/sftpgo/plugins/sftpgo-plugin-auth

sudo chmod +x /etc/sftpgo/plugins/sftpgo-plugin-auth
sudo chown root:root /etc/sftpgo/plugins/sftpgo-plugin-auth

sudo chmod +x /etc/sftpgo/plugins/sftpgo-plugin-auth
sudo chown root:root /etc/sftpgo/plugins/sftpgo-plugin-auth

ls -l /etc/sftpgo/plugins/sftpgo-plugin-auth
sudo chmod +x /etc/sftpgo/plugins/sftpgo-plugin-auth
ls -l /etc/sftpgo/plugins/sftpgo-plugin-auth
sudo chown root:root /etc/sftpgo/plugins/sftpgo-plugin-auth

[vdobrv]

root@sftp:~# ls -l /opt/sftpgo/plugin/sftpgo-plugin-auth
total 88
drwxr-xr-x 2 sftpgo sftpgo 4096 Jun 18 20:16 authenticator
drwxr-xr-x 2 sftpgo sftpgo 4096 Jun 18 20:16 cmd
-rwxr-xr-x 1 sftpgo sftpgo 1459 Jun 18 20:16 go.mod
-rwxr-xr-x 1 sftpgo sftpgo 14202 Jun 18 20:16 go.sum
-rwxr-xr-x 1 sftpgo sftpgo 34523 Jun 18 20:16 LICENSE
drwxr-xr-x 2 sftpgo sftpgo 4096 Jun 18 20:16 logger
-rwxr-xr-x 1 sftpgo sftpgo 790 Jun 18 20:16 main.go
-rwxr-xr-x 1 sftpgo sftpgo 5596 Jun 18 20:16 README.md
drwxr-xr-x 2 sftpgo sftpgo 4096 Jun 18 20:16 res
drwxr-xr-x 2 sftpgo sftpgo 4096 Jun 18 20:16 test

[vdobrv]

Its a FILE!!
AAAAAAAAAA
sftpgo-plugin-auth - its a not a FOLDER
Its a FILE!!

[RickeyWard]

I'm sure you're over it now, but the issue is that you have all the docker compose environment variables in quotes, that's what the README has, but that doesn't work. It tries to use the escaped quotes in the file path blows up. Just strip off all the double quotes in the environment variables

specifically
SFTPGO_PLUGINS__0__CMD="/etc/sftpgo/plugins/sftpgo-plugin-auth
should be
SFTPGO_PLUGINS__0__CMD=/etc/sftpgo/plugins/sftpgo-plugin-auth

but as soon as you fix that, you'll get a different error, so just remove them all.