I have setup Graphite Web 0.9.9 on CentOS 6.2 x86_64 at EC2 and I'm trying to get LDAP authentication to work against 389 Directory Server. I have configured local_settings.py with:


But I still get "Authentication attempt failed" every time I try to log in. Looking at the logs on the LDAP server, it doesn't look like graphite-web is connecting to the LDAP server at all. Unfortunately, I don't see anything useful in the logs on the graphite server - I only see "access.log" and "info.log". "error.log" and "exception.log" are empty.

Any bright ideas on what can I do to further troubleshoot this?

  • If you connect using those credentials from a different ldap client can you connect? Have you tried looking at a packet capture? – Zoredache Feb 27 '12 at 20:15
  • Yes, I have LDAP authentication working in a number of other webapps ranging from mod_authnz_ldap in Apache to Tomcat to JIRA. As well as pam_ldap for Linux auth. – organicveggie Feb 28 '12 at 0:35
  • What about SELinux ? – ALex_hha Feb 25 '14 at 11:54
  • It might be easier to just use mod_authnz_ldap instead of the graphic-provided LDAP. – robbyt Jan 14 '15 at 5:20
  • 1
    missng LDAP library in python? My troubleshoot hint is to write a python scrpt to query the LDAP. This would assure you all the components are in-place. – Francesco Malvezzi Oct 25 '15 at 11:27

Did you have the python-ldap package installed on this centos 6 host?

I got this working after installing it, a minimal centos installation does not include it, and the graphite packages from epel don't mark it a a dependency. You will need to reload httpd after installing it.


Access logs should include everything about the connection request. Start with isolating firewall & try a telnet. If you can telnet, Try to run native ldapsearch against ldap server & see if it returns data.

Access logs will contain all data related to that connection. Paste access logs after sanitizing IP address to investigate the issue. You can also mail to 389-users@lists.fedoraproject.org for any issues.

  • As I mentioned in the original post, the access logs are empty. – organicveggie Aug 24 '12 at 23:07

If you're using LDAP to communicate with an Active Directory server, Try turning off referral chasing.

I added these lines to local_settings.py.

import ldap
ldap.set_option(ldap.OPT_REFERRALS, 0) 
# Critcal for preventing timeouts due to AD search referrals not supported by LDAP v3.
# http://code.google.com/p/reviewboard/issues/detail?id=1641

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.