Tuwunel login error with old LDAP accounts

Support apps
, , ,
1

What app is this about, and its version: tuwunel 1.8.3~ynh1
What YunoHost version are you running: 12.1.40.1
What type of hardware are you using: Old laptop or computer

Describe your issue

After upgrading to version 1.8.3, attempting to log in with an old LDAP user via the client returns an error. New LDAP users log in successfully.
ChatGPT give this:
“The 1.8.3 specification explicitly mentions an LDAP change:
accounts that did not originate in LDAP and deactivated accounts are refused.
This means that starting with 1.8.3, the server intentionally checks whether an account was originally created via LDAP.
This means that search-ldap=true is insufficient. Tuwunel 1.8.3 additionally checks an internal account origin flag.”
How to fix old accounts?

Share relevant logs or error messages

v1=the server returned an error: [403 / M_FORBIDDEN] M_FORBIDDEN: Account does not permit LDAP login

2

Does the old account have tuwunel.main permission?

4

yes

5

Was the user able to log in before? If so - what’s the output of scanning rocksdb (prebuilt available here but feel free to build from source)?

Command is

sudo yunohost app shell tuwunel
./ldb --db=tuwunel-db scan --column_family=userid_origin | grep <my user>
6

Yes, it could before the update.
One of the tuwunel developers suggested a fix; it needs to be run in admin room for each old user:

!admin query raw put userid_origin @username:server ldap

Now old accounts can log in successfully.