caused by http://projects.theforeman.org/issues/7369

Does the refresh button on your external user groups also just hang?

I have no idea how should it works because we use only one group in AD and use it in ldap filter.
Seems it fails in different way:
I've added group, tried to add mapping to AD it fails with "POST /usergroups/1-admins HTTP/1.1" 500"

Started PUT "/usergroups/1-admins" for 10.128.60.25 at 2015-05-01 08:26:17 +0000
2015-05-01 08:26:17 [I] Processing by UsergroupsController#update as HTML
2015-05-01 08:26:17 [I] Parameters: {"utf8"=>"✓", "authenticity_token"=>"...............blanked.........................", "usergroup"=>{"name"=>"admins", "user_ids"=>[""], "admin"=>"1", "role_ids"=>["", "9"], "external_usergroups_attributes"=>{"0"=>{"_destroy"=>"false", "name"=>"Server Administration Team", "auth_source_id"=>"2"}, "new_external_usergroups"=>{"_destroy"=>"false", "name"=>"", "auth_source_id"=>"2"}}}, "commit"=>"Submit", "id"=>"1-admins"}
2015-05-01 08:26:17 [I]

But it had been added because item and button appeared. When I click refresh button - get this
LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException
LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException
app/models/auth_sources/auth_source_ldap.rb:114:in `users_in_group'
app/models/external_usergroup.rb:32:in `users'
app/models/external_usergroup.rb:18:in `refresh'
app/controllers/external_usergroups_controller.rb:5:in `refresh'
app/controllers/concerns/application_shared.rb:13:in `set_timezone'
app/models/concerns/foreman/thread_session.rb:32:in `clear_thread'
lib/middleware/catch_json_parse_errors.rb:9:in `call'

the same for rake task

[v-foreman ~]# foreman-rake ldap:refresh_usergroups
Apipie cache enabled but not present yet. Run apipie:cache rake task to speed up API calls.
Workaround for RbVmomi may not work as ComputeResource is already loaded: ComputeResource
User group Server Administration Team could not be refreshed - LDAP source LDAP-v-dc not available: LdapFluff::ActiveDirectory::MemberService::UIDNotFoundException

#10509 will provide a workaround by disabling this feature, but I don't understand yet why it's hanging.

If you have the ability to install a nightly version of Foreman on a test server, please do so and enable debugging (http://projects.theforeman.org/projects/foreman/wiki/Troubleshooting#How-do-I-enable-debugging) as nightly builds now have LDAP debugging. It might show us what it's attempting to do.

I've installed the latest via git clone, Version 1.9.0-develop.
Enabled debug.
Created the ldap, with one group.
With User Sync off, able to log in, however, have to do a group refresh before user as access.
With User Sync enabled, logging in hangs. LDAP-op search loops in a set of groups. Another user attempted to login with same result with a different group looping. Recovery is to kill the process.

What layout are those groups Tom? Is one a member of the other?

Not sure what you mean by layout. The groups are owners of other multiple groups the id is a member of so the group is repeated a couple of times using powershell to list out the groups, recursively. They are not direct members of each other, however, with this many groups(~180) it may be possible.

Hello,

This fixes it for me: https://github.com/theforeman/ldap_fluff/pull/43

in 1.9.0 issue still exists but unchecking 'Usergroup sync' make it work

The loop has been fixed in https://github.com/theforeman/ldap_fluff/pull/43 and https://github.com/theforeman/ldap_fluff/pull/44.

But this is not the end of the story. If your logins are not lowercase, your groups will be considered empty. this should be solved on the foreman side.

Also, as performance of ActiveDirectory is very low, an option do disable recursive search would be better.

I will try to work on those, but I'm very busy currently.