failed to load plugin [ldap-auth] err: error loading module 'lualdap' from file '/usr/local/apisix/deps/lib/lua/5.1/lualdap.so':"failed to load plugin [ldap-auth]

[api7]

failed to load plugin [ldap-auth] err: error loading module 'lualdap' from file '/usr/local/apisix/deps/lib/lua/5.1/lualdap.so':"failed to load plugin [ldap-auth]

[tzssangglass]

maybe you need to install openldap-devel, like

yum install -y openldap-devel

[tzssangglass]

openldap-devel is not provided with apisix, it needs to be installed by the user.

[spacewander]

openldap-devel is expected to be installed if apisix is installed via yum, see

apisix-build-tools/package-apisix.sh

Line 10 in 0d46617

dep_ldap="openldap-devel"

[spacewander]

The EVP_KDF_ctrl is from libk5crypto which is Red Hat specific, not the libcrypto we finally use. Maybe using the libcrypto from openresty-openssl111 when installing lua-ldap can fix this problem.

[kenhys]

as @spacewander says, maybe the root of this issue is caused from:

apisix-build-tools/utils/install-common.sh

Line 98 in 222ef2e

luarocks make ./rockspec/apisix-master-${iteration}.rockspec --tree=/tmp/build/output/apisix/usr/local/apisix/deps --local

lualdap 1.2.6-1 depends on lua >= 5.1 (5.1-1 provided by VM)
gcc -O2 -fPIC -I/usr/local/openresty/luajit/include/luajit-2.1 -c src/lualdap.c -o src/lualdap.o -I/usr/include
gcc -shared -o lualdap.so src/lualdap.o -L/usr/lib64 -Wl,-rpath,/usr/lib64 -lldap -llber
Cloning into 'lua-resty-rocketmq'...
Note: switching to 'f5aca7d66b6323805aa13b26567c39042a837ed4'.

[soulbird]

lualdap.so depends on libldap-2.4.so.2

ldd /usr/local/apisix/deps/lib/lua/5.1/lualdap.so | grep libldap
ibldap-2.4.so.2 => /usr/lib64/libldap-2.4.so.2 (0x00007fe82934a000)

The libldap-2.4.so.2 dynamic library was installed via openldap-devel when installing apisix. openldap-devel uses centos8's openssl, so the EVP_KDF* symbols are introduced.

apisix-base specifies the search path of the dynamic library through rpath at build time, via: https://github.com/api7/apisix-build-tools/blob/master/build-apisix-base.sh#L94. When apisix is ​​running, it will first search for this path when loading the dynamic library. This caused libldap-2.4.so.2 to be loaded with openresty-openssl instead of the system's openssl, thus resulting in the symbol not being found. For the search path of dynamic libraries, please refer to: https://man7.org/training/download/shlib_dynlinker_slides.pdf

Therefore, the solutions are as follows:

1. Delete the installed openresty-openssl. When apisix is ​​running, it will continue to search for the system openssl. This method is rude
2. Use source code to compile and install openldap, specify openssl as openresty-openssl when compiling. But unfortunately, openldap does not support specifying openssl directories. However I found a modified way here. This seems to work, and someone has tried it in the apisix issue.