Active Directory LDAP not working

RantMaster commented

2017-02-20 21:42:53 +01:00

(Migrated from github.com)

BookStack Version:0.14.3
PHP Version:7.0
MySQL Version:5.7.12

Expected Behavior

Allows AD users to Login

Actual Behavior

BookStack throws error about Search Operators.

Hi There,

I am having trouble making this work. I have been unable to get BookStack to find the DN rather than the UID. Bookstack successfully connects to AD but fails when trying to search for the user
This is the error I get
at HandleExceptions->handleError('2', 'ldap_search(): Search: Operations error', '/var/www/BookStack/app/Services/Ldap.php', '57', array('ldapConnection' => resource, 'baseDn' => 'DC=domain,DC=local', 'filter' => '(&(dn=${user}))', 'attributes' => array('cn', 'uid', 'dn', 'mail')))

This is how I have configured my LDAP settings:

LDAP Settings
LDAP_SERVER=172.23.35.10:389
LDAP_BASE_DN="DC=domain,DC=local"
LDAP_DN="CN=ServiceAccount,OU=Users,OU=Domain,DC=Domain,DC=local"
LDAP_PASS=password
LDAP_USER_FILTER=(&(dn=${user}))
LDAP_VERSION=3

I believe this is similar to #56

Let me know if you need any more info

* BookStack Version:0.14.3 * PHP Version:7.0 * MySQL Version:5.7.12 ##### Expected Behavior Allows AD users to Login ##### Actual Behavior BookStack throws error about Search Operators. Hi There, I am having trouble making this work. I have been unable to get BookStack to find the DN rather than the UID. Bookstack successfully connects to AD but fails when trying to search for the user This is the error I get `at HandleExceptions->handleError('2', 'ldap_search(): Search: Operations error', '/var/www/BookStack/app/Services/Ldap.php', '57', array('ldapConnection' => resource, 'baseDn' => 'DC=domain,DC=local', 'filter' => '(&(dn=${user}))', 'attributes' => array('cn', 'uid', 'dn', 'mail')))` This is how I have configured my LDAP settings: LDAP Settings LDAP_SERVER=172.23.35.10:389 LDAP_BASE_DN="DC=domain,DC=local" LDAP_DN="CN=ServiceAccount,OU=Users,OU=Domain,DC=Domain,DC=local" LDAP_PASS=password LDAP_USER_FILTER=(&(dn=${user})) LDAP_VERSION=3 I believe this is similar to #56 Let me know if you need any more info

ssddanbrown commented

2017-02-23 19:48:22 +01:00

(Migrated from github.com)

Hi @RantMaster, Sorry to hear your facing LDAP troubles.

The error message posted seems a little cut-off. Would you be able to post the full error message? Here a page on getting debug messages from logs:
https://www.bookstackapp.com/docs/admin/debugging/

Hi @RantMaster, Sorry to hear your facing LDAP troubles. The error message posted seems a little cut-off. Would you be able to post the full error message? Here a page on getting debug messages from logs: https://www.bookstackapp.com/docs/admin/debugging/

btone-comm commented

2017-03-17 22:51:52 +01:00

(Migrated from github.com)

@RantMaster
For whatever reason, we were not able to do a base search off of the LDAP root, but we did find that if we bind to a container or organizational unit that is worked without issue.

Also, quotes are not needed for the LDAP_BASE_DN

Here's is out LDAP settings for comparison:

# LDAP Settings
LDAP_SERVER=IP_ADDRESS
LDAP_BASE_DN=ou=OU_NAME,dc=DOMAIN,dc=local
LDAP_DN=USER@DOMAIN.COM
LDAP_PASS=PASSWORD
LDAP_USER_FILTER=(&(uid=${user}))
LDAP_VERSION=3

@RantMaster For whatever reason, we were not able to do a base search off of the LDAP root, but we did find that if we bind to a container or organizational unit that is worked without issue. Also, quotes are not needed for the LDAP_BASE_DN Here's is out LDAP settings for comparison: ``` # LDAP Settings LDAP_SERVER=IP_ADDRESS LDAP_BASE_DN=ou=OU_NAME,dc=DOMAIN,dc=local LDAP_DN=USER@DOMAIN.COM LDAP_PASS=PASSWORD LDAP_USER_FILTER=(&(uid=${user})) LDAP_VERSION=3 ```

👍 1 ❤️ 2

comnam90 commented

2017-03-27 23:40:11 +02:00

(Migrated from github.com)

@btone-comm
Thanks man for that tip! no longer getting any errors in laravel.log when trying to login, however I'm also not able to login :/
I'm getting:

These credentials do not match our records

Any thoughts or tips on this one?

Update
Nevermind, I changed the filter from uid=${user} to SAMAccountName=${user} and that sorted it

@btone-comm Thanks man for that tip! no longer getting any errors in laravel.log when trying to login, however I'm also not able to login :/ I'm getting: > These credentials do not match our records Any thoughts or tips on this one? **Update** Nevermind, I changed the filter from `uid=${user}` to `SAMAccountName=${user}` and that sorted it

btone-comm commented

2017-03-27 23:55:11 +02:00

(Migrated from github.com)

@comnam90 Awesome!

Alwaysin commented

2017-07-10 19:45:20 +02:00

(Migrated from github.com)

For whatever reason, we were not able to do a base search off of the LDAP root, but we did find that if we bind to a container or organizational unit that is worked without issue.

Does anybody has come with a fix for this issue? I hit the same bug: https://github.com/BookStackApp/BookStack/issues/431 and cannot authenticate my users into the app :'(

> For whatever reason, we were not able to do a base search off of the LDAP root, but we did find that if we bind to a container or organizational unit that is worked without issue. Does anybody has come with a fix for this issue? I hit the same bug: https://github.com/BookStackApp/BookStack/issues/431 and cannot authenticate my users into the app :'(

ssddanbrown commented

2017-07-10 19:57:53 +02:00

(Migrated from github.com)

@Alwaysin Can you try the following:

Open the app/Services/LdapService.php file. After line 44, Add the following line:

$this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, 0);

That block of code should then look like this:

        // Find user
        $userFilter = $this->buildFilter($this->config['user_filter'], ['user' => $userName]);
        $baseDn = $this->config['base_dn'];
        $emailAttr = $this->config['email_attribute'];
        $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, 0);
        $users = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, $userFilter, ['cn', 'uid', 'dn', $emailAttr]);
        if ($users['count'] === 0) return null;

Then see if it binds on the base DN. Unfortunately I don't have active directory myself so I can't test this before deploying a fix. Let me know if this works and I'll patch it into a bugfix release.

@Alwaysin Can you try the following: 1. Open the `app/Services/LdapService.php` file. After line 44, Add the following line: ```php $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, 0); ``` That block of code should then look like this: ```php // Find user $userFilter = $this->buildFilter($this->config['user_filter'], ['user' => $userName]); $baseDn = $this->config['base_dn']; $emailAttr = $this->config['email_attribute']; $this->ldap->setOption($ldapConnection, LDAP_OPT_REFERRALS, 0); $users = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, $userFilter, ['cn', 'uid', 'dn', $emailAttr]); if ($users['count'] === 0) return null; ``` Then see if it binds on the base DN. Unfortunately I don't have active directory myself so I can't test this before deploying a fix. Let me know if this works and I'll patch it into a bugfix release.

Alwaysin commented

2017-07-10 20:09:34 +02:00

(Migrated from github.com)

With this line added, I got a new error:

Whoops, looks like something went wrong.

1/1
ErrorException in Ldap.php line 57:
ldap_search(): Search: Partial results and referral received

I hope it is going into the right direction :D

With this line added, I got a new error: ``` Whoops, looks like something went wrong. 1/1 ErrorException in Ldap.php line 57: ldap_search(): Search: Partial results and referral received ``` I hope it is going into the right direction :D

ssddanbrown commented

2017-07-10 20:14:48 +02:00

(Migrated from github.com)

@Alwaysin Do you have the following line in your .env file?

LDAP_VERSION=3

If not, Please try adding it. (Might need to run php artisan optimize after changing .env file)

@Alwaysin Do you have the following line in your `.env` file? ``` LDAP_VERSION=3 ``` If not, Please try adding it. (Might need to run `php artisan optimize` after changing .env file)

❤️ 1

Alwaysin commented

2017-07-10 20:17:31 +02:00

(Migrated from github.com)

Yes!!
That made it work!

Thank you very much @ssddanbrown :)

Yes!! That made it work! Thank you very much @ssddanbrown :)

ssddanbrown commented

2017-07-10 20:22:27 +02:00

(Migrated from github.com)

@Alwaysin Awesome, Glad to hear. I'll mark this change to be in the next bugfix release. Keep this in mind as you might have to make a configuration tweak on that update in the event there's a reason this change will have to be configurable/non-default.

👍 1

ssddanbrown commented

2017-07-10 21:58:13 +02:00

(Migrated from github.com)

Update now out to cover this.

Rows
Columns

Active Directory LDAP not working #317

Expected Behavior

Actual Behavior