Skip to content

Enabling LDAP lost admin access #2031

Description

@kabaga

Describe the bug
According the Bookstackapp instruction, to enable LDAP, the LDAP parameters need to be added to the .env file. The issue that I am having is when I login to the web UI using the local Bookstack admin account, then change the AUTH_METHOD from standard to ldap. Bookstack logs me out. When I try to login again, Bookstack gives me an error stating "These credentials do not match our records."

LDAP works because I can login with my ldap user account, but no admin privilege.

I couldn't get the LDAPS to work at all.

Steps To Reproduce
Steps to reproduce the behavior:

  1. Add the LDAP parameters to the .env file
  2. Change the AUTH_METHOD to standard
  3. On the Bookstack web UI, login using the local admin account
  4. Change the AUTH_METHOD to ldap
  5. Refresh the web UI page
  6. Bookstack bring you back to the login page
  7. Login with the local admin account will fail and gives out error message "These credentials do not match our records."
  8. Login with ldap account works, but no admin level access

Expected behavior
Step 6 should not kick me out and should allow me to continue working on ‘External Authentication ID’

Screenshots
n/a

Your Configuration (please complete the following information):

  • Exact BookStack Version (Found in settings): v0.28.3
  • PHP Version: 7.3.16 according to the containers php -v
  • Hosting Method (Nginx/Apache/Docker): Docker container from Linuxserver.io

Additional context
I am using Univention as my LDAP server. Here is the .env LDAP parameters.

AUTH_METHOD=ldap
LDAP_SERVER=10.0.7.40:7389
#LDAP_SERVER=ldaps://10.0.7.40:7636
LDAP_BASE_DN=dc=example,dc=com
LDAP_DN=uid=bookstack,cn=users,dc=example,dc=com
LDAP_PASS=password
LDAP_USER_FILTER=(&(uid=${user}))
LDAP_VERSION=3
LDAP_ID_ATTRIBUTE=uid
LDAP_EMAIL_ATTRIBUTE=mail
LDAP_DISPLAY_NAME_ATTRIBUTE=uid
LDAP_USER_TO_GROUPS=true
LDAP_GROUP_ATTRIBUTE="memberOf"
LDAP_REMOVE_FROM_GROUPS=false
LDAP_AUTO_CONFIRM_EMAIL=true
LDAP_TLS_INSECURE=false
LDAP_FOLLOW_REFERRALS=true
APP_DEBUG=true

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions