LdapRecord icon indicating copy to clipboard operation
LdapRecord copied to clipboard

Can connect with administrator credentials but cannot login

Open abhitheawesomecoder opened this issue 2 years ago • 8 comments

Environment: Ubuntu 20.04.6 LTS

  • LDAP Server Type: OpenLDAP
  • PHP Version: [ 8.2]

Describe the bug:

admin credentials are working successfully with php artisan ldap:test

LDAP_USERNAME="cn=admin,dc=domain,dc=example,dc=com"
LDAP_PASSWORD="Password"
LDAP_BASE_DN="dc=domain,dc=example,dc=com"

but when I try to login with same credetials like

protected function credentials(Request $request): array
{
   return [
	'username' => 'cn=admin,dc=domain,dc=example,dc=com',
	'password' => 'Password',
  ];
}

It is not working. I am using phpLDAPadmin which has LdapRecord as a core package

abhitheawesomecoder avatar Aug 04 '23 16:08 abhitheawesomecoder

Your username key in the returned array is incorrect. You must return a key to search your directory by. This is currently executing a search in your LDAP directory for a user containing the username attribute equal to cn=admin,dc=domain,dc=example,dc=com, which will yield no results.

You should use an attribute that will contain a unique value per user, such as samAccountName, mail, or userPrincipalName. Your admin account may not have that those attributes though, so in your circumstance, the below will work:

protected function credentials(Request $request): array
{
   return [
	'cn' => 'admin',
	'password' => 'Password',
  ];
}

stevebauman avatar Aug 04 '23 16:08 stevebauman

this is the first thing I tried but this is also not allowing login

protected function credentials(Request $request): array
	{
		// return [
		// 	'mail' => $request->get('email'),
		// 	'password' => $request->get('password'),
		// ];

		return [
			'cn' => 'admin',
			'password' => 'Password',
		];
	}

It says :

Whoops! Something went wrong?

These credentials do not match our records.

this is my slapcat

baba@MyHost:/home/myabhi# sudo slapcat dn: dc=ldap01,dc=calsob,dc=com objectClass: top objectClass: dcObject objectClass: organization o: calsob dc: ldap01 structuralObjectClass: organization entryUUID: 147bda2a-c66c-103d-993e-6dcb071e592f creatorsName: cn=admin,dc=ldap01,dc=calsob,dc=com createTimestamp: 20230803170815Z entryCSN: 20230803170815.677810Z#000000#000#000000 modifiersName: cn=admin,dc=ldap01,dc=calsob,dc=com modifyTimestamp: 20230803170815Z

dn: cn=admin,dc=ldap01,dc=calsob,dc=com objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: e1NTSEF9eG5LcFhMN0VzOVg1OORVjkTGtpR0p5YlY1WVU3Q2I= structuralObjectClass: organizationalRole entryUUID: 147c2052-c66c-103d-993f-6dcb071e592f creatorsName: cn=admin,dc=ldap01,dc=calsob,dc=com createTimestamp: 20230803170815Z entryCSN: 20230803170815.679661Z#000000#000#000000 modifiersName: cn=admin,dc=ldap01,dc=calsob,dc=com modifyTimestamp: 20230803170815Z

abhitheawesomecoder avatar Aug 04 '23 17:08 abhitheawesomecoder

Hello sir the issue is yet not resolved

On Fri, Aug 4, 2023, 10:29 PM Steve Bauman @.***> wrote:

Closed #625 https://github.com/DirectoryTree/LdapRecord/issues/625 as completed.

— Reply to this email directly, view it on GitHub https://github.com/DirectoryTree/LdapRecord/issues/625#event-10011477732, or unsubscribe https://github.com/notifications/unsubscribe-auth/AA6DATVWCBALR4OCO6SXERDXTUTA5ANCNFSM6AAAAAA3ENXMU4 . You are receiving this because you authored the thread.Message ID: @.***>

abhitheawesomecoder avatar Aug 04 '23 18:08 abhitheawesomecoder

Hi @abhitheawesomecoder,

Please post your LDAP configuration.

stevebauman avatar Aug 04 '23 18:08 stevebauman

LDAP_LOGGING=true LDAP_CONNECTION=default LDAP_HOST=ldap01.calsob.com LDAP_PORT=389 LDAP_USERNAME="cn=admin,dc=ldap01,dc=calsob,dc=com" LDAP_PASSWORD="Password" LDAP_BASE_DN="dc=ldap01,dc=calsob,dc=com" LDAP_TIMEOUT=5 LDAP_SSL=false LDAP_TLS=false LDAP_SASL=false

abhitheawesomecoder avatar Aug 04 '23 18:08 abhitheawesomecoder

I am able to login as a user Screenshot (30)

abhitheawesomecoder avatar Aug 04 '23 18:08 abhitheawesomecoder

if there was some issue with server then php artisan ldap:test won't have worked.

abhitheawesomecoder avatar Aug 04 '23 18:08 abhitheawesomecoder

I came across this answer and I think this could be the real issue, what do you think?

https://unix.stackexchange.com/questions/744327/cant-login-on-phpldapadmin-using-admin-user

I think normal admin account cannot be used for login rather it can only be used for connection.

abhitheawesomecoder avatar Aug 04 '23 18:08 abhitheawesomecoder

Hi @abhitheawesomecoder, apologies for the delayed response.

I'm honestly not sure about this. The error you're seeing is a generic "incorrect password" error. If you're encountering problems logging in with your configured administrator account, this is either environment or application related. Since I don't maintain or have any involvement in phpLDAPAdmin, I would suggest asking on their issue tracker.

stevebauman avatar May 06 '24 00:05 stevebauman