help with LDAP Authentication after update Malformed UTF-8

[nitalr]

after updating bookstack to 0.28.3 users are unable to connect with LDAP Authentication after some troubleshoot

when a user is login bookstack creates a new user with special character as bind

when i enable the debug (with debug enable and LDAP_DUMP_USER_DETAILS=true) i receive:
InvalidArgumentException
Malformed UTF-8 characters, possibly incorrectly encoded






the server is in a close network

if you need more information just tell me what to get...

• Exact BookStack Version 0.28.3
• PHP Version: 7.4
• Hosting Method : Apache

it is important to note everything worked before with this config just in an old version

[ssddanbrown]

Hi @nitalr,
Apologies that you are experiencing issues. Do you know what version you were on before?

Could you try setting:

LDAP_VERSION=3

in your .env file? To see if that solves the issue?

[nitalr]

Hi
the version was 0.26.4
and the LDAP Config is already have LDAP_VERSION=3 setting
i am attaching the configuration of LDAP in .env file

[ssddanbrown]

@nitalr Hmm, Was the addition of the LDAP_ID_ATTRIBUTE option recent? As far as I can remember, That has only been supported since v0.28.0. I'm assuming you're using AD?

AD provides this attribute in binary format, which can cause issues when stored.
We added support for decoding these to hex in v0.28.1/v0.28.2, So you can define the option like so:

LDAP_ID_ATTRIBUTE=BIN;objectGUID

Note, a change in the id attribute can cause existing matched users to become mis-matched. You'd need to update the External Authentication ID field for all existing users that have logged in with AD before, to allow them to continue use of their old accounts.

[nitalr]

the LDAP integration in very recent (2 months) and based on the tutorial in the site so it is possible that the config file had more then what is needed
LDAP_ID_ATTRIBUTE=BIN;objectGUID
fix the problem of decoding and it did change the format of External Authentication ID

thanks !

[rocnetBinarian]

I also have this problem on a fresh install (using the ubuntu script) of Bookstack version v0.28.3. However, in my case, I already had LDAP_ID_ATTRIBUTE=BIN;objectGUID.

Here's the relevant part of the .env (heavily edited for security's sake):

AUTH_METHOD=ldap

LDAP_SERVER=192.168.50.5:389
LDAP_BASE_DN=ou=users,dc=example,dc=com
LDAP_DN=test@example.com
LDAP_PASS='test one test two'

LDAP_USER_FILTER=(&(sAMAccountName=${user}))
LDAP_VERSION=3

LDAP_ID_ATTRIBUTE=BIN;objectGUID
LDAP_EMAIL_ATTRIBUTE=mail
LDAP_DISPLAY_NAME_ATTRIBUTE=cn

LDAP_USER_TO_GROUPS=true
LDAP_GROUP_ATTRIBUTE="memberOf"
LDAP_REMOVE_FROM_GROUPS=false

LDAP_DUMP_USER_DETAILS=true

The error thrown is the same as described above, and happens when logging in from the main login prompt. The user logging in did not have a previous account.

One possible hint: the AD server in use is...old. Is it possible LDAP_VERSION needs to be something other than 3?

[ssddanbrown]

Hi @rocnetBinarian,
Please could you let me know what happens when you set LDAP_DUMP_USER_DETAILS=false in your .env file?

Also, It'll probably be worth opening a new issue here on GitHub, specific to your case since this one is closed.

[labratm]

I had this problem and it was because i had LDAP_DUMP_USER_DETAILS=true
commenting that out fixed it. thanks