Secondary LDAP server not evaluated when the first one has failed

[bmfmancini]

When you have multiple LDAP servers configured in the auth settings the expected behaviour is that cacti will evaluate the LDAP servers from left to right

with the below failure the secondary server is not evaluated

2023-11-21 11:36:17 - AUTH LOGIN FAILED: LDAP Login Failed for user 'user' from IP Address ''.
2023-11-21 11:36:17 - AUTH LOGIN FAILED: LDAP Error: Protocol Error, Unable to bind, LDAP result: (Can't contact LDAP server) on Server (ldap hostname)
2023-11-21 11:36:17 - AUTH LDAP: Protocol Error, Unable to bind, LDAP result: (Can't contact LDAP server) on Server (ldap hostsname)
``

However in ling/ldap I see the following error conditions are checked and it does not include this error 

		/* unable to bind */
		$ldap_error = ldap_errno($ldap_conn);
		if ($ldap_error == 0x02) {
			/* protocol error */
			$output = LdapError::GetErrorDetails(LdapError::ProtocolErrorGeneral, $ldap_conn, $this->host);
		} elseif ($ldap_error == 0x31) {
			/* invalid credentials */
			$output = LdapError::GetErrorDetails(LdapError::Failure, $ldap_conn, $this->host);
		} elseif ($ldap_error == 0x32) {
			/* insufficient access */
			$output = LdapError::GetErrorDetails(LdapError::InsufficientAccess, $ldap_conn, $this->host);
		} elseif ($ldap_error == 0x51) {
			/* unable to connect to server */
			$output = LdapError::GetErrorDetails(LdapError::ConnectionUnavailable, $ldap_conn, $this->host);
		} elseif ($ldap_error == 0x55) {
			/* timeout */
			$output = LdapError::GetErrorDetails(LdapError::ConnectionTimeout, $ldap_conn, $this->host);
		} else {
			/* general bind error */
			$output = LdapError::GetErrorDetails(LdapError::ProtocolErrorBind, $ldap_conn, $this->host);
		}
	}

[TheWitness]

How did you get an empty IP address?

[bmfmancini]

I redacted it it was populated correctly though

…

On Wed, Nov 22, 2023, 08:51 TheWitness ***@***.***> wrote: How did you get an empty IP address? — Reply to this email directly, view it on GitHub <#5590 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADGEXTF3UNCUXZF4TF3G5GDYFX7ODAVCNFSM6AAAAAA7U62KU6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMRSHAYTCOBQHE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[TheWitness]

Okay

[TheWitness]

This code block, you should log an error like this

		} else {
			/* general bind error */
cacti_log("LDAP Bind failed error was $ldap_error");
			$output = LdapError::GetErrorDetails(LdapError::ProtocolErrorBind, $ldap_conn, $this->host);
		}

[TheWitness]

give it a whirl again @bmfmancini.

[bmfmancini]

Tested good!