LDAP: not possible to use anonymous bind

[Jay2k1]

I've set up a v3.0.2 instance in preparation for a migration from v2. After setting up LDAP identically to the v2 instance, I cannot use it to log in, getting "This provider is not fully configured. An administrator needs to finish setting it up."

I tracked this message down in the source code and found this:

wiki/backend/modules/authentication/ldap/authentication.ts

Lines 71 to 77 in 02942fa

	if (!url || !bindDn || !searchBase || !searchFilter) {
	strategyDebug(
	this,
	`is not configured: ${missingSettings({ 'LDAP URL': url, 'Admin Bind DN': bindDn, 'Search Base': searchBase, 'Search Filter': searchFilter })}, so no login can be attempted`
	)
	throw new Error('ERR_STRATEGY_MISCONFIGURED')
	}

I suspect this snippet might be the reason I see the error, because I did not fill the Admin Bind DN and Admin Bind Credentials fields.
LDAP does not necessarily need these; there's a feature called "anonymous bind" allowing queries without a dedicated account. This has worked fine in v2. For some reason, in v3, this check makes the Admin Bind DN mandatory. I removed the || !bindDn part, enabling the LDAP provider to work as expected.

I suggest doing the same in the code.

Two more thoughts that came up while debugging this:

• if there are mandatory fields, it would be nice if this would be reflected in the web UI somehow - a red asterisk, being unable to save if a mandatory field has not been populated, something like this.
• a more detailed error message seems to be produced by strategyDebug() there. After some digging in the code, I found that I apparently need to enable the "auth debug" flag in Admin ➜ System ➜ Flags. If this needs to sit behind a default-off flag, maybe it would make sense to log a line saying something like "a log-in with a third-party auth provider failed. for detailed log messages, enable the auth debug flag in admin..." - I did check server logs but nothing was logged, and i double checked old and new LDAP settings three times to make sure I didn't forget something...

[dgesteves]

You found the right line, and it's already fixed on the 3.x branch: 4ad07c0 landed the same day you posted, but it isn't in a release yet, the latest is still 3.0.2. It drops !bindDn from that check and skips the bind entirely when the field is empty, so the search runs on an unbound connection. The field hint now says to leave it empty for anonymous search too.

Until the next release you can keep your patch or run a dev image, ghcr.io/requarks/wiki:3.0.2-dev.4ad07c0 or a newer one like 3.0.2-dev.fc365d6. Both worked for me, but they're dev builds, so I'd keep that to your test instance.

I ran 3.0.2 and those images against OpenLDAP with anonymous search allowed, same database, blank Admin Bind DN and credentials:

3.0.2              jay/jaypass   -> ERR_STRATEGY_MISCONFIGURED
                   [AUTH] is not configured: Admin Bind DN is empty, so no login can be attempted
3.0.2-dev.4ad07c0  jay/jaypass   -> authenticated
                   jay/wrongpass -> ERR_LOGIN_FAILED
                   [AUTH] searching anonymously, as no Admin Bind DN is set

The slapd log shows no BIND on the search connection, only on the password check.

If you were hoping for a no-patch trick on 3.0.2, I tried two: a dummy DN with an empty password gets UnwillingToPerformError [53] from OpenLDAP with default settings, and a single space as the DN gets InvalidDNSyntaxError [34]. On plain 3.0.2, a real bind account was the only thing that worked for me.

The commit only touches the LDAP module, so your other two ideas (marking required fields in the UI, and a log hint pointing to the auth debug flag) are still open.

[NGPixel]

Fixed in 4ad07c0. Will land in next release.