LDAP sync doesnt work with Active Directory

[StfnGe]

Debug mode

• I have enabled debug mode
• I have read checked the Common Issues page

Describe the bug

When i try to connect our AD to our local SnipeIT Instance, i always receive the error "500 Server Error. Please check your server logs for more information."

When i change the login credentials for example i receive the error that those are not correct. So SnipeIT establishes the connection but runs into an issue here. These are my settings:

Server: ldap://DNSNAME (pingable and nc able to the ldap port of that server)
Bind: CN=Administrator,OU=_ADMINISTRATION,DC=company,DC=de
Base Bind DN: OU=Users,DC=company,DC=de
LDAP Filter: &(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))
Username field: samaccountname
Last Name: sn
First Name: givenname
LDAP Auth query: sAMAccountName=
LDAP Version: 3

Reproduction steps

1. Setup LDAP Connection
2. Click on test connection
3. Receive 500 Server Error.

Expected behavior

LDAP Connection succeds

Screenshots

Snipe-IT Version

6.0.1

Operating System

Ubuntu 22.04 LTS

Web Server

Apache

PHP Version

8.1.2

Operating System

No response

Browser

No response

Version

No response

Device

No response

Operating System

No response

Browser

No response

Version

No response

Error messages

[08:17:49] LOG.error: Error: Object of class LDAP\Connection could not be converted to string in /var/www/snipe-it/app/Models/Ldap.php:307
Stack trace:
#0 /var/www/snipe-it/app/Http/Controllers/Api/SettingsController.php(50): App\Models\Ldap::findLdapUsers()
#1 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/Controller.php(54): App\Http\Controllers\Api\SettingsController->ldaptest()
#2 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(45): Illuminate\Routing\Controller->callAction()
#3 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/Route.php(262): Illuminate\Routing\ControllerDispatcher->dispatch()
#4 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/Route.php(205): Illuminate\Routing\Route->runController()
#5 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/Router.php(721): Illuminate\Routing\Route->run()
#6 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(128): Illuminate\Routing\Router->Illuminate\Routing\{closure}()
#7 /var/www/snipe-it/app/Http/Middleware/CheckPermissions.php(24): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#8 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): App\Http\Middleware\CheckPermissions->handle()
#9 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/Middleware/ThrottleRequests.php(127): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#10 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/Middleware/ThrottleRequests.php(63): Illuminate\Routing\Middleware\ThrottleRequests->handleRequest()
#11 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\Routing\Middleware\ThrottleRequests->handle()
#12 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Auth/Middleware/Authenticate.php(44): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#13 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\Auth\Middleware\Authenticate->handle()
#14 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Auth/Middleware/Authenticate.php(44): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#15 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\Auth\Middleware\Authenticate->handle()
#16 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(103): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#17 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/Router.php(723): Illuminate\Pipeline\Pipeline->then()
#18 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/Router.php(698): Illuminate\Routing\Router->runRouteWithinStack()
#19 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/Router.php(662): Illuminate\Routing\Router->runRoute()
#20 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Routing/Router.php(651): Illuminate\Routing\Router->dispatchToRoute()
#21 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(167): Illuminate\Routing\Router->dispatch()
#22 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(128): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}()
#23 /var/www/snipe-it/vendor/livewire/livewire/src/DisableBrowserCache.php(19): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#24 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Livewire\DisableBrowserCache->handle()
#25 /var/www/snipe-it/vendor/barryvdh/laravel-debugbar/src/Middleware/InjectDebugbar.php(67): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#26 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Barryvdh\Debugbar\Middleware\InjectDebugbar->handle()
#27 /var/www/snipe-it/vendor/fruitcake/laravel-cors/src/HandleCors.php(52): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#28 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Fruitcake\Cors\HandleCors->handle()
#29 /var/www/snipe-it/app/Http/Middleware/PreventBackHistory.php(23): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#30 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): App\Http\Middleware\PreventBackHistory->handle()
#31 /var/www/snipe-it/app/Http/Middleware/SecurityHeaders.php(26): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#32 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): App\Http\Middleware\SecurityHeaders->handle()
#33 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#34 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ConvertEmptyStringsToNull.php(31): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle()
#35 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull->handle()
#36 /var/www/snipe-it/app/Http/Middleware/CheckForDebug.php(25): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#37 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): App\Http\Middleware\CheckForDebug->handle()
#38 /var/www/snipe-it/app/Http/Middleware/CheckForSetup.php(25): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#39 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): App\Http\Middleware\CheckForSetup->handle()
#40 /var/www/snipe-it/vendor/fideloper/proxy/src/TrustProxies.php(57): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#41 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Fideloper\Proxy\TrustProxies->handle()
#42 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#43 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\View\Middleware\ShareErrorsFromSession->handle()
#44 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(121): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#45 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\Session\Middleware\StartSession->handleStatefulRequest()
#46 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\Session\Middleware\StartSession->handle()
#47 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php(86): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#48 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance->handle()
#49 /var/www/snipe-it/app/Http/Middleware/NoSessionStore.php(28): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#50 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(167): App\Http\Middleware\NoSessionStore->handle()
#51 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(103): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#52 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(142): Illuminate\Pipeline\Pipeline->then()
#53 /var/www/snipe-it/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(111): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter()
#54 /var/www/snipe-it/public/index.php(52): Illuminate\Foundation\Http\Kernel->handle()
#55 {main}

Additional context

No response

[welcome]

👋 Thanks for opening your first issue here! If you're reporting a 🐞 bug, please make sure you include steps to reproduce it. We get a lot of issues on this repo, so please be patient and we will get back to you as soon as we can.

[snipe]

We've been testing this specifically with AD, so I'm sure it does work, it just might need some configuration tweaks. @uberbrady can you take a look?

[g33kphr33k]

Hopefully this helps. This is working absolutely fine on Debian 11, Nginx, PHP8.1 with all of the correct php extensions.

Make sure that your DC can be resolved by name correctly on your web host.

[StfnGe]

We've been testing this specifically with AD, so I'm sure it does work, it just might need some configuration tweaks. @uberbrady can you take a look?

Just tested again. I can't get it to work. Also tested just IP usage for the ldap:// address and the other ad's replicas as well. Via commandline "php artisan snipeit:ldap-sync --summary" i'll always receive the error message "Object of class LDAP\Connection could not be converted to string".

[uberbrady]

What version of PHP are you running? The "LDAP\Connection" change is only with PHPv8.1 - which we are trying to support, but I'd be curious to hear if you have better luck running against PHPv8.0

[StfnGe]

I had PHPv8.1.2 running but i now downgraded to version PHP 8.0.19 and it works flawlessly immediately. So there seems to be an issue with PHPv8.1.2.

[snipe]

@uberbrady is there anything we can do to make this forward-compatible now?

[RP-TG]

This definitely seems to be a regression, we were on (I believe) v5.1.3 running under php 7.4, I ran "php upgrade.php" expecting to go to v5.1.10 (?) as there was no blog post about v6 being released, instead the script updated us to v6/master and now our previously perfectly working ldap connection to local AD servers produces the same 500 server error page.

Existing user logins work fine, but new logins we have just tried to set up don't work.

[snipe]

As far as we're aware, this isn't a regression, and we didn't post a blog post because it would be identical to the release notes, which are pretty detailed. php upgrade always updates to master, and always has, unless you give it a branch or a tag name. It does appear as though there is a potential issue with PHP 8.1.x, but 7.4.x-8.0.x should work fine.

[RP-TG]

All I can tell you is it was working fine coupling php7.4 + v5.1.3 and now no longer seems to work with php7.4 + v6.
Our ldap config hasn't changed, but if I browse to the People -> LDAP Sync page, as soon as I hit Synchronize, i'll now get a http 500.
I've just seen v6.0.1 was released, updated again to that, but the behaviour is still broken.

EDIT: Just flicked on debugging helpfully, error displayed is "ErrorException: Trying to access array offset on value of type null" from app/Http/Controllers/Users/LDAPImportController.php:60

I'd respectfully suggest most people are likely coming from your website, and may not be familiar with github, so having a release notes section exclusively there isn't the most visible.

[snipe]

The only way to download Snipe-IT is via Github, so it would be kind of weird for them not to be familiar with it. We do not provide downloads directly from the website. Our mailing list announcement also sent people directly to the releases page. Our blog is the least viewed of all of our assets, as it has something like 8 subscribers (it's pretty new.)

We reworked a lot of the LDAP functionality (which was previously not-ideal for larger directories) in v6, but it's not broken, as you can see from the OP on this issue.

If you could be more specific with respect to the specific 500 error you're seeing (via the logs), that would be more helpful.

[snipe]

EDIT: Just flicked on debugging helpfully, error displayed is "ErrorException: Trying to access array offset on value of type null" from app/Http/Controllers/Users/LDAPImportController.php:60

Thanks, that at least gives us something to work with.

[snipe]

What do you get if you run the LDAP sync directly via cli?

[RP-TG]

Sorry, can you simple simon for me the command you want me to run?

[snipe]

https://snipe-it.readme.io/docs/ldap-sync

Snipe-IT Documentation

LDAP Sync

You can set up a cron to automatically sync LDAP users using the following: location and location_id are optional. So for example, if you know the location_id of the location you're trying to add the users to, you could use: Or if you know the name of the location, you could use: See the full docume...

[RP-TG]

"php artisan snipeit:ldap-sync" seemed to run with no issues

[RP-TG]

Additionally, going to "Update LDAP/AD Settings" webpage and running the "Test LDAP Sync" button works fine:

" Successfully connected to LDAP server. Successfully bound to LDAP server. A sample of 10 users returned from the LDAP server based on your settings:"

[uberbrady]

Another option to try is:

php artisan snipeit:ldap-sync --json_summary - curious to see if you get any further output?

[RP-TG]

"php artisan snipeit:ldap-sync --json_summary" gives no output, however "php artisan snipeit:ldap-sync --summary" gives a full output of all our users being updated ok.
I have even made a change to an AD user and this has been captured successfully as shown in "php artisan snipeit:ldap-sync --summary"

[RussellLeVasseur]

I am seeing the same issue. I downgraded from 8.1 to 7.4 and got successful LDAP queries without changing a single LDAP setting.

I was able to Test LDAP Login with 8.1, but Test LDAP Synchronization failed with 500 on PHP 8.1.

[uberbrady]

I don't know why the autolinking isn't working, but this PR: #11197 might fix it (it did for me).

[snipe]

I think you have to mention the linked ticket in the body of the PR now :(