Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Not able to use LDAP/AD login, There was an error authenticating the LDAP user: Could not find user in LDAP directory #6509

Closed
madslorenzen opened this issue Dec 14, 2018 · 42 comments
Closed

Not able to use LDAP/AD login, There was an error authenticating the LDAP user: Could not find user in LDAP directory #6509

madslorenzen opened this issue Dec 14, 2018 · 42 comments
Labels
ldap

Comments

@madslorenzen
Copy link

Please confirm you have done the following before posting your bug report:

Describe the bug
A clear and concise description of what the bug is.
We are unable to login with via LDAP. This error is shown : production.ERROR: There was an error authenticating the LDAP user: Could not find user in LDAP directory
LDAP connection test from LDAP settings page is successful, but when trying to test with user credentials further down, it fails. We have tried many diffrent ways, read just about all bug reports and troubleshooted after them, but no luck.

To Reproduce
Steps to reproduce the behavior:

  1. Setup LDAP integration with AD
  2. Test LDAP connction with success
  3. Try to login with AD user
  4. See error

Expected behavior
I would expect to be able to login with AD credentials.

Screenshots
If applicable, add screenshots to help explain your problem.

Server (please complete the following information):

  • Snipe-IT Version v4.6.6 build 3926 (g1a10aa0dd)
  • OS: Windows 2016 x64
  • Web Server: WAMP
  • PHP Version 7.0.32

Desktop (please complete the following information):

  • OS: Windows 10 x64
  • Browser Chrome + Internet Explorer
  • Version 71.0.3578.98, 11.407.17134.0

Error Messages

  • WITH DEBUG TURNED ON, if you're getting an error in your browser, include that error
    Debug mode turned on, Login Failed. USER did not successfully bind to LDAP.
  • If a stacktrace is provided in the error, include that too.
    no.
  • Any errors that appear in your browser's error console.
    no
  • Confirm whether the error is reproducible on the demo: https://snipeitapp.com/demo.
    No (It is AD / LDAP)
  • Include any additional information you can find in storage/logs and your webserver's logs.

Additional context

  • Is this a fresh install or an upgrade?
    Fresh
  • What OS and web server you're running Snipe-IT on
  • Snipe-IT Version v4.6.6 build 3926 (g1a10aa0dd)
  • OS: Windows 2016 x64
  • Web Server: WAMP
  • PHP Version 7.0.32
  • What method you used to install Snipe-IT (install.sh, manual installation, docker, etc)
    Manual Installation
  • Include what you've done so far in the installation, and if you got any error messages along the way.
    Everything runs, except the issue.
  • Indicate whether or not you've manually edited any data directly in the database
    We did not.

Add any other context about the problem here.

Please do not post an issue without answering the related questions above. If you have opened a different issue and already answered these questions, answer them again, once for every ticket. It will be next to impossible for us to help you.
@madslorenzen
Copy link
Author

All users are imported on LDAP sync although ending up not being able to login.
Ive checked the ldap filer many times.

@madslorenzen
Copy link
Author

Any luck in finding a cause for our issue ?

@HinchK
Copy link
Contributor

HinchK commented Dec 18, 2018 •
edited
Loading

Hello @madslorenzen!

It sounds like your authentication query is off:
image

Are you connecting to active directory? I've seen case-sensitivity issues with this field in particular.
https://snipe-it.readme.io/docs/ldap-sync-login

If you have exhausted all possibilities, and it continues to be an issue - please let me know! 👍

@madslorenzen
Copy link
Author

Hi HinchK, Thank you for your reply.
We have tried many different settings for the LDAP AD Authentication Query - it has been tried with both uid=, samaccountname= and sAMAccountName= . The setting is now set as sAMAccountName= and import of users from AD is successful. But is is not possible to log in with a user from the AD, error message is shown as Error: The username or password is incorrect, and written in the log as RROR: There was an error authenticating the LDAP user: Could not find user in LDAP directory.

So I have to say that the issues persists, please help.
Brgds Mads

@HinchK
Copy link
Contributor

HinchK commented Dec 18, 2018

Mads! Have you tried: uid=samaccountname?

@madslorenzen
Copy link
Author

I have now tried uid=samaccountname. After the configuration change, I did a LDAP Sync of the user accounts with success, but still are not able to login with AD accounts. Error messages are the same.

@HinchK
Copy link
Contributor

HinchK commented Dec 18, 2018

Ok @madslorenzen - lets address two things from here:

Please check that the user accounts you are trying to log in with are "activated" in the system -
image

ll Snipe-IT versions >4.4 require PHP 7.1.3 or higher. Please update your instance's PHP to at leasst 7.1.3, and restart your web server.

@madslorenzen
Copy link
Author

All AD users are activated.
image

Our PHP version is 7.0.32 - I will try to upgrade it to 7.1.3 now.

@madslorenzen
Copy link
Author

With PHP version 7.2.10 the error continues. Still unable to log in with AD synced users.

@madslorenzen
Copy link
Author

image

@madslorenzen
Copy link
Author

@HinchK Do you have any further suggestions on what we can do ?

@madslorenzen
Copy link
Author

When using wireshark on the domain controller, I only see the Bind users password sent., never the user I try to authenticate. I only see a ldap success to find the login user, but I do not see a password beeing sent, or checked.

@madslorenzen
Copy link
Author

After the LDAP bind SerachRequest that gives success in finding the login user, I only see these three entryes, before the LDAP unbind. All three reqests from SnipeIT server towards DC
image

@madslorenzen
Copy link
Author

@HinchK Do you have any further suggestions ?

@huangshifang
Copy link

image
I Try it !
sucess

@huangshifang
Copy link

image
https://snipe-it.readme.io/docs/ldap-sync-login

@madslorenzen
Copy link
Author

Hi - This setting has been set and tested several times without success. It it now the setting also:
image

@madslorenzen
Copy link
Author

madslorenzen commented Dec 21, 2018 •
edited
Loading

Tested LDAP sync with success, LDAP login with error:
image
This is the issue we have been seeing all along.

@huangshifang
Copy link

image
image

@huangshifang
Copy link

check your php version

@huangshifang
Copy link

snipe-it version 4.66 also sucess

@madslorenzen
Copy link
Author

Stated the versions earlier in the ticket :
image

@huangshifang
Copy link

image
try copy it

@huangshifang
Copy link

image

@madslorenzen
Copy link
Author

Tried to insert &(sAMAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2)) to LDAP Filter, No luck. Same result. Able to Test LDAP Sync - able to to LDAP sync under People, but not able to login - or test LDAP login - fails with not able to bind.

@HinchK
Copy link
Contributor

HinchK commented Dec 21, 2018

@madslorenzen after doing some research, I regret to say that without our insight into active directory, we are just trying to hit a moving target.

What we are doing here is matching usernames for usernames, from snipe-it to active directory. This is pretty much whatever your domain's uid/username field LABEL is, mapped to one we pulled into Snipe-IT from the Sync. Rather than get inside your domain - I did a little research and was able to compile a a sample list of common Snipe-IT LDAP Authentication Settings that I have had to implement over the years.

In some of these cases, we have had to use a setting like uid=mail, because the domain login enforced full email-usernames and thats how we were able to map it.....

This is by far the most common:
image

More LDAP Authentication Queries:

userprincipalname=

cn=                   (I don't think this was AD)

samaccountname=

uid=givenname

uid=

uid=mail

mail=

@huangshifang
Copy link

@madslorenzen It's a question of LDAP Authentication Queries.

@snipe snipe closed this as completed Jan 4, 2019
@madslorenzen
Copy link
Author

madslorenzen commented Jan 7, 2019 via email

@madslorenzen
Copy link
Author

madslorenzen commented Jan 7, 2019 via email

@madslorenzen
Copy link
Author

madslorenzen commented Jan 8, 2019 via email

@pvnick
Copy link

pvnick commented Feb 4, 2019

Did you get this figured out? I just got mine working after struggling with it for some time. Might be able to help you if you still need.

@snipe snipe added ldap and removed ldap labels Mar 6, 2019
@diegorod
Copy link

Hi @pvnick , I'm having trouble myself. Can you share your settings ?

@tamfadmin
Copy link

@dieorod - I had this same exact problem. It turned out to be my Base Bind DN. The problem showed up after I upgraded to v4.6.15. Plus it isn't helpful that the error doesn't indicate any errors for the actual problem. This took me days to figure out!!!

Below is an example of my base bind dn.

Base Bind DN My example: OU=Sync,DC=your,DC=domain,DC=com

I hope this is helpful.

@j33p4meplz
Copy link

Having a similar issue in docker on AD.

@diegorod
Copy link

My issue was a dumb one - I didn't check the box "This is an Active Directory server" because I thought it was referring to the server that snipeit was hosted on. After checking that box everything worked fine.

@j33p4meplz
Copy link

j33p4meplz commented Jun 21, 2019 via email

@KUSD-GIT-ACCT
Copy link

@diegorod this actually got mine working. I assumed it meant is the server I'm hosting the website on an AD server so I never checked it.

@arlinters
Copy link

My issue was a dumb one - I didn't check the box "This is an Active Directory server" because I thought it was referring to the server that snipeit was hosted on. After checking that box everything worked fine.

This fixed my issue. Thank you @diegorod !

@tamfadmin
Copy link

tamfadmin commented Sep 26, 2019 via email

@do-d1
Copy link

do-d1 commented Dec 12, 2019

My issue was a dumb one - I didn't check the box "This is an Active Directory server" because I thought it was referring to the server that snipeit was hosted on. After checking that box everything worked fine.

this helped me !!!
same thing i never was thinking to mark this checkbox , its not an LDAP server ...

@glencostiganFDC
Copy link

My issue was a dumb one - I didn't check the box "This is an Active Directory server" because I thought it was referring to the server that snipeit was hosted on. After checking that box everything worked fine.

Yep, thought the same. It's worded weird...

@luanxinchen
Copy link

@dieorod - I had this same exact problem. It turned out to be my Base Bind DN. The problem showed up after I upgraded to v4.6.15. Plus it isn't helpful that the error doesn't indicate any errors for the actual problem. This took me days to figure out!!!

Below is an example of my base bind dn.

Base Bind DN My example: OU=Sync,DC=your,DC=domain,DC=com

I hope this is helpful.

thanks bro! this fixed my issue!!! you r the best one!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
ldap
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests