LDAPS not working #24

manoftheforest · 2016-12-08T12:24:05Z

Hi,

I recently configured auth_ldap on my tt-rss instance. Authentication works with LDAP via port 389, but I get Wrong Username or Password when using LDAPS with port 636.
So basically changing define('LDAP_AUTH_SERVER_URI', 'ldap://my.org'); to define('LDAP_AUTH_SERVER_URI', 'ldaps://my.org') makes me unable to log in.

I downloaded tt-rss' and auth_ldap's most recent builds from their respective repositories.
I'm running CentOS Linux release 7.2.1511 with php 5.4.
LDAPS Connection to my Active Directory works fine with other applications.

My error log gets flooded with these PHP Notices, it throws a notice for every line in accept-to-gettext.php, but this happens with both LDAP and LDAPS configured (-> tt-rss related most likely):
PHP Notice: Undefined index: in /srv/web/my.org/lib/accept-to-gettext.php on line 150
PHP Notice: Array to string conversion in /srv/web/my.org/include/errorhandler.php on line 24
PHP Notice: Array to string conversion in /srv/web/my.org/include/errorhandler.php on line 24

The text was updated successfully, but these errors were encountered:

hydrian · 2016-12-09T01:17:37Z

Sounds like there is an issue with PHP not trusting certificate that is being offered by the LDAP server.

Make sure you are using the hostname that is displayed in the certificate and make sure PHP trusts the end of the certificate chain offered by the LDAP server. PHP and LDAP treat untrusted certificates very harshly and often give back misleading errors.

The other option is it ignore disabled PHP certificate checking. This isn't recommended.

Currently there is no option to disable LDAPS certificate checking in just this module. If you'd like this please file a feature request for this feature.

hydrian · 2016-12-09T01:18:55Z

Those accept-to-gettext error look more like ttrss core issues.

hydrian · 2016-12-09T15:57:55Z

Added issue #25 for the enhancement

manoftheforest · 2016-12-29T13:36:20Z

Thanks for the reply and sorry for the long wait, I only recently had time to get back to this issue again.
I'm quite sure that this is not certificate related. I have a similar installation running on an older system (CentOS 6) which works fine with LDAP Auth over LDAPS.
I enabled debug logging and this is what I get when I try to log in with domain credentials and LDAPS enabled:

Failed login attempt for myuser from x.x.x.x

classes/handler/public.php(627): user_error(Failed login attempt for myuser from x.x.x.x, 512)

public.php(50): login()

E_WARNING (2) classes/db/pgsql.php:70 pg_affected_rows() expects parameter 1 to be resource, boolean given

classes/db/pgsql.php(70): pg_affected_rows()

classes/db.php(86): affected_rows()

classes/logger/sql.php(20): affected_rows()

classes/logger.php(28): log_error(256, LDAP bind(): Bind failed ()with DN cn=myorg, , , )

plugins/auth_ldap/init.php(84): log_error(256, LDAP bind(): Bind failed ()with DN cn=myorg, , , )

plugins/auth_ldap/init.php(313): _log(LDAP bind(): Bind failed ()with DN cn=myorg, 256)

include/functions.php(739): authenticate(myuser, mypassword)

classes/handler/public.php(604): authenticate_user(myuser, mypassword)

public.php(50): login()

E_USER_ERROR (256) classes/db/pgsql.php:47 Query INSERT INTO ttrss_error_log (errno, errstr, filename, lineno, context, owner_uid, created_at) VALUES (256, 'LDAP bind(): Bind failed ()with DN cn=myorg', '', '', '', NULL, NOW()) failed: ERROR: invalid input syntax for integer: "" ZEILE 3: mybasedn', '', '', '', NU... ^

classes/db/pgsql.php(47): user_error(Query INSERT INTO ttrss_error_log
(errno, errstr, filename, lineno, context, owner_uid, created_at) VALUES
(256, 'LDAP bind(): Bind failed ()with DN cn=myorg', '', '', '', NULL, NOW()) failed: ERROR: invalid input syntax for integer: ""
ZEILE 3: mybasedn', '', '', '', NU...
^, 256)

classes/db.php(66): query(INSERT INTO ttrss_error_log
(errno, errstr, filename, lineno, context, owner_uid, created_at) VALUES
(256, 'LDAP bind(): Bind failed ()with DN cn=myorg', '', '', '', NULL, NOW()), 1)

classes/logger/sql.php(18): query(INSERT INTO ttrss_error_log
(errno, errstr, filename, lineno, context, owner_uid, created_at) VALUES
(256, 'LDAP bind(): Bind failed ()with DN cn=myorg', '', '', '', NULL, NOW()))

classes/logger.php(28): log_error(256, LDAP bind(): Bind failed ()with DN cn=myorg, , , )

plugins/auth_ldap/init.php(84): log_error(256, LDAP bind(): Bind failed ()with DN cn=myorg, , , )

plugins/auth_ldap/init.php(313): _log(LDAP bind(): Bind failed ()with DN cn=myorg, 256)

include/functions.php(739): authenticate(myuser, mypassword)

classes/handler/public.php(604): authenticate_user(myuser, mypassword)

public.php(50): login()

E_WARNING (2) classes/db/pgsql.php:70 pg_affected_rows() expects parameter 1 to be resource, boolean given

classes/db/pgsql.php(70): pg_affected_rows()

classes/db.php(86): affected_rows()

classes/logger/sql.php(20): affected_rows()

classes/logger.php(28): log_error(1024, Array
(
[host] => myhost
[basedn] => mybasedn
[port] => 636
[starttls] =>
)
, , , )

plugins/auth_ldap/init.php(84): log_error(1024, Array
(
[host] => myhost
[basedn] => mybasedn
[port] => 636
[starttls] =>
)
, , , )

plugins/auth_ldap/init.php(284): _log(Array
(
[host] => myhost
[basedn] => mybasedn
[port] => 636
[starttls] =>
)
, 1024)

include/functions.php(739): authenticate(myuser, mypassword)

classes/handler/public.php(604): authenticate_user(myuser, mypassword)

public.php(50): login()

E_USER_ERROR (256) classes/db/pgsql.php:47 Query INSERT INTO ttrss_error_log (errno, errstr, filename, lineno, context, owner_uid, created_at) VALUES (1024, 'Array ( [host] => myhost [basedn] => mybasedn [port] => 636 [starttls] => ) ', '', '', '', NULL, NOW()) failed: ERROR: invalid input syntax for integer: "" ZEILE 10: ', '', '', '', NULL, NOW()) ^

classes/db/pgsql.php(47): user_error(Query INSERT INTO ttrss_error_log
(errno, errstr, filename, lineno, context, owner_uid, created_at) VALUES
(1024, 'Array
(
[host] => myhost
[basedn] => mybasedn
[port] => 636
[starttls] =>
)
', '', '', '', NULL, NOW()) failed: ERROR: invalid input syntax for integer: ""
ZEILE 10: ', '', '', '', NULL, NOW())
^, 256)

classes/db.php(66): query(INSERT INTO ttrss_error_log
(errno, errstr, filename, lineno, context, owner_uid, created_at) VALUES
(1024, 'Array
(
[host] => myhost
[basedn] => mybasedn
[port] => 636
[starttls] =>
)
', '', '', '', NULL, NOW()), 1)

classes/logger/sql.php(18): query(INSERT INTO ttrss_error_log
(errno, errstr, filename, lineno, context, owner_uid, created_at) VALUES
(1024, 'Array
(
[host] => myhost
[basedn] => mybasedn
[port] => 636
[starttls] =>
)
', '', '', '', NULL, NOW()))

classes/logger.php(28): log_error(1024, Array
(
[host] => myhost
[basedn] => mybasedn
[port] => 636
[starttls] =>
)
, , , )

plugins/auth_ldap/init.php(84): log_error(1024, Array
(
[host] => myhost
[basedn] => mybasedn
[port] => 636
[starttls] =>
)
, , , )

plugins/auth_ldap/init.php(284): _log(Array
(
[host] => myhost
[basedn] => mybasedn
[port] => 636
[starttls] =>
)
, 1024)

include/functions.php(739): authenticate(myuser, mypassword)

classes/handler/public.php(604): authenticate_user(myuser, mypassword)

public.php(50): login()

Alexconquer · 2019-01-18T16:44:32Z

Hello,
I up my OpenLDAP server to ldaps and i'm lost TTrss auth.

I found problem: line 285 in init.php

In ldap_connect, the scheme of URI It's missing

And line 303, the test is wrong : It must test $this->_scheme not $this->_host

hydrian · 2019-01-19T01:54:59Z

I'm doing LDAP over TLS via StartTLS and it is working fine. Have you verified that php trusts you LDAP server? PHP treats untrusted LDAP certificate chains very harshly before PHP 7.1.

To test it on an standard linux box use the following command:
#> openssl s_client -connect ldap.mydomain.internal:636 -showcerts

If that doesn't verify the whole chain, you'll probably have LDAPS/StartTLS connection problems but it will error will just be can't connect to server.

hydrian · 2019-01-19T02:28:09Z

Sorry @Alexconquer, I was looking at the some older code and I hadn't pulled from the master in a while. Another merge broke it. FIxing..

Alexconquer · 2019-01-21T14:28:17Z

This command return "Verification: OK".

And others programs : Dovecot, PostFix and OpenXchange are't problem.

I add information of my context, i close ldap port and i only open ldaps.

kettbi · 2019-03-13T12:58:48Z

Hi,
Same here, this pull request #34 didn't work for me.
I use SSL, not TLS.

logs :

Failed login attempt for MyUser from x.x.x.x
1. classes/handler/public.php(505): user_error(Failed login attempt for MyUser from x.x.x.x, 512)
2. public.php(50): login()

LDAP bind(): Bind failed ()with DN cn=myadmin,dc=domain,dc=com
Array ( [host] => LDAP [basedn] => ou=users,ou=myou,dc=domain,dc=com [port] => 636 [starttls] => )

conf :

/// append auth_ldap to the list
        define('PLUGINS', 'auth_ldap, auth_internal, note');
        define('LDAP_AUTH_SERVER_URI', 'ldaps://LDAP/');
        define('LDAP_AUTH_USETLS', FALSE); // Enable TLS Support for ldaps://
        define('LDAP_AUTH_ALLOW_UNTRUSTED_CERT', TRUE); // Allows untrusted certificate
        define('LDAP_AUTH_BASEDN', 'myBaseDN');
        define('LDAP_AUTH_ANONYMOUSBEFOREBIND', FALSE);
        // ??? will be replaced with the entered username(escaped) at login
        define('LDAP_AUTH_SEARCHFILTER', '(&(objectClass=posixAccount)(uid=???))');
        // Optional configuration
        define('LDAP_AUTH_BINDDN', 'adminDN');
        define('LDAP_AUTH_BINDPW', 'password');
        define('LDAP_AUTH_LOGIN_ATTRIB', 'uid');
        define('LDAP_AUTH_LOG_ATTEMPTS', TRUE);
        //Enable Debug Logging
        define('LDAP_AUTH_DEBUG', TRUE);

Without SSL it works just fine

eNBeWe · 2019-07-26T22:09:08Z

I had the same problem initially.
Manually adding the changes from #34 solved the issue and the Authentication works fine.

hydrian self-assigned this Dec 9, 2016

hydrian added the question label Dec 9, 2016

Alexconquer mentioned this issue Jan 18, 2019

Fix ldaps connect #34

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

LDAPS not working #24

LDAPS not working #24

manoftheforest commented Dec 8, 2016

hydrian commented Dec 9, 2016

hydrian commented Dec 9, 2016 •

edited

Loading

hydrian commented Dec 9, 2016

manoftheforest commented Dec 29, 2016

Alexconquer commented Jan 18, 2019

hydrian commented Jan 19, 2019

hydrian commented Jan 19, 2019

Alexconquer commented Jan 21, 2019

kettbi commented Mar 13, 2019

eNBeWe commented Jul 26, 2019

LDAPS not working #24

LDAPS not working #24

Comments

manoftheforest commented Dec 8, 2016

hydrian commented Dec 9, 2016

hydrian commented Dec 9, 2016 • edited Loading

hydrian commented Dec 9, 2016

manoftheforest commented Dec 29, 2016

Alexconquer commented Jan 18, 2019

hydrian commented Jan 19, 2019

hydrian commented Jan 19, 2019

Alexconquer commented Jan 21, 2019

kettbi commented Mar 13, 2019

eNBeWe commented Jul 26, 2019

hydrian commented Dec 9, 2016 •

edited

Loading