Unable to Login with LDAP Credentials (Docker Container)

[TopHatProductions115new]

I'm running MeshCentral as a Docker container --
Version: ghcr.io/ylianst/meshcentral:latest
Database: MariaDB
Auth. Method: LDAP

I have been experiencing login issues recently. When logging in with existing LDAP credentials, I receive an "Access denied" error. This only seems to happen when I use LDAP account credentials.

If more information is required, please let me know.

[si458]

If it use to work with ur ldap credentials and then suddenly stopped working with ur ldap credentials, this would scream to me an ldap issue with ur server not meshcentral
We haven't changed anything config wise for ldap
Can u share ur config.json? (Hide passwords n sessionkey)

[TopHatProductions115new]

Sure, though I'm not sure which Active Directory settings would cause this.

I have other services, using their own bind accounts on that domain controller, that are working without issue:

{
    "settings": {
        "cert": "ras.txp-network.ml",
        "WANonly": true,
        "LANonly": false,
        "_sessionKey": "aSessionKeyToNeverBeShared",
        "_port": ActualPortNumber,
        "aliasPort": 443,
        "_ignoreAgentHashCheck": true,
        "TlsOffload": "Proxy,Server,IP,Addresses",
        "_redirPort": ActualPortNumber,
        "redirAliasPort": 80,
        "_portBind": "IPv4bindAddress",
        "maintenanceMode": false,
        "debug": true,
        "MariaDB": {
            "host": "DbIPv4Address",
            "port": "3306",
            "database": "meshcentral",
            "user": "meshcentralDBusername",
            "password": "anotherPasswordToNeverShare",
            "connectionLimit": 7
        }
    },

    "domains": {
        "": {
            "title": "TXP-Network Remote Access Service",
            "newAccounts": false,
            "userNameIsEmail": false,
            "meshMessengerTitle": "RAS Messenger",
            "allowSavingDeviceCredentials": true,
            "CertUrl": "https://subdomain.domain.tld/",
            "auth": "ldap",
            "ldapOptions": {
                "url": "ldap://domain.tld:389",
                "bindDN": "cn=MeshCentralBindAccount,ou=ItsOrgUnit,dc=domain,dc=tld",
                "bindCredentials": "BindAccountPassword",
                "searchBase": "cn=Users,dc=domain,dc=tld",
                "searchFilter": "(userPrincipalName={{username}})",
                "reconnect": true
            },
            "_ldapUserKey": "uidNumber",
            "_ldapUserBinaryKey": "objectSID",
            "ldapUserRealname": "displayName",
            "ldapUserName": "displayName",
            "ldapUserEmail": "mail",
            "ldapUserPhoneNumber": "telephoneNumber",
            "ldapUserGroups": "memberOf",
            "ldapUserRequiredGroupMembership": [ "cn=MeshCentralUsers,ou=ItsOrgUnit,dc=domain,dc=tld" ],
            "ldapSiteAdminGroups": [ "cn=MeshCentralAdmins,ou=ItsOrgUnit,dc=domain,dc=tld" ],
            "_ldapUserImage": "thumbnailPhoto"
        }
    }
}

I've re-checked the username and reset the password on the bind account as well. The account never got locked.

Are there any authentication logs that I can check, to see what may be going wrong?

[TopHatProductions115new]

After experimenting a bit, I had to change my config to look like this:

    "domains": {
        "": {
            "title": "TXP-Network Remote Access Service",
            "newAccounts": false,
            "userNameIsEmail": false,
            "meshMessengerTitle": "RAS Messenger",
            "allowSavingDeviceCredentials": true,
            "CertUrl": "https://subdomain.domain.tld/",
            "auth": "ldap",
            "LDAPOptions": {
                "url": "ldap://domain.tld:389",
                "bindDN": "CN=MeshCentralBindAccount,OU=ItsOrgUnit,DC=domain,DC=tld",
                "bindCredentials": "BindAccountPassword",
                "searchBase": "CN=Users,DC=domain,DC=tld",
                "searchFilter": "(userPrincipalName={{username}})"
            },
            "_LDAPUserKey": "uidNumber",
            "_LDAPUserBinaryKey": "objectSID",
            "_LDAPUserRealname": "displayName",
            "_LDAPUserName": "displayName",
            "_LDAPUserEmail": "mail",
            "_LDAPUserPhoneNumber": "telephoneNumber",
            "_LDAPUserGroups": "memberOf",
            "_LDAPUserRequiredGroupMembership": [ "CN=meshCentralUsers,OU=ItsOrgUnit,DC=domain,DC=tld" ],
            "_LDAPSiteAdminGroups": [ "CN=meshCentralAdmins,OU=ItsOrgUnit,DC=domain,DC=tld" ],
            "_LDAPUserImage": "thumbnailPhoto"
        }
    }

The best I can fathom is a syntax error. The bind credentials and domain controller remained unchanged during my 2nd round of testing.