💬 [Question] Connect via LDAP

[rfpg1]

Hello everyone,

I've read the documentation in: https://github.com/cypht-org/cypht/wiki/How-to-setup-LDAP-Authentication

But still I can't login via LDAP and can't find where logs are because data/logs is empty to understand what the actual problem is.

I've tried settings the values in docker-compose.yml and .env files but still nothing

When I did docker exec -it container bash and checked .env inside the docker it has different values from my docker-compose.yml

Could this be the problem? If so, how to fix?

Thanks for the help

[IrAlfred]

Hello @rfpg1,

Are you able to authenticate to your LDAP server using this command

ldapwhoami -x -H ldaps://<ip-address> -D "uid=user,dc=example,dc=com" -W

[rfpg1]

Hello @IrAlfred,

I cannot authenticate that way. What I normally do is

ldapwhoami -x -H ldap://<ip-address> -D "cn=user,dc=example,dc=com" -W

My LDAP server is an Active Directory. Could that be the problem?

Edit:
Also tried changing LDAP_UID_ATTR to cn or sAMAccountName but neither worked

If I could read some logs to understand why the authentication is failing that could do it, but I can't find the log file

[IrAlfred]

My LDAP server is an Active Directory. Could that be the problem?

Of course no.

There are exactly two configs

# For Cypht Addressbook
LDAP_UID_ATTR="cn"

# For Cypht Authentication
LDAP_AUTH_UID_ATTR="cn"

[rfpg1]

I meant LDAP_AUTH_UID_ATTR instead of LDAP_UID_ATTR, my mistake for confusing both

LDAP_AUTH_UID_ATTR is what I'm using in compose file

This is my docker-compose.yml file:

services:
  db:
    image: mariadb:10
    ports:
      - "3306:3306"
    volumes:
      - ./data/mysql:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=DB_ROOT_PASSWORD
      - MYSQL_DATABASE=DB_NAME
      - MYSQL_USER=DB_USER
      - MYSQL_PASSWORD=DB_PASS
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-uDB_USER", "-pDB_PASS"]
      interval: 10s
      timeout: 5s
      retries: 5

  cypht:
    image: cypht/cypht:2.5.1
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "80:80"
    environment:
      - DB_CONNECTION_TYPE=host
      - DB_DRIVER=mysql
      - DB_HOST=db
      - DB_NAME=DB_NAME
      - DB_USER=DB_USER
      - DB_PASS=DB_PASS
      - SESSION_TYPE=LDAP
      - USER_CONFIG_TYPE=DB
      - AUTH_TYPE=LDAP
      - LDAP_AUTH_PORT=389
      - LDAP_AUTH_SERVER=my_ip
      - LDAP_AUTH_TLS=false
      - LDAP_AUTH_BASE_DN=DC=example,DC=com
      - LDAP_AUTH_UID_ATTR=sAMAccountName
    volumes:
      - ./data/log/nginx:/var/log/nginx
      - ./data/log/php:/var/log/php
      - ./data/log/supervisord:/var/log/supervisord
      - ./data/fonts:/usr/local/share/cypht/site/fonts
      - ./data/user_settings:/var/lib/hm3/users          
      - ./data/user_attachments:/var/lib/hm3/attachments 

Do you see anything wrong?

[IrAlfred]

Thank you for providing the details. I'm investigating and will provide an update as soon as I have more information.

[IrAlfred]

@rfpg1

Do you structure your users within Organizational Units (OUs) in your LDAP directory?

[rfpg1]

Yes, I do, also tried to put the OU in BASE_DN, but still not working

[IrAlfred]

Yes, I do, also tried to put the OU in BASE_DN, but still not working

Did you provide the full path, I mean from the root OU to the current user's. For example:

LDAP_AUTH_BASE_DN=OU=Sales,OU=Users,DC=company,DC=com

From right to left. In the example Sales is in Users

[rfpg1]

Yes, I did an LDAP search to check the full DN of my user and put that DN in there, excluding the CN

Aren't there any logs I can read?

[IrAlfred]

Yes, I did an LDAP search to check the full DN of my user and put that DN in there, excluding the CN

Aren't there any logs I can read?

Unfortunately no application-specific logs, only generic Docker logs.
If you don't mind, you can create a test account we can use for debugging ! This would be helpful

[rfpg1]

Where to create the test account?

I've managed to login with AUTH_TYPE=DB (which is the default I believe) with credentials also defined in the docker-compose

But I really needed the LDAP login

[IrAlfred]

Where to create the test account?

I've managed to login with AUTH_TYPE=DB (which is the default I believe) with credentials also defined in the docker-compose

But I really needed the LDAP login

On your LDAP server so I can try to login on my side.

[rfpg1]

You want an account on my LDAP server?

It is in a private network, you cannot access it even if I wanted to

[IrAlfred]

You want an account on my LDAP server?

It is in a private network, you cannot access it even if I wanted to

Oh unfortunately! Maybe we can plan for a screenshare in that case. You can DM on gitter (iralfred:gitter.im) and join our Cypht Community (https://app.gitter.im/#/room/#cypht-org_community:gitter.im)