LDAP binding

[Lichengchang]

Hi,

I am trying to bind user authorization to LDAP In conf.php

// LDAP settings
define('USE_LDAP', true);
define('LDAP_SSL', false); // set to true if using LDAP with SSL encryption
define('LDAP_HOST', '192.168.1.1');
define('LDAP_PORT', '389');
define('LDAP_PROTOCOL_VERSION', 3);
define('LDAP_DN', 'OU=employee,DC=example,DC=com');
define('LDAP_USER', 'jimmy'); // if no email set: cn=admin,dc=example,dc=com
define('LDAP_PASS', 'password');

I'm getting these errors:
Could not bind to server. Returned Error was: [34] Invalid DN syntax

tcpdump info：
No DN information was sent.

normal situation：

so in conf.php LDAP_DN is invalid?

[Skywalker-11]

Can you query the ldap server with ldapsearch?

EDIT:
The command should be something like
ldapsearch -x -h 192.168.1.1 -D "jimmy" -W -b "OU=employee,DC=example,DC=com"

What ldap server are you using?

[Lichengchang]

Yes, But I use following commend：
ldapsearch -x -h 192.168.1.1 -D "uid=jimmy,ou=employee,dc=example,dc=com" -W -b "ou=employee,dc=example,dc=com"

system：ubuntu 14.04
ldap：openldap 2.4.31

[Skywalker-11]

if thats the case the ldap_user should be uid=jimmy,ou=employee,dc=example,dc=com

[Lichengchang]

Hi,

I follow the step but it still not working .

[Lichengchang]

any defferent way i can try??

[Lichengchang]

ldap server display error： get_ava: unknown attributeType sAMAccountName

[Skywalker-11]

check the LDAP_EMAIL_FIELD it should define the account name the users are using to login.

MailWatch can work with mail address and SMTP:<username> to compare the specified fields value. As fallback it uses sAMAccountName as the field eg. for Microsoft Active Directory.

[Skywalker-11]

any news?

[Lichengchang]

I change some set in the conf.php：
LDAP_USER use uid=publicUser,dc=example,dc=com
LDAP_EMAIL_FIELD use mail

Then I change some code in the functions.php
In 2624 line：

$user = 'cn='
cn change to uid

LDAP is work.

[Skywalker-11]

As it is solved: can you close it?

[gregorgodler]

Hi, I'm having the same issue. What exactly did you change in function.php?

[Skywalker-11]

@CowBoy6 can you try to use tools/LDAP/ldaptest.php? It should give more verbose output.

[gregorgodler]

@Skywalker-11 I'm using EFA, if this could help. Here is output:

[root@efa mailscanner]# php tools/LDAP/ldaptest.php Test connection to server Try authenticating as cn=admin,dc=domain,dc=com authentication for searching the account was successful search for test@mydomain.com in LDAP directory search done found 1 accounts matching the filter array(2) { ["count"]=> int(1) [0]=> array(24) { ["objectclass"]=> array(5) { ["count"]=> int(4) [0]=> string(12) "posixAccount" [1]=> string(3) "top" [2]=> string(13) "inetOrgPerson" [3]=> string(16) "domainAccount" } [0]=> string(11) "objectclass" ["gidnumber"]=> array(2) { ["count"]=> int(1) [0]=> string(1) "0" } [1]=> string(9) "gidnumber" ["givenname"]=> array(2) { ["count"]=> int(1) [0]=> string(4) "test" } [2]=> string(9) "givenname" ["sn"]=> array(2) { ["count"]=> int(1) [0]=> string(4) "test" } [3]=> string(2) "sn" ["uid"]=> array(2) { ["count"]=> int(1) [0]=> string(4) "test" } [4]=> string(3) "uid" ["homedirectory"]=> array(2) { ["count"]=> int(1) [0]=> string(16) "/home/users/test" } [5]=> string(13) "homedirectory" ["loginshell"]=> array(2) { ["count"]=> int(1) [0]=> string(9) "/bin/bash" } [6]=> string(10) "loginshell" ["cn"]=> array(2) { ["count"]=> int(1) [0]=> string(4) "test" } [7]=> string(2) "cn" ["uidnumber"]=> array(2) { ["count"]=> int(1) [0]=> string(5) "50786" } [8]=> string(9) "uidnumber" ["mail"]=> array(2) { ["count"]=> int(1) [0]=> string(18) "test@mydomain.com" } [9]=> string(4) "mail" ["userpassword"]=> array(2) { ["count"]=> int(1) [0]=> string(105) "{CRYPT}$6$FQHA4z1q$.z6Eip9TFtkum31qNOiQVxdKkNzSETnlZqELalkPqGKAoKkeqr4bnObCM25w/6QwMh6K/35CurKcSK0dfJgDj/" } [10]=> string(12) "userpassword" ["count"]=> int(11) ["dn"]=> string(66) "uid=test,ou=Users,o=domain,ou=InternalUsers,dc=domain,dc=com" } } Trying to authenticate as user: test@mydomain.com PHP Warning: ldap_bind(): Unable to bind to server: Invalid DN syntax in /var/www/html/mailscanner/tools/LDAP/ldaptest.php on line 117 :Could not bind to server ldap.domain.com. Returned Error was: [34] Invalid DN syntax

[Skywalker-11]

@CowBoy6 can you try if a ldap query like the following works (for binding user -D use the value as indicated by Trying to authenticate as user: test@mydomain.com
ldapsearch -x -h <LDAP_HOST> -D "test@mydomain.com" -W -b <LDAP_DN>