Can't login empty Base DN

[luis-gmonkey]

Hello guys I'm trying to authenticate with

$credentials = [
        'mail' => '[email protected]',
        'password' => 'randompassword',
    ];

Auth::attempt($credentials) but I can't, laravel log returns:

[2021-07-13 16:23:28] local.INFO: LDAP (ldap://192.168.1.5:389) - Operation: Binding - Username: testuser
[2021-07-13 16:23:28] local.INFO: LDAP (ldap://192.168.1.5:389) - Operation: Bound - Username: testuser
[2021-07-13 16:23:28] local.INFO: LDAP (ldap://192.168.1.5:389) - Operation: Search - Base DN:  - Filter: (&(objectclass (...)

But works fine with:

$connection = new \LdapRecord\Connection([ ... ]

$connection->auth()->attempt('[email protected]', 'randompassword', $stayAuthenticated = true)

What am I doing wrong?

Also, does this makes sense?

'users' => [
            'driver' => 'ldap',
            'model' => LdapRecord\Models\ActiveDirectory\User::class,
            'rules' => [],
            'database' => [
                'model' => App\User::class,
                'sync_passwords' => true,
                'sync_attributes' => [
                    'name' => 'cn',
                    'email' => 'userPrincipalName',
                ],
            ],
        ],

[stevebauman]

Hi @luis-gmonkey,

Your search result will return empty, since there appears to be no base DN configured.

Have you published the ldap.php configuration file or configured your connection through your .env file?

[luis-gmonkey]

I tried this example:

// Add the connection into the container:
Container::addConnection($connection);

// Get all objects:
$objects = Entry::get();

// Get a single object:
$object = Entry::find('cn=John Doe,dc=local,dc=com');

dd($object)

But dd returned null.

Laravel log returned:
[2021-07-13 17:14:20] local.INFO: LDAP (ldap://192.168.1.5:389) - Operation: Binding - Username: testuser
[2021-07-13 17:14:20] local.INFO: LDAP (ldap://192.168.1.5:389) - Operation: Bound - Username: testuser  
[2021-07-13 17:14:20] local.INFO: LDAP (ldap://192.168.1.5:389) - Operation: Search - Base DN:  - Filter: (objectclass=*) - Selected: (objectguid,*) - Time Elapsed: 218.14  
[2021-07-13 17:14:20] local.INFO: LDAP (ldap://192.168.1.5:389) - Operation: Read - Base DN: cn=testuser,dc=mydomain,dc=com - Filter: (objectclass=*) - Selected: (objectguid,*) - Time Elapsed: 15.64  

On read he used the dn but when searching did not?

[luis-gmonkey]

@stevebauman Can you give me a hand with this?
I can see all the user data with $object = Entry::find('CN=Testuser,OU=Someou,DC=mydomain,DC=com');
I really fail to see what could be wrong with the auth :x

[stevebauman]

Hmm strange... It seems something is overriding your configured base DN and is setting it null or empty.

Let's try this:

• Scaffold a new Laravel application
• Run composer require directorytree/ldaprecord-laravel
• Publish the ldap.php configuration file via php artisan vendor:publish
• Insert your .env variables from your current application
• Run php artisan ldap:browse

You should be able to traverse your LDAP directory via the console. If this works, then we know for sure it's something in your application 👍

[luis-gmonkey]

Edit: This behaves the same way on the original laravel application.

When using [to ] puting the same distinguished name as in .env I get all the data I want, and I can even go up.

[luis-gmonkey]

The user i'm using in the .env is in the same level as the one i'm trying to connect is that a problem?
Also I don't know if this is important but when trying the login the log returns the search query with expected chars like.

Operation: Search - Base DN: - Filter: (&(objectclass=\70\6f\74 (...)

[luis-gmonkey]

I figured it out, I had the credentials keys wrong.

$credentials = [
        'email' => '[email protected]',
        'password' => 'aaasdasd',
    ];`

Can't use email, I need to use userprincipalname or samaccountname with just the username, this is mentioned on the docs but I assumed that the email was converted on the fly to userprincipalname with LdapRecord, and since I made it to sync on the auth.php I wrongly assumed it would "sync" the array keys.

'sync_attributes' => [
                    'name' => 'cn',
                    'email' => 'userPrincipalName',
                ],

Since the docs mentioned the "email", I assume my clients AD don't have the email as a entry, otherwise this would work right? And should I insist to change that or is okay to use userprincipalname ?

Thanks for you time @stevebauman , and sorry for these noobs questions hehehe

[stevebauman]

That's great that you were able to resolve the issue @luis-gmonkey!

Also, this is described in the docs here:

https://ldaprecord.com/docs/laravel/v2/auth/database/laravel-ui#login-controller
https://ldaprecord.com/docs/laravel/v2/auth/database/laravel-breeze/#login-request
https://ldaprecord.com/docs/laravel/v2/auth/database/laravel-jetstream/#authentication-callback

As you can see above, we set the mail key which is passed to the LdapRecord authentication provider.

A search query will be executed on your LDAP directory for a user that contains the mail attribute equal to the entered email that the user has submitted on your login form. The password key will not be used in the search.

If a user cannot be located in your directory, or they fail authentication, they will be redirected to the login page normally with the "Invalid credentials" error message.

Sync attributes are only meant for mapping Eloquent model attributes to LDAP attributes.

The credentials array and sync attributes don't really complement each other. They are independent and must be configured as such 👍

Hope this helps!

[stevebauman]

And should I insist to change that or is okay to use userprincipalname ?

If you're using Active Directory, then use userprincipalname if you don't have the mail address populated on your LDAP user objects.

I use the mail LDAP attribute in the documentation to provide a working example for all LDAP server types (they all contain the mail attribute), while only Active Directory has the userPrincipalName attribute. 👍

[luis-gmonkey]

Hi @stevebauman
Thanks for taking the time to answer me back, and thanks for your awesome work =)

[stevebauman]

Happy to help @luis-gmonkey! And thanks so much for your kind words! ❤️ I really appreciate that 😄