start_tls_error on invalid password, invalid username, lockouts, expiry all working normal

[Narfmeister]

Hi,

I'm currently attempting to implement ldapRecord and am having luck with authenticating and reading user details.

What I'm encountering is when an invalid password is supplied I receive an LdapRecord \LdapRecordException of ldap_start_tls(): Unable to start TLS: Local error. What seems odd is that after 3 attempts, the account is locked out in ActiveDirectory and returns the correct lock out message. Something odd seems to be happening specifically when an invalid password is supplied.

Supplying an invalid username for example seems to appear as expected:

I'm just following along with the Laravel Breeze guide in the documentation and I'm not sure where I've gone wrong as the authentication appears to be succeeding and other exceptions such as lockouts & invalid usernames appear to be processing correctly. It's only invalid passwords where this is happening. Has anyone experienced this or have any advice?

I'm currently using Laravel 10.45.0 with ldaprecord-laravel 3.4.0 and PHP 8.3.3

Cheers

[stevebauman]

Hi @Narfmeister,

Can you please post your connection configuration with any sensitive details omitted?

[jollyrogers11]

Hey @stevebauman, I am also seeing this issue. I am updating some projects of mine to Laravel 11 and it is requiring me to update directorytree/ldaprecord-laravel. They were at version 2.7 and I have updated them to 3.3.1 and had not seen any issues when testing locally on my machine so I pushed my changes into production. I was monitoring my log files on a few sites that I had updated and saw the following:

[2024-03-26 08:59:39] production.ERROR: ldap_start_tls(): Unable to start TLS: Local error {"exception":"[object] (LdapRecord\LdapRecordException(code: 2): ldap_start_tls(): Unable to start TLS: Local error

I wasn't sure what was causing the issue because I seemed to be able to login to the site just fine. Started doing some searches to see if anyone else was having the issue and found this forum. I tried logging in with an invalid password and it throws this exception:

It only seems to happen when I try logging in with a valid username but invalid password.

My authentication controller is pretty simple. I am not using an Eloquent model, I just check to see if the authentication attempt with the LDAP credentials is successful or not:

public function authenticate(Request $request)
{
$validated = $request->validate([
'username' => 'required',
'password' => 'required',
]);

    Event::listen(Rejected::class, function () {
        abort(redirect()->back()->withErrors(['message' => 'You are unauthorized to access this page.']));
    });

    if (!Auth::attempt(['samaccountname' => $validated['username'], 'password' => $validated['password']])) {
        return redirect()->back()->withErrors(['message' => 'Username or password is incorrect.']);
    }

    return redirect(route('home'));

}

I do have an LDAP rule that makes sure you are in certain groups and should be able to login. I have always just done the Auth::attempt and if it returns false, I would redirect back with an error message. This is crashing for me now because an LdapRecordException is being thrown when I attempt to login with an invalid password. Should that exception be thrown for invalid password or should it just return false? I have about 30 sites that I maintain. Do I need to update them all to just catch the LdapRecordException and then redirect with an error message? Any thoughts on the best way to fix this issue are much appreciated.

[stevebauman]

Hey guys apologies for the delay on this, I'll be able to look into this over the next couple days. I finally have a Windows VM with Active Directory in Azure so I can ensure this is fixed. Will keep you posted, but of course PR's are open if you find a resolution sooner 🙏

[jollyrogers11]

I started doing incremental updates this morning to see when the issue shows up for me. Everything works as expected up to version 2.7.3, but I start getting the issue when I update to 3.0.0.

[stevebauman]

Hi guys, this issue should be resolved in the latest update v3.6.0. I appreciate your patience.

Please run composer update and you should be all set.

Let me know if you encounter any issues! 🙏

[Narfmeister]

Works perfectly! Thank you!

[stevebauman]

Awesome! Thanks for testing and reporting back 🙏

[jollyrogers11]

Updated this morning and my sites are working again like they used to. Thanks @stevebauman !!

[stevebauman]

Great to hear @jollyrogers11! Thanks for reporting 🙏