how to use the ldap plugin

[liangliwu]

Why don't the properties of the ldap plugin include bind dn and bind dn's paasword. I tried to integrate the ldap plugin with open ldap, but it failed.

[juzhiyuan]

Hi @liangliwu, here is the LDAP-auth plugin doc: https://apisix.apache.org/docs/apisix/plugins/ldap-auth/

And I noticed the password is extracted from Authorization header, does it make sense to you? https://github.com/apache/apisix/blob/master/apisix/plugins/ldap-auth.lua#L132-L141

[moonming]

@tzssangglass please take a look,thx

[tzssangglass]

Hi @kostyanp95 , you can enable: https://github.com/apache/apisix/blob/master/docs/en/latest/architecture-design/debug-mode.md#basic-debug-mode to check if the request has gone through the key-auth plugin.

[kostyanp95]

@jp-gouin, hi!
Also, I noticed that the ldap-auth.lua script code here on github differs from the actual one that lies in the docker container.

I used the command docker exec -it apisix bash and cat apisix/plugins/ldap-auth.lua to view the code.

Comparison of ldap-auth.lua file on GitHub and in docker container:

On the left is a file copied from GitHub, on the right is a file from the docker container apisix.

As we can see, in the script from the docker container on the right on line 155, this strange message Invalid API key in the request was found.

Did something go wrong? :)

[tzssangglass]

ok, I know, maybe cause by this PR: https://github.com/apache/apisix/pull/6707/files#diff-8e5b15fc718c151b0f2b2fbf464e510f31c3e0bf31a350aa2f5ca01349f4a2f6

I think your problem is a consumer mismatch

"user_dn": "cn=ldap_id_nexus,ou=TechAccount,dc=city,dc=company,dc=zone"

and

"base_dn": "OU=TechAccount,DC=city,DC=company,DC=zone",

it looks like they are not case-sensitive, can you try:

"base_dn": "ou=TechAccount,dc=city,dc=company,dc=zone",

[kostyanp95]

ok, I know, maybe cause by this PR: https://github.com/apache/apisix/pull/6707/files#diff-8e5b15fc718c151b0f2b2fbf464e510f31c3e0bf31a350aa2f5ca01349f4a2f6

I think your problem is a consumer mismatch

"user_dn": "cn=ldap_id_nexus,ou=TechAccount,dc=city,dc=company,dc=zone"

and

"base_dn": "OU=TechAccount,DC=city,DC=company,DC=zone",

it looks like they are not case-sensitive, can you try:

"base_dn": "ou=TechAccount,dc=city,dc=company,dc=zone",

Indeed, I changed user_dn to
"user_dn": "cn=ldap_id_nexus,OU=TechAccount,DC=city,DC=company,DC=zone"
@liangliwu, that is, cn, ou and dc are case sensitive. And it worked!

Also, as it turns out, cn cannot contain whitespace characters, because plugin deletes those. It is normal? @jp-gouin
(ldap-auth.lua)

Anyway, thanks for your help everyone!

[kostyanp95]

Do we mark the issue as resolved?

[qyk1995]

@kostyanp95 help me, I meet same question. #10235

[Zeeeeta]

I successfully use the ldap-auth plugin on UAT with the following config:

Consumer
"user_dn": "CN=uat_xxx_yyy,OU=System ID,DC=XXXX,DC=COM,DC=UAT"

Route Plugin
"base_dn": "OU=System ID,DC=XXXX,DC=COM,DC=UAT",
"uid": "CN"

However, when I try to use it on our PRD env, where the CN and sAMAccountName are different.
CN has space in it (XXX YY), and sAMAccountName has a dot in it instead (xxx.yy).

I am unable to authenticate no matter setting uid to CN and use "XXX YY", or setting uid to sAMAccountName and use "xxx.yy".

[moonming]

@shreemaan-abhishek please take a look, thx

[shreemaan-abhishek]

@Zeeeeta I am not much familiar with LDAP so could you please provide me with guided steps to reproduce this situation so that I can investigate and provide you a solution?

[jp-gouin]

The trim of the space is due to obj.username = ngx.re.gsub(res[1], "\\s+", "", "jo") that was copy from the basic-auth plugin.

Maybe it's a security thing otherwise probably not useful.