Access denied for LDAP auth

[Franco-Sparrow]

Code of Conduct

• I agree to follow this project's Code of Conduct

Is there an existing issue for this?

• I have searched the existing issues

Version

10.0.11
10.0.14

Bug description

I have configured the LDAP auth following the official documentation for Active Directory. I am using Windows AD 2022 (AD 2016 server level).

PS: I have tried also with RootDN: CN=ccecasa,CN=Users,DC=ecasa,DC=avianet,DC=cu.

If the LDAP configuration were wrong, I guess that I couldnt be able to synchronize with my AD, which is not the case, as the GLPI is capable to import all users from Redes AD group:

sudo -u www-data /usr/bin/php bin/console glpi:ldap:synchronize_users

The output is as follow:

+-----------------+-----------+
| Servidores LDAP | DC101 (2) |
| Filtro LDAP     |           |
| Fecha de inicio |           |
| Fecha fin       |           |
+-----------------+-----------+
¿Quiere continuar? [Yes/no]yes
Procesando servidor LDAP "2"...
Importando nuevos usuarios desde el servidor "2"...
No se encontraron usuarios.
Sincronizar usuarios con el servidor "2"...
 6/6 [============================] 100%
+---------------+------------+--------------+-------------------+-------------------------+
| Servidor LDAP | Importados | Sincronizado | Eliminado de LDAP | Restablecido desde LDAP |
+---------------+------------+--------------+-------------------+-------------------------+
| 2             | 0          | 6            | 0                 | 0                       |
+---------------+------------+--------------+-------------------+-------------------------+

Relevant log output

No response

Page URL

No response

Steps To reproduce

No response

Your GLPI setup information

No response

Anything else?

No response

[cconard96]

Is the user active and does it have at least one profile assignment?

[Franco-Sparrow]

Is the user active and does it have at least one profile assignment?

Hi Sir, thanks for your quick reply.

I havent seen this on the official documentation. In fact, I got this command to synchronize user outside the LDAP topic in the dcumentation. In response to your question: Yes, they are all active users once imported and synchronized with the GLPI server:

The user franco.diaz is associated with the profile Admin

[Franco-Sparrow]

I guess I will have to keep with local database access, as this is not working.

[trasher]

Try with latest stable release; and without plugins (no idea if you use some because you did not fill requested information).

While it is possible there is a bug, it also could be a configuration issue that is out of the scope of community support, since this is often the case with configuration similar to yours.

[Franco-Sparrow]

@trasher thanks for your reply. Could you please indicate me where is the configuration issue? I shared the link to the official documentation, I followed the instructions, I even added the screenshots. Did you see anything wrong from my side? I have only installed Glpi Inventory plugin, no extra plugin for auth, LDAP is integrated with the solution. I will follow your recommendation, and will install the latest stable version...but does that means that this is broken on v10.0.11?

Thanks in advance

[trasher]

Since I have absolutely no knowledge on Azure, no I can't tell what the problem is. As said, that is out of the scope of community support.

Latest release contains numerous fixes (including security ones); I have no idea if that can affect your problem, but anyway this is the first thing to check.

[Franco-Sparrow]

@cconard96 @trasher

Good day gentlemans. As recommended by you, previous this comment, I have upgraded to GLPI latest stable version 10.0.14. The LDAP auth issue remains even after the upgrade.

tail -f /var/log/glpi/event.log
2024-03-31 11:18:31 [2@glpi]
[login] 3: glpi  inicio de sesión desde IP 10.7.5.20
2024-03-31 11:19:36 [@glpi]
[login] 3: Fallo en el acceso de franco.diaz desde la IP 10.7.5.20
2024-03-31 11:19:50 [2@glpi]
[login] 3: glpi  inicio de sesión desde IP 10.7.5.20
2024-03-31 11:22:58 [@glpi]
[login] 3: Fallo en el acceso de franco.diaz desde la IP 10.7.5.20
2024-03-31 11:23:02 [2@glpi]
[login] 3: glpi  inicio de sesión desde IP 10.7.5.20

May I have a follow up on this?

Thanks in advance

[Franco-Sparrow]

Is working now. I changed the user filter. The group filter was wrong.