Forum

Welcome to ProjeQtOr new Forum. We migrated old forum to the new website.
You will find all your posts here, with your usual account.
Just one point : you’ll have to reinitialize your password. Use “Lost password” feature.

LDAP Connection Pro...
 
Notifications
Clear all

LDAP Connection Problems

4 Posts
3 Users
0 Reactions
16.5 K Views
(@francis2301)
Posts: 88
Active Member
Topic starter
 
[#1889]

Hi,
We're trying to configure LDAP integration but it seems we're doing something wrong, since it's not working.

Here are the configurations:
Connection with LDAP Users: YES
LDAP base dn : DC=frescatto,DC=com
LDAP user: CN=pfsense,CN=Users,DC=frescatto,DC=com
LDAP Passwowrd: ****** (our password)
LDAP user filter: uid=%username%

When we try to connect in projeqtor using a USER/PWD from AD it doesn't allows the connection.
The log file only says: 2014-07-03 16:47:24 ===== TRACE ===== Login error for user 'username'

Is there anything wrong in the configuration?

Question 1: Do we need to import the LDAP Users to projeqtor before allowing them to connect?
If no, and after solving the problem we're facing, how will we set the correct profile for these LDAP users? Does projeqtor creates a user in its database in the first login?

Thanks


 
Posted : 04 Jul 2014 0H25
(@babynus)
Posts: 14952
Member Admin
 

1) Password must be ldap password fir ldzp user : try and connect through other mean
2) filter must retrieve the ldap user : try and search user with given username
3) log seems to show that you enter "username" to log in ProjeQtOr : does this user exist in ldap with corresponding uid ?
4) You do not need to import ldap user in Projeqtor : this is the interest of ldap connectivity, authentication is devoted to ldap, with ldap password
5) you define in global parameters default profile for new users
6) Yes, projeqtor automatically creates a projeqtor user on first ldap connection, retrievong the cn (common name) and email


 
Posted : 04 Jul 2014 22H39
(@xeiran)
Posts: 2
New Member
 

Having very similar problems with LDAP connection, any assistance would be greatly appreciated.
We keep getting the error: ldap_bind(): Unable to bind to server: Invalid credentials

1. The user we are trying to log in with is a valid working LDAP user, "ourdomain.netbmullins", with valid email address, and can log in via other means.
2. The LDAP authentication user has also been verified and can log in via other means.
3. We use Active Directory, so presumably the default user filter specified in Projeqtor works; I am unsure how to test.
4. LDAP authentication module in PHP.ini is enabled (that was the first problem I ran into).
5. There are no firewalls blocking the LDAP port, and we have not changed the default port number.

Parameters are:
Connection with LDAP Users: YES
LDAP base dn : DC=ourdomain,DC=net
LDAP host: dc1.ourdomain.net
LDAP port: 389
LDAP version: 3
LDAP user: CN=ldapprojeqtor,DC=ourdomain,DC=net
LDAP Passwowrd: ****** (our password)
LDAP user filter: uid=%username%

Here is the debug trace:
==============

2014-10-02 18:08:07 ----- DEBUG ----- 0.071998;desc itresource
2014-10-02 18:08:07 ----- DEBUG ----- 0.00074;select * from itresource where itresource.name='ourdomain.net\bmullins' and itresource.isUser = '1' 
2014-10-02 18:08:09 ----- DEBUG ----- 0.028237;desc itparameter
2014-10-02 18:08:09 ----- DEBUG ----- 0.018768;select * from itparameter where itparameter.idUser is null and itparameter.idProject is null and itparameter.parameterCode='dbVersion'
2014-10-02 18:08:09 ----- DEBUG ----- 0.002663;desc itresource
2014-10-02 18:08:09 ----- DEBUG ----- 0.000487;select * from itresource where itresource.name='ourdomain.net\bmullins' and itresource.isUser = '1' 
2014-10-02 18:08:09 ----- DEBUG ----- 0.000931;select * from itparameter where  (idUser is null and idProject is null)
2014-10-02 18:08:09 ** ERROR ** ERROR **
2014-10-02 18:08:09 ** ERROR ** on file 'C:UniServerZwwwprojeqtormodelUser.php' at line (765)
2014-10-02 18:08:09 ** ERROR ***** cause = ldap_bind(): Unable to bind to server: Invalid credentials

==============


 
Posted : 03 Oct 2014 3H33
(@xeiran)
Posts: 2
New Member
 

Solved my own problem.

  1. On our Microsoft Server 2012 R2 setup, neither the filter 'uid=' nor the filter 'sAMaccountName=' worked for me. Instead I had to use the filter 'userPrincipalName=%USERNAME%', specifying the login as 'username @ ourdomain.net' (without spaces, of course)
  2. I did not specify the 'LDAP user' connection string correctly.

As suggested in other threads, if you are using Active Directory, use the command line tool "dsquery" to get the exact LDAP user connection string, like this:

  • dsquery user -name *
  • or

  • dsquery user -name partialfirstname*
  • The exact connection string that finally solved my problem was:

  • CN=ldap projeqtor,OU=ourdomain subgroup,OU=ourdomain maingroup,DC=ourdomain,DC=net
  • where CN=firstname lastname
    NOT CN=username

    One other rookie mistake I made (and I should know better) - when testing, close out your browser completely OR clear the cache settings before each attempt.


     
    Posted : 07 Oct 2014 0H39
    Share:

    Scroll to Top