Hi,

No this is not an encryption issue.
This is anaccount issue.
You need to define correct user to browse the LDAP, then connecting user must provide own LDAP password.

If you don't succeed, you will probzbly have an explanation in the log file.

Hello Babynus,

I don't understand... I can connect with any Active Directory account without entering the password.. How is this possible?
Is the ldap module checks the password of the Active Directory?

I have no error message in the log file...

Here are my parameters:
LDAP base dn: dc=domain,dc=local
LDAP user: cn=administrator,cn=Users,dc=domain,dc=local
LDAP password: password administrator account
LDAP user filter: I tried sAMAccount=%username% and also (&(objectCategory=user)(memberof=CN=GRP_Projeqtor,OU=Groups,DC=domain,DC=local))

I can connect with any Active Directory account without entering the password

You mean you can connect to ProjeQtOr with any account, without entreing the password ?
This should really not be possible.

LDAP user filter: I tried sAMAccount=%username%

You must define a filter that leads to the username entered in the login screen.

I can connect with any Active Directory account without entering the password

You mean you can connect to ProjeQtOr with any account, without entreing the password ?
This should really not be possible.

That's it exactly.

LDAP user filter: I tried sAMAccount=%username%

You must define a filter that leads to the username entered in the login screen.

Ah ok. I'll try.
Thanks.

There is really a security problem.
I can connect with any account, with or without entering password...

Can you check if it's coding problem, please?

Thanks Babynus

Hi,

I ran several tests and never could connect witrhout password.
Maybe it is due to your Active Directory configuration, alowing anonymous connections or at least connections without password.
(on my side I use OpenLdap)

I tried with :

incorrect LDAP base DN => error
incorrect LDAP host => error
incorrect LDAP port => error
incorrect LDAP version => error
incorrect LDAP user => error
incorrect LDAP password => error
LDAP filter "uid=%USERNAME%", correct password => login OK (new user created with uid)
LDAP filter "uid=%USERNAME%", incorrect password => "invalid login parameters"
LDAP filter "uid=%USERNAME%", no password => "invalid login parameters"
LDAP filter "cn=%USERNAME%", no password => login OK (new user created with common name)
LDAP filter "cn=%USERNAME%", incorrect password => "invalid login parameters"
LDAP filter "cn=%USERNAME%", no password => "invalid login parameters"
LDAP filter "xx=%USERNAME%", correct password => "invalid login parameters" (no match for filter)

So what you are facing does not seem to be a programming issue.
I guess it is an AD issue : allowing anonymous access or access with no password.

Hi,

To try and debug, could you please try to :
- download and unzip attached file
- copy this User.php file into /model directory
- set debugLevel="3"
- try again without password

You should retrieve in the log file something like :

2014-01-02 14:12:40 ----- DEBUG ----- ** trace binding admin **
2014-01-02 14:12:40 ----- DEBUG ----- user='cn=Manager,dc=maxcrc,dc=com'
2014-01-02 14:12:40 ----- DEBUG ----- password='secret'
2014-01-02 14:12:40 ----- DEBUG ----- binding OK
2014-01-02 14:12:40 ----- DEBUG ----- result:
2014-01-02 14:12:40 ----- DEBUG ----- 1
2014-01-02 14:12:40 ----- DEBUG ----- filter=uid=other
2014-01-02 14:12:40 ----- DEBUG ----- dn=uid=other,ou=People,dc=maxcrc,dc=com
2014-01-02 14:12:40 ----- DEBUG ----- ldap_user_dn='uid=other,ou=People,dc=maxcrc,dc=com'
2014-01-02 14:12:40 ----- DEBUG ----- parampassword=''
2014-01-02 14:12:40 ** ERROR ** ERROR **
2014-01-02 14:12:40 ** ERROR ** on file 'D:ProgrammesEasyPHP.12.1wwwprojeqtormodelUser.php' at line (782)
2014-01-02 14:12:40 ** ERROR ***** cause = ldap_bind(): Unable to bind to server: Server is unwilling to perform
2014-01-02 14:12:40 ----- DEBUG ----- result bind user:
2014-01-02 14:12:40 ----- DEBUG -----
2014-01-02 14:12:40 ----- DEBUG ----- incorrect binding

Please post your own result here (after hiding password with stars)

Hello Babynus,

My question is stupid but how to set debugLevel=3 ? 😛

In your parameters.php file.
The location of this file is defined in file /tool/parametersLocation.php.
By defaut, it is "../files/config/parameters.php", but it is highly advised to move it outside web access.

The only stupid question is the one that is not asked 😉

Hello Babynus,

Here are logs file:

I try to connect with AD account without password: connection successfull

2014-01-06 10:12:28 ----- DEBUG ----- ** trace binding admin **
2014-01-06 10:12:28 ----- DEBUG ----- user='cn=s_projeqtor,ou=Projeqtor,dc=domain,dc=local'
2014-01-06 10:12:28 ----- DEBUG ----- password='mypassword'
2014-01-06 10:12:28 ----- DEBUG ----- binding OK
2014-01-06 10:12:28 ----- DEBUG ----- result:
2014-01-06 10:12:28 ----- DEBUG ----- 1
2014-01-06 10:12:28 ----- DEBUG ----- filter=(&(objectCategory=user)(memberof=CN=APP_Projeqtor,OU=Projeqtor,DC=domain,DC=local))
2014-01-06 10:12:28 ----- DEBUG ----- dn=CN=s_projeqtor,OU=Projeqtor,DC=domain,DC=local
2014-01-06 10:12:28 ----- DEBUG ----- ldap_user_dn='CN=s_projeqtor,OU=Projeqtor,DC=domain,DC=local'
2014-01-06 10:12:28 ----- DEBUG ----- parampassword=''
2014-01-06 10:12:28 ----- DEBUG ----- result bind user:
2014-01-06 10:12:28 ----- DEBUG ----- 1
2014-01-06 10:12:28 ----- DEBUG ----- ** end trace binding **
2014-01-06 10:12:28 ===== TRACE ===== NEW CONNECTED USER 'user1'

Then, I try to connect with AD account with password:
2014-01-06 10:19:02 ----- DEBUG ----- ** trace binding admin **
2014-01-06 10:19:02 ----- DEBUG ----- user='cn=s_projeqtor,ou=Projeqtor,dc=domain,dc=local'
2014-01-06 10:19:02 ----- DEBUG ----- password='mypassword'
2014-01-06 10:19:02 ----- DEBUG ----- binding OK
2014-01-06 10:19:02 ----- DEBUG ----- result:
2014-01-06 10:19:02 ----- DEBUG ----- 1
2014-01-06 10:19:02 ----- DEBUG ----- filter=(&(objectCategory=user)(memberof=CN=APP_Projeqtor,OU=Projeqtor,DC=domain,DC=local))
2014-01-06 10:19:02 ----- DEBUG ----- dn=CN=s_projeqtor,OU=Projeqtor,DC=domain,DC=local
2014-01-06 10:19:02 ----- DEBUG ----- ldap_user_dn='CN=s_projeqtor,OU=Projeqtor,DC=domain,DC=local'
2014-01-06 10:19:02 ----- DEBUG ----- parampassword='mypassword'
2014-01-06 10:19:02 ----- DEBUG ----- result bind user:
2014-01-06 10:19:02 ----- DEBUG ----- 1
2014-01-06 10:19:02 ----- DEBUG ----- ** end trace binding **
2014-01-06 10:19:02 ===== TRACE ===== NEW CONNECTED USER 'user1'

User1 added in user list on Projeqtor but the name is s_projeqtor (it's service account).

Hi,

The issue is on your filter.

filter=(&(objectCategory=user)(memberof=CN=APP_Projeqtor,OU=Projeqtor,DC=domain,DC=local))

It retrieves exactly the dn of your admin user :

dn=CN=s_projeqtor,OU=Projeqtor,DC=domain,DC=local

The unexpected behavior is that as you are already connected with this user, the binding with no password works.
It explains why user1 is created with service name (s_projeqtor).

You must define a filter that will retrieve the user that tries to connect, using the %USERNAME% parameter.
("user1" does not appear in the logged filter)