Login Issues

[ClundXIII]

Hi!

I installed the latest release, barebones, php8.4 behind nginx proxy. Logging in from the Terminal works fine:

$ ldapsearch -v -H ldaps://ldap -D "cn=smm,ou=user,dc=ldap,dc=risklayer,dc=local" -W -b "dc=ldap,dc=risklayer,dc=local" "(objectClass=*)"

and I see the whole tree. phpLDAPadmin config:

APP_NAME=Laravel
APP_ENV=production
APP_KEY=<removed>
APP_DEBUG=false

APP_URL=https://<domain>/<subfolder>

LOG_CHANNEL=daily

CACHE_DRIVER=file
QUEUE_CONNECTION=sync
SESSION_DRIVER=file
SESSION_LIFETIME=120

LDAP_HOST=ldap
LDAP_USERNAME=
LDAP_PASSWORD=
LDAP_CACHE=false
LDAP_ALERT_ROOTDN=true
LDAP_CONNECTION=ldaps
LDAP_LOGIN_ATTR=CN
LDAP_LOGIN_OBJECTCLASS=simpleSecurityObject,inetOrgPerson,posixAccount
LDAP_BASE_DN='dc=ldap,dc=risklayer,dc=local'

when I log in with cn=smm,ou=user,dc=ldap,dc=risklayer,dc=local and the correct password I just receive "These credentials do not match our records."

Logging in with the rootDN works and gives me the specific error page that the account cannot be used.

[leenooks]

If you are have LDAP_LOGIN_ATTR=CN in your environment, and using those details, then PLA is expecting smm as the login, not cn=smm,ou=user,dc=ldap,dc=risklayer,dc=local (which is a DN, not a "CN").

[ClundXIII]

If you are have LDAP_LOGIN_ATTR=CN in your environment, and using those details, then PLA is expecting smm as the login, not cn=smm,ou=user,dc=ldap,dc=risklayer,dc=local (which is a DN, not a "CN").

Using LDAP_LOGIN_ATTR=DN yields the same result.

Also the user OU is ou=user,dc=ldap,dc=risklayer,dc=local which is not the base DN that I want to work in dc=ldap,dc=risklayer,dc=local.

is the LDAP_BASE_DN setting just for logging in? Should it be changed to ou=user,dc=ldap,dc=risklayer,dc=local then?

Using this config:

LDAP_LOGIN_ATTR=CN
[..]
LDAP_BASE_DN='ou=user,dc=ldap,dc=risklayer,dc=local'

with just "smm" to log in also does not work

[leenooks]

It sounds like your LDAP server is rejecting the login - you'll need to look at it's debug log to see why. Look at wiki (bottom of the page) to understand what PLA does to login to the LDAP server.

[ClundXIII]

adding the rootDN credentials as LDAP_USERNAME= and LDAP_PASSWORD= makes the login work and drops me into the next view.

Now I am running into the next issue, the the app is inside a subdirectory, the base URL is set as APP_URL= (without trailing slash). A lot of resources and an ajax request fails.

Is a subdirectory supported by phpLDAPadmin?

[ClundXIII]

Okay, I went to a custom domain, now everything works

[leenooks]

BTW: Running PLA in a subdirectory is not supported - its not supported by the underlying framework that PLA uses.
I am however working on getting PLA to work in a subpath (when it is behind a proxy).