ntoupin Posted November 30, 2017 Author Posted November 30, 2017 Anybody got any further with this? I still can't get past the login page I know ldaps is working and according to phpinfo php-ldap is working As far as I can see my config and authentication files look correct Enable ldap debugging, what error is it throwing? ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7); 1
markwilfan Posted November 30, 2017 Posted November 30, 2017 Thanks @ntoupin Didn't know how to turn on logging. Eventually got it to spew out some logs and found this error "TLS: peer cert untrusted or revoked (0x42)" A bit of Google-Fu later (other search engines are available) and adding "TLS_REQCERT allow" to the /etc/ldap/ldap.conf file has let me log in. Not tested yet though as got excited I got this far.
ntoupin Posted November 30, 2017 Author Posted November 30, 2017 (edited) Thanks @ntoupin Didn't know how to turn on logging. Eventually got it to spew out some logs and found this error "TLS: peer cert untrusted or revoked (0x42)" A bit of Google-Fu later (other search engines are available) and adding "TLS_REQCERT allow" to the /etc/ldap/ldap.conf file has let me log in. Not tested yet though as got excited I got this far. The certificate authentication for LDAPS has been the most common issue people have had when PMing me for help - I usually tell most to just set ldap.conf to "TLS_REQCERT never" right off the bat for testing - if everything works after that then the cert/ldaps is the issue. Edited November 30, 2017 by ntoupin
markwilfan Posted November 30, 2017 Posted November 30, 2017 Thanks for that @ntoupin Alas I get php errors on trying to create an account. PHP Warning: ldap_search(): Search: Operations error in /home/support/public_html/guests/index.php on line 179 PHP Warning: ldap_sort() expects parameter 2 to be resource, boolean given in /home/support/public_html/guests/index.php on line 180 PHP Warning: ldap_count_entries() expects parameter 2 to be resource, boolean given in /home/support/public_html/guests/index.php on line 182 PHP Warning: ldap_add(): Add: Operations error in /home/support/public_html/guests/index.php on line 217 PHP Warning: ldap_mod_add(): Modify: Operations error in /home/support/public_html/guests/index.php on line 243
markwilfan Posted November 30, 2017 Posted November 30, 2017 Rrrrrrrrrrrrrrrrrewind. I'd mistyped the password for the ldap bind. Thanks so much for your help @ntoupin . Great little script too!
markwilfan Posted November 30, 2017 Posted November 30, 2017 @ntoupin just a thought. I've used github to install your script. If I "git pull" if you update it I assume that will wipe out my configs Just noticed a few things whilst messing about. $ldap_users_group = "Admin Staff"; is missing from index.php also at the moment the $ldap_manager_group doesn't do anything as it is given $access = 3 and that is not specified so you get normal user periods. I've just changed line 100 on authenticate to if(strpos($grps, $ldap_manager_group)) { $access = 2; break; } else so that our domain admins can create accounts up to 1 year. Thanks again. Been looking for something like this for ages.
ntoupin Posted November 30, 2017 Author Posted November 30, 2017 Rrrrrrrrrrrrrrrrrewind. I'd mistyped the password for the ldap bind. Thanks so much for your help @ntoupin . Great little script too! My pleasure, enjoy! It's been very convenient to not have to create guest/temporary accounts for wifi/computer authentication for speakers, events, etc. myself and allow the staff to do this themselves, so hopefully you find the same!
ntoupin Posted November 30, 2017 Author Posted November 30, 2017 @ntoupin just a thought. I've used github to install your script. If I "git pull" if you update it I assume that will wipe out my configs Just noticed a few things whilst messing about. $ldap_users_group = "Admin Staff"; is missing from index.php also at the moment the $ldap_manager_group doesn't do anything as it is given $access = 3 and that is not specified so you get normal user periods. I've just changed line 100 on authenticate to so that our domain admins can create accounts up to 1 year. Thanks again. Been looking for something like this for ages. Correct, if I do ever update it my plan was to put the configs into a database so no configs would need to be done in the actual code. Those we're just placeholders for future settings / changes. Of course feel free to change/modify to your needs. Not sure that I'll ever update it on git though as I really only made this for my own use and just wanted to share it in working condition for others that could find use for it.
markwilfan Posted February 27, 2018 Posted February 27, 2018 @ntoupin Hey buddy. It seems some kind of update has broken the guest reg script. I haven't managed to pin down what has broken it and was wondering if you could spin me in the right direction. When somebody submits the form you get a message that says "Error: This username already exists. Please try again with a different username.". The script does actually make the account so obviously something in the error checking logic is wrong. Below is an output from the apache error log read1msg: mark request completed, ld 0x55f59b6394a0 msgid 2 request done: ld 0x55f59b6394a0 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed ldap_msgfree ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP sch4304.internal:636 ldap_new_socket: 6 ldap_prepare_socket: 6 ldap_connect_to_host: Trying 172.16.111.1:636 ldap_pvt_connect: fd: 6 tm: -1 async: 0 attempting to connect: connect success TLS: peer cert untrusted or revoked (0x42) ldap_open_defconn: successful ldap_send_server_request ldap_result ld 0x55d3cbb6d460 msgid 1 wait4msg ld 0x55d3cbb6d460 msgid 1 (infinite timeout) wait4msg continue ld 0x55d3cbb6d460 msgid 1 all 1 ** ld 0x55d3cbb6d460 Connections: * host: sch4304.internal port: 636 (default) refcnt: 2 status: Connected last used: Tue Feb 27 23:12:00 2018 ** ld 0x55d3cbb6d460 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x55d3cbb6d460 request count 1 (abandoned 0) ** ld 0x55d3cbb6d460 Response Queue: Empty ld 0x55d3cbb6d460 response count 0 ldap_chkResponseList ld 0x55d3cbb6d460 msgid 1 all 1 ldap_chkResponseList returns ld 0x55d3cbb6d460 NULL ldap_int_select read1msg: ld 0x55d3cbb6d460 msgid 1 all 1 read1msg: ld 0x55d3cbb6d460 msgid 1 message type bind read1msg: ld 0x55d3cbb6d460 0 new referrals read1msg: mark request completed, ld 0x55d3cbb6d460 msgid 1 request done: ld 0x55d3cbb6d460 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ldap_msgfree ldap_add_ext ldap_send_initial_request ldap_send_server_request ldap_result ld 0x55d3cbb6d460 msgid 2 wait4msg ld 0x55d3cbb6d460 msgid 2 (infinite timeout) wait4msg continue ld 0x55d3cbb6d460 msgid 2 all 1 ** ld 0x55d3cbb6d460 Connections: * host: sch4304.internal port: 636 (default) refcnt: 2 status: Connected last used: Tue Feb 27 23:12:00 2018 ** ld 0x55d3cbb6d460 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x55d3cbb6d460 request count 1 (abandoned 0) ** ld 0x55d3cbb6d460 Response Queue: Empty ld 0x55d3cbb6d460 response count 0 ldap_chkResponseList ld 0x55d3cbb6d460 msgid 2 all 1 ldap_chkResponseList returns ld 0x55d3cbb6d460 NULL ldap_int_select read1msg: ld 0x55d3cbb6d460 msgid 2 all 1 read1msg: ld 0x55d3cbb6d460 msgid 2 message type add read1msg: ld 0x55d3cbb6d460 0 new referrals read1msg: mark request completed, ld 0x55d3cbb6d460 msgid 2 request done: ld 0x55d3cbb6d460 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed ldap_create ldap_url_parse_ext(ldaps://sch4304.internal) ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP sch4304.internal:636 ldap_new_socket: 6 ldap_prepare_socket: 6 ldap_connect_to_host: Trying 172.16.111.1:636 ldap_pvt_connect: fd: 6 tm: -1 async: 0 attempting to connect: connect success TLS: peer cert untrusted or revoked (0x42) ldap_open_defconn: successful ldap_send_server_request ldap_result ld 0x55d3cbb6d460 msgid 1 wait4msg ld 0x55d3cbb6d460 msgid 1 (infinite timeout) wait4msg continue ld 0x55d3cbb6d460 msgid 1 all 1 ** ld 0x55d3cbb6d460 Connections: * host: sch4304.internal port: 636 (default) refcnt: 2 status: Connected last used: Tue Feb 27 23:12:00 2018 ** ld 0x55d3cbb6d460 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x55d3cbb6d460 request count 1 (abandoned 0) ** ld 0x55d3cbb6d460 Response Queue: Empty ld 0x55d3cbb6d460 response count 0 ldap_chkResponseList ld 0x55d3cbb6d460 msgid 1 all 1 ldap_chkResponseList returns ld 0x55d3cbb6d460 NULL ldap_int_select read1msg: ld 0x55d3cbb6d460 msgid 1 all 1 read1msg: ld 0x55d3cbb6d460 msgid 1 message type bind read1msg: ld 0x55d3cbb6d460 0 new referrals read1msg: mark request completed, ld 0x55d3cbb6d460 msgid 1 request done: ld 0x55d3cbb6d460 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ldap_msgfree ldap_modify_ext ldap_send_initial_request ldap_send_server_request ldap_result ld 0x55d3cbb6d460 msgid 2 wait4msg ld 0x55d3cbb6d460 msgid 2 (infinite timeout) wait4msg continue ld 0x55d3cbb6d460 msgid 2 all 1 ** ld 0x55d3cbb6d460 Connections: * host: sch4304.internal port: 636 (default) refcnt: 2 status: Connected last used: Tue Feb 27 23:12:00 2018 ** ld 0x55d3cbb6d460 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x55d3cbb6d460 request count 1 (abandoned 0) ** ld 0x55d3cbb6d460 Response Queue: Empty ld 0x55d3cbb6d460 response count 0 ldap_chkResponseList ld 0x55d3cbb6d460 msgid 2 all 1 ldap_chkResponseList returns ld 0x55d3cbb6d460 NULL ldap_int_select read1msg: ld 0x55d3cbb6d460 msgid 2 all 1 read1msg: ld 0x55d3cbb6d460 msgid 2 message type modify read1msg: ld 0x55d3cbb6d460 0 new referrals read1msg: mark request completed, ld 0x55d3cbb6d460 msgid 2 request done: ld 0x55d3cbb6d460 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed ldap_msgfree Thanks in advance
Martin48 Posted February 28, 2018 Posted February 28, 2018 I was horrified by the title, but then actually liked your project / idea and implementation well done, would probably be useful here and mroe secure then a generic supply account for example...
ntoupin Posted March 6, 2018 Author Posted March 6, 2018 @ntoupin Hey buddy. It seems some kind of update has broken the guest reg script. I haven't managed to pin down what has broken it and was wondering if you could spin me in the right direction. When somebody submits the form you get a message that says "Error: This username already exists. Please try again with a different username.". The script does actually make the account so obviously something in the error checking logic is wrong. Below is an output from the apache error log read1msg: mark request completed, ld 0x55f59b6394a0 msgid 2 request done: ld 0x55f59b6394a0 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed ldap_msgfree ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP sch4304.internal:636 ldap_new_socket: 6 ldap_prepare_socket: 6 ldap_connect_to_host: Trying 172.16.111.1:636 ldap_pvt_connect: fd: 6 tm: -1 async: 0 attempting to connect: connect success TLS: peer cert untrusted or revoked (0x42) ldap_open_defconn: successful ldap_send_server_request ldap_result ld 0x55d3cbb6d460 msgid 1 wait4msg ld 0x55d3cbb6d460 msgid 1 (infinite timeout) wait4msg continue ld 0x55d3cbb6d460 msgid 1 all 1 ** ld 0x55d3cbb6d460 Connections: * host: sch4304.internal port: 636 (default) refcnt: 2 status: Connected last used: Tue Feb 27 23:12:00 2018 ** ld 0x55d3cbb6d460 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x55d3cbb6d460 request count 1 (abandoned 0) ** ld 0x55d3cbb6d460 Response Queue: Empty ld 0x55d3cbb6d460 response count 0 ldap_chkResponseList ld 0x55d3cbb6d460 msgid 1 all 1 ldap_chkResponseList returns ld 0x55d3cbb6d460 NULL ldap_int_select read1msg: ld 0x55d3cbb6d460 msgid 1 all 1 read1msg: ld 0x55d3cbb6d460 msgid 1 message type bind read1msg: ld 0x55d3cbb6d460 0 new referrals read1msg: mark request completed, ld 0x55d3cbb6d460 msgid 1 request done: ld 0x55d3cbb6d460 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ldap_msgfree ldap_add_ext ldap_send_initial_request ldap_send_server_request ldap_result ld 0x55d3cbb6d460 msgid 2 wait4msg ld 0x55d3cbb6d460 msgid 2 (infinite timeout) wait4msg continue ld 0x55d3cbb6d460 msgid 2 all 1 ** ld 0x55d3cbb6d460 Connections: * host: sch4304.internal port: 636 (default) refcnt: 2 status: Connected last used: Tue Feb 27 23:12:00 2018 ** ld 0x55d3cbb6d460 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x55d3cbb6d460 request count 1 (abandoned 0) ** ld 0x55d3cbb6d460 Response Queue: Empty ld 0x55d3cbb6d460 response count 0 ldap_chkResponseList ld 0x55d3cbb6d460 msgid 2 all 1 ldap_chkResponseList returns ld 0x55d3cbb6d460 NULL ldap_int_select read1msg: ld 0x55d3cbb6d460 msgid 2 all 1 read1msg: ld 0x55d3cbb6d460 msgid 2 message type add read1msg: ld 0x55d3cbb6d460 0 new referrals read1msg: mark request completed, ld 0x55d3cbb6d460 msgid 2 request done: ld 0x55d3cbb6d460 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed ldap_create ldap_url_parse_ext(ldaps://sch4304.internal) ldap_sasl_bind_s ldap_sasl_bind ldap_send_initial_request ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP sch4304.internal:636 ldap_new_socket: 6 ldap_prepare_socket: 6 ldap_connect_to_host: Trying 172.16.111.1:636 ldap_pvt_connect: fd: 6 tm: -1 async: 0 attempting to connect: connect success TLS: peer cert untrusted or revoked (0x42) ldap_open_defconn: successful ldap_send_server_request ldap_result ld 0x55d3cbb6d460 msgid 1 wait4msg ld 0x55d3cbb6d460 msgid 1 (infinite timeout) wait4msg continue ld 0x55d3cbb6d460 msgid 1 all 1 ** ld 0x55d3cbb6d460 Connections: * host: sch4304.internal port: 636 (default) refcnt: 2 status: Connected last used: Tue Feb 27 23:12:00 2018 ** ld 0x55d3cbb6d460 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x55d3cbb6d460 request count 1 (abandoned 0) ** ld 0x55d3cbb6d460 Response Queue: Empty ld 0x55d3cbb6d460 response count 0 ldap_chkResponseList ld 0x55d3cbb6d460 msgid 1 all 1 ldap_chkResponseList returns ld 0x55d3cbb6d460 NULL ldap_int_select read1msg: ld 0x55d3cbb6d460 msgid 1 all 1 read1msg: ld 0x55d3cbb6d460 msgid 1 message type bind read1msg: ld 0x55d3cbb6d460 0 new referrals read1msg: mark request completed, ld 0x55d3cbb6d460 msgid 1 request done: ld 0x55d3cbb6d460 msgid 1 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ldap_msgfree ldap_modify_ext ldap_send_initial_request ldap_send_server_request ldap_result ld 0x55d3cbb6d460 msgid 2 wait4msg ld 0x55d3cbb6d460 msgid 2 (infinite timeout) wait4msg continue ld 0x55d3cbb6d460 msgid 2 all 1 ** ld 0x55d3cbb6d460 Connections: * host: sch4304.internal port: 636 (default) refcnt: 2 status: Connected last used: Tue Feb 27 23:12:00 2018 ** ld 0x55d3cbb6d460 Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ld 0x55d3cbb6d460 request count 1 (abandoned 0) ** ld 0x55d3cbb6d460 Response Queue: Empty ld 0x55d3cbb6d460 response count 0 ldap_chkResponseList ld 0x55d3cbb6d460 msgid 2 all 1 ldap_chkResponseList returns ld 0x55d3cbb6d460 NULL ldap_int_select read1msg: ld 0x55d3cbb6d460 msgid 2 all 1 read1msg: ld 0x55d3cbb6d460 msgid 2 message type modify read1msg: ld 0x55d3cbb6d460 0 new referrals read1msg: mark request completed, ld 0x55d3cbb6d460 msgid 2 request done: ld 0x55d3cbb6d460 msgid 2 res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_parse_result ldap_msgfree ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed ldap_msgfree Thanks in advance That error throw is custom coded in the php, it's not an actual LDAP error. It's coded to throw that error... if ($info !=1){ } where $info = ldap_count_entries($ldap, $result); when binding the ldap connection. How the form is working is that you enter the details and when you submit it binds to the ldap server, does an ldap search for the username you entered. If it finds an entry, it results a false for $info!=1 because $info would be 1 (matching the username in your LDAP) and goes to the else {} statement which just echo's the error message into the page. It shouldn't create the account if it's throwing that error as the only code in the else {} statement that shows the error is the error, the code that actually creates an account in LDAP is dependent on the if ($info !=1){ } passing as true. The only thing I can think of that would do that would be users submitting the form, it creates the account in the backend while processing the end user's page, then while the page is still loading they hit submit again thus bringing them to the error message (basically double clicking the submit button) vs. submitting once and waiting for a page load. If that's not the case, attach or pm me your index.php code so I can take a look.
markwilfan Posted March 9, 2018 Posted March 9, 2018 @ntoupin Thank you again so much for looking at this. From your explanation I worked out there was something in my html that breaking your code so I just redid the custom bits and it is fine now. Not sure why it stopped working though. Thanks again
myioriextan Posted April 12, 2020 Posted April 12, 2020 i know this kinna old topic. but can you help me with this? im also stuck at Login failed: Incorrect user name, password, or rights
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now