Dokuwiki: authldap broken after upgrade to Eleanor of tsort

[KaiMartin]

After an upgrade to Eleanor of tsort login into my LDAP enabled dokuwiki instance ceased to work. The recent hot fix did nothing to this failure.

Apparently, the problem is related to the fact that our LDAP server requires a user/password pair to bind. The function ldap_bind() failed when called with arguments that reference user name and password from the config of the plugin.

  $this->getConf('binddn')
  conf_decodeString($this->getConf('bindpw'))

This is how the parameters are set in local.protected.php :

  $conf['plugin']['authldap']['binddn'] = 'cn=XXXXXXX,dc=iqo,dc=uni-hannover,dc=de';
  $conf['plugin']['authldap']['bindpw'] = 'XXXXXXXX';

If I print the values of the terms above with msg() the output looks fine. The password gets correctly extracted from the hash in the config file -- no garbled characters, no additional space.

I was able to work-around the problem by explicitly setting the values in auth.php. E.g.:

  $usr="uid=XXXXXXX,ou=people,dc=iqo,dc=uni-hannover,dc=de";
  $pwd="XXXXXX";
  if(!@ldap_bind($this->con, $usr, $pwd)) { 

This is of course just a band-aid. But it was the best I could come up with my very limited PHP programming skills.

---<)kaimartin(>---

[cainadai]

Our Dokuwki/LDAP implementation is also broken as of Elenor of Tsort, but we have long used anonymous binding, so no user/password. I'm not sure how to work around the problem without switching to an authenticated bind and following KaiMartin's workaround above, so I've restored a backup for now. Our parameters from local.php are:

$conf['authtype'] = 'authldap';
$conf['auth']['ldap']['server'] = 'athena.las';
$conf['auth']['ldap']['usertree'] = 'cn=users,dc=athena,dc=las';
$conf['auth']['ldap']['grouptree'] = 'cn=groups,dc=athena,dc=las';
$conf['auth']['ldap']['userfilter'] = '(&(uid=%{user})(objectClass=posixAccount))';
$conf['auth']['ldap']['groupfilter'] = '(&(objectClass=posixGroup)(memberUID=%{uid}))';
$conf['auth']['ldap']['version'] = '3';

Hope this helps track down the problem; if there's anywhere in particular I can look for error messages, let me know. All I get from Dokuwiki itself is "LDAP: couldn't connect to LDAP server".

[tomaskavalek]

Same problem, it seems that $this->getConf ignore anything which is declared in local.php configuration file.

[Chris--S]

When authentication modules were made plugins there was a change to how their configuration parameters were organised. The array reference should now include ['plugin'] as the first reference. iirc after the change was brought in there was code to read the old parameters, that code may have been removed now.

@cainadai I think your settings should now look like this:

$conf['authtype'] = 'authldap';
$conf['plugin']['auth']['ldap']['server'] = 'athena.las';
$conf['plugin']['auth']['ldap']['usertree'] = 'cn=users,dc=athena,dc=las';
$conf['plugin']['auth']['ldap']['grouptree'] = 'cn=groups,dc=athena,dc=las';
$conf['plugin']['auth']['ldap']['userfilter'] = '(&(uid=%{user})(objectClass=posixAccount))';
$conf['plugin']['auth']['ldap']['groupfilter'] = '(&(objectClass=posixGroup)(memberUID=%{uid}))';
$conf['plugin']['auth']['ldap']['version'] = '3';

This is also mentioned in #1616 (towards the bottom) with relation to the authad plugin.

@KaiMartin - I see a difference between your config 'binddn' string and the $usr string you've hardcoded. If that difference isn't relevant, try using dbglog() rather than msg() and look at what is output to debug.log ( found in {cachedir}, normally {dokuroot}/data/cache ) and requires 'allowdebug' to be turned on in your configuration. msg() processes the characters for safe output as html.

[tomaskavalek]

Changing structure from $conf['auth']['ldap']['...'] to $conf['plugin']['authldap']['...'] solve my problem.

[kellerkindt]

@tomaskavalek Thanks a lot!

[alfredocambera]

This information is not available on the project site. It took me a while to get here to and I think It would be really helpful for other users.