LDAP authentication not allowing new user, just keeps spinning.

[Roadster850]

I need to upgrade from 2.1.27.36 to 3.0.9, so I created a new instance on a different Linux Mint box of our current version. I made sure the new install was using PHP 7.4 etc. I copied over the appropriate files from the 'production' server as well as replaced the database with the db from production. All was well.
I upgraded Teampass by renaming the directory, and placing 3.0.9 in a new directory. I copied the files called out in the procedure from the old directory to the new directory.
When I tested access with any LDAP user who had access in the production instance, they were able to access.
I added all what I found in other webpages to the LDAP setup (attached/redacted).
When I tried to access the new test server with an account not in the proper group for access, it just kept spinning forever.
I thought I was good to go. I added that account to the LDAP group "Teampass", and thought I would be able to login.
Same result, just spinning. After many days trying different settings in the LDAP setup, I thought I must be missing something.
I hope someone can see my mistake in the configuration! Thank you in advance. Jeff

tp.config.php

'10', 'enable_favourites' => '1', 'show_last_items' => '1', 'enable_pf_feature' => '1', 'log_connections' => '0', 'log_accessed' => '1', 'time_format' => 'H:i:s', 'date_format' => 'm/d/y', 'duplicate_folder' => '0', 'item_duplicate_in_same_folder' => '0', 'duplicate_item' => '0', 'number_of_used_pw' => '3', 'manager_edit' => '1', 'cpassman_dir' => '/var/www/teampass', 'cpassman_url' => 'http://tpass', 'favicon' => 'http://tpass/favicon.ico', 'path_to_upload_folder' => '/var/www/teampass/upload', 'url_to_upload_folder' => 'https://tpass/upload', 'path_to_files_folder' => '/var/www/teampass/files', 'url_to_files_folder' => 'https://tpass/files', 'activate_expiration' => '0', 'pw_life_duration' => '0', 'maintenance_mode' => '0', 'enable_sts' => '0', 'encryptClientServer' => '1', 'teampass_version' => '3.0.9', 'ldap_mode' => '1', 'ldap_type' => 'ActiveDirectory', 'ldap_suffix' => '@example.com', 'ldap_domain_dn' => 'DC=example,DC=com', 'ldap_domain_controler' => 'dc1.example.com,dc2.example.com', 'ldap_user_attribute' => 'samaccountname', 'ldap_ssl' => '0', 'ldap_tls' => '0', 'ldap_search_base' => '0', 'ldap_port' => '389', 'richtext' => '0', 'allow_print' => '1', 'roles_allowed_to_print' => '["1"]', 'show_description' => '1', 'anyone_can_modify' => '0', 'anyone_can_modify_bydefault' => '0', 'nb_bad_authentication' => '0', 'utf8_enabled' => '1', 'restricted_to' => '0', 'restricted_to_roles' => '0', 'enable_send_email_on_user_login' => '0', 'enable_user_can_create_folders' => '1', 'insert_manual_entry_item_history' => '0', 'enable_kb' => '1', 'enable_email_notification_on_item_shown' => '0', 'enable_email_notification_on_user_pw_change' => '0', 'custom_logo' => '', 'custom_login_text' => '', 'default_language' => 'english', 'send_stats' => '1', 'send_statistics_items' => 'stat_country;stat_users;stat_items;stat_items_shared;stat_folders;stat_folders_shared;stat_admins;stat_managers;stat_ro;stat_mysqlversion;stat_phpversion;stat_teampassversion;stat_languages;stat_kb;stat_suggestion;stat_customfields;stat_api;stat_2fa;stat_agses;stat_duo;stat_ldap;stat_syslog;stat_stricthttps;stat_fav;stat_pf;', 'send_stats_time' => '1619553285', 'get_tp_info' => '1', 'send_mail_on_user_login' => '0', 'nb_items_by_query' => 'auto', 'enable_delete_after_consultation' => '0', 'enable_personal_saltkey_cookie' => '0', 'personal_saltkey_cookie_duration' => '31', 'email_smtp_server' => 'example.outlook.com', 'email_smtp_auth' => '0', 'email_auth_username' => '', 'email_auth_pwd' => '', 'email_port' => '25', 'email_security' => 'none', 'email_server_url' => '', 'email_from' => '[email protected]', 'email_from_name' => '[email protected]', 'pwd_maximum_length' => '40', 'google_authentication' => '0', 'delay_item_edition' => '0', 'allow_import' => '1', 'proxy_ip' => '', 'proxy_port' => '', 'upload_maxfilesize' => '10mb', 'upload_docext' => 'doc,docx,dotx,xls,xlsx,xltx,rtf,csv,txt,pdf,ppt,pptx,pot,dotx,xltx,pfx', 'upload_imagesext' => 'jpg,jpeg,gif,png', 'upload_pkgext' => '7z,rar,tar,zip', 'upload_otherext' => 'sql,xml', 'upload_imageresize_options' => '1', 'upload_imageresize_width' => '800', 'upload_imageresize_height' => '600', 'upload_imageresize_quality' => '90', 'use_md5_password_as_salt' => '0', 'ga_website_name' => 'TeamPass for ChangeMe', 'api' => '0', 'subfolder_rights_as_parent' => '0', 'show_only_accessible_folders' => '0', 'enable_suggestion' => '0', 'otv_expiration_period' => '7', 'default_session_expiration_time' => '60', 'duo' => '0', 'enable_server_password_change' => '0', 'ldap_object_class' => '0', 'bck_script_path' => '/var/www/teampass/backups', 'bck_script_filename' => 'bck_teampass', 'syslog_enable' => '0', 'syslog_host' => 'localhost', 'syslog_port' => '514', 'manager_move_item' => '0', 'create_item_without_password' => '1', 'otv_is_enabled' => '0', 'agses_authentication_enabled' => '0', 'item_extra_fields' => '0', 'saltkey_ante_2127' => 'none', 'migration_to_2127' => 'done', 'files_with_defuse' => 'done', 'timezone' => 'America/New_York', 'enable_attachment_encryption' => '1', 'personal_saltkey_security_level' => '50', 'ldap_new_user_is_administrated_by' => '0', 'disable_show_forgot_pwd_link' => '1', 'offline_key_level' => '60', 'enable_http_request_login' => '0', 'ldap_and_local_authentication' => '1', 'secure_display_image' => '1', 'upload_zero_byte_file' => '0', 'upload_all_extensions_file' => '0', 'bck_script_passkey' => 'somelonggroupofcharacters', 'admin_2fa_required' => '0', 'ldap_allowed_usergroup' => '', 'ldap_new_user_role' => '3', 'bck_script_key' => 'shortergroupcharacters', 'settings_offline_mode' => '1', 'password_overview_delay' => '4', 'roles_allowed_to_print_select' => '', 'clipboard_life_duration' => '30', 'mfa_for_roles' => '', 'tree_counters' => '0', 'settings_tree_counters' => '0', 'copy_to_clipboard_small_icons' => '0', 'enable_massive_move_delete' => '0', 'email_debug_level' => '0', 'ga_reset_by_user' => '', 'onthefly-backup-key' => '', 'onthefly-restore-key' => '', 'ldap_user_dn_attribute' => 'DistinguishedName', 'ldap_dn_additional_user_dn' => 'CN=Teampass,OU=Security Groups,DC=example,DC=com', 'ldap_user_object_filter' => '(&(objectCategory=Person)(objectclass=user)(memberOf=CN=teampass,dc=example,dc=com))', 'ldap_bdn' => 'dc=example,dc=com', 'ldap_hosts' => '172.XX.XX.XX,172.XX.XX.XX', 'ldap_password' => 'ThePasswordForTheAccount', 'ldap_username' => 'CN=AD READ,OU=ServiceAccts,DC=example,DC=com', 'api_token_duration' => '60', 'enable_tasks_manager' => '1', 'task_maximum_run_time' => '300', 'maximum_number_of_items_to_treat' => '300', 'tasks_manager_refreshing_period' => '100', 'ldap_tls_certifacte_check' => 'LDAP_OPT_X_TLS_NEVER', 'enable_tasks_log' => '0', 'enable_ad_users_with_ad_groups' => '0', 'enable_ad_user_auto_creation' => '0', 'ldap_group_object_filter' => '(objectClass=Teampass)', 'ldap_guid_attibute' => 'objectguid', 'sending_emails_job_frequency' => '2', 'user_keys_job_frequency' => '1', 'items_statistics_job_frequency' => '5', 'reload_cache_table_task' => '', 'rebuild_config_file' => '', 'purge_temporary_files_task' => '', 'clean_orphan_objects_task' => '', 'users_personal_folder_task' => '', 'upgrade_timestamp' => '1697660027', );

[Roadster850]

tp.config.txt

[nilsteampassnet]

@Roadster850
Can you set your LDAP attribute in lowercase letters
Example:

• User Distinguished Name: distinguishedname
• User name attribute: samaccountname

[Roadster850]

Hi Nils, I updated all settings to only lowercase letters.
The problem persists.
I did try the using the "Test current configuration" at the bottom of the LDAP page.
The test was successful with my test user "alan,wrench".
As expected, if I typed the wrong password, an error occurred.
When I tried a username and password not found in AD, a different error occurred.
It's odd that there is success for the test, but keeps spinning when trying to login using my test account.

[Roadster850]

Hi Nils, I have an update. I found "Logs" in Teampass admin UI. I attempted a login with the username and password which has been failing. In the log I see: 11/28/23 10:22:33 User does not exist alan.wrench 127.0.0.1
I wonder if the user needs to be created in Teampass first? But if I remember correctly, that is not how LDAP was described in the documentation for a new user.

[nilsteampassnet]

@Roadster850
You are right.
If it is an AD user iwthout an account in TP, he should be created.
Nevertheless, I will perform new test on this part as I didn't run the tests recently.
You can also create the account in TP from the USers page by importing it from AD.

[Roadster850]

Hi Nils, I built a new server and installed 3.0.9. I created a local user or two. We are in the process of moving from our old domains (due to growth of the business) to new domain. I thought I would try to connect to LDAP AD on the new domain. I set many of the settings the same as my other attempt, and I have the same or similar results. When I go to the users page and try to synchronize or list users, I just see the spinning icon, the same as when I attempt to login via an AD user account. As before, if I enter the incorrect username or password when trying to login, I receive an error. I will attach the tp.config.php, a screenshot of the settings and the error shown within Teampass and the logs from /var/logs/apache2. Thank you.

teampass_access.txt
teampass_error.txt

[Roadster850]

Hi Nils, I thought I would make sure there wasn't something in our current AD causing the problem. We currently have 3 domains we are moving to 1 domain. (As a result of mergers etc.) I created a new install of version 3.0.9 on Ubuntu. I setup LDAP in the same way as the server in question above, with the exception of the domain name. Also, I made sure there were no spaces in the username used to connect to AD, in case the spaces were causing a problem. I see very similar results - when I go into Users page and click LDAP sync, I see the spinning icon, when I click List users, another spinning icon appears with no results for either. When I attempt to login as an AD user, I see the spinning icon. As a test, when I type the wrong password, Teampass shows an error as expected. If I spell a username incorrectly with the correct password, an error is shown also as expected. I will attach logs and screenshots. The username for my test account is "alan.wrench". In the Logs via the GUI, "User does not exist" is shown after an attempt is made using the correct username and password.
I had to append .txt to the extension for the tp.config.php file in order to attach the file.

Thank you!

tp.config.php.txt

teampass_error.txt

[jntgavetti]

I got some error when try using LDAP to, sometimes it configures correctly and i can list all the active directory users, add, edit and sht but can't login.

[jntgavetti]

Ps: Is a new installation, i'm using the latest version with Docker.
tp.config.txt

[Blubmann1337]

Maybe you have the same problem I have. After the upgrade, all users were recognized as local users.
I was able to check this with the following query to the database: select id,auth_type, name from teampasteampass_users;

[Roadster850]

Yes, I found the same results. Active Directory users were switched to local users.
I wasn't too concerned about the change, as we are changing domains as soon as I am able to authenticate users via Active Directory. We currently have only about 6 accounts, but the number will be increasing considerably once the move is complete. The usernames change on the new domain from first initial dot last name in most cases to first name dot last name for all. (Standardized). The of the six current users, only two of us have private folders.

[Roadster850]

I found an acceptable workaround. I loaded the latest build 3.1.0 as a new install, set all settings as they were on my other attempts. Same results as before. I removed the entry for "Additional User DN" which was: cn=rmstp,ou=groups,dc=domainname,dc=com.
Now when as admin I go to Users and click the LDAP synchronization button, then list, I see all users and I believe groups as well. Under action is a person silhouette with a + next to it. I tried logging in as an LDAP user, and it just keeps spinning. I added my own account by clicking the Action icon next to my name and following the necessary actions to add my account. After completing, I am able to do what I would expect to be able to do. Just to be sure, I tried my test user without adding the account first. The user just sees the spinning icon.
As far as I am concerned, my issue is resolved as we are able to keep people out unless we add them. Thank you Nils for all of your work.