glpi-project
Unable to synchronize existing LDAP users
Code of Conduct
- [x] I agree to follow this project's Code of Conduct
Is there an existing issue for this?
- [x] I have searched the existing issues
Version
10.0.2
Bug description
Hi,
Im on a fresh install of GLPI 10.0.2. My first LDAP user sync worked but for existing users, sync not working.
Relevant log output
PHP Warning (2): ldap_search(): Search: Bad search filter in /var/www/glpi/src/User.php at line 2008
Uncaught Exception TypeError: ldap_get_entries(): Argument #2 ($result) must be of type LDAP\Result, bool given in /var/www/glpi/src/AuthLDAP.php at line 4227
Page URL
No response
Steps To reproduce
1 - Go to Administration -> Users 2 - Try to sync existing LDAP users (expert mode or not) 3 - Check one user or more 4 - Sync
Your GLPI setup information
Informations sur le système, l'installation et la configuration
GLPI 10.0.2 ( => /var/www/glpi) Installation mode: TARBALL Current language:fr_FR
Server
Operating system: Linux CALN-GLPI 5.10.0-15-amd64 #1 SMP Debian 5.10.120-1 (2022-06-09) x86_64 PHP 8.1.8 apache2handler (Core, FFI, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apache2handler, apcu, bz2, calendar, ctype, curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, imap, intl, json, ldap, libxml, mbstring, memcache, mysqli, mysqlnd, openssl, pcre, pdo_mysql, posix, readline, session, shmop, sockets, sodium, standard, sysvmsg, sysvsem, sysvshm, tokenizer, xml, xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib) Setup: max_execution_time="30" memory_limit="128M" post_max_size="8M" safe_mode="" session.save_handler="files" upload_max_filesize="2M" Software: Apache/2.4.54 (Debian) (Apache/2.4.54 (Debian) Server at oda.agglo-lisieux.fr Port 443 ) Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Safari/537.36 Server Software: Debian 11 Server Version: 10.5.15-MariaDB-0+deb11u1 Server SQL Mode: STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION Parameters: admglpi@localhost/glpi Host info: Localhost via UNIX socketPHP version (8.1.8) is supported. Sessions configuration is OK. Allocated memory is sufficient. mysqli extension is installed. Following extensions are installed: dom, fileinfo, json, simplexml. curl extension is installed. gd extension is installed. intl extension is installed. libxml extension is installed. zlib extension is installed. The constant SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES is present. Database engine version (10.5.15) is supported. The log file has been created successfully. Write access to /var/www/glpi/files/_cache has been validated. Write access to /var/www/glpi/config has been validated. Write access to /var/www/glpi/files/_cron has been validated. Write access to /var/www/glpi/files has been validated. Write access to /var/www/glpi/files/_dumps has been validated. Write access to /var/www/glpi/files/_graphs has been validated. Write access to /var/www/glpi/files/_lock has been validated. Write access to /var/www/glpi/files/_pictures has been validated. Write access to /var/www/glpi/files/_plugins has been validated. Write access to /var/www/glpi/files/_rss has been validated. Write access to /var/www/glpi/files/_sessions has been validated. Write access to /var/www/glpi/files/_tmp has been validated. Write access to /var/www/glpi/files/_uploads has been validated. Web access to the files directory should not be allowed but this cannot be checked automatically on this instance. Make sure access to error log file (/files/_log/php-errors.log) is forbidden; otherwise review .htaccess file and web server configuration. exif extension is installed. ldap extension is installed. openssl extension is installed. zip extension is installed. bz2 extension is installed. Zend OPcache extension is installed. Following extensions are installed: ctype, iconv, mbstring, sodium. Write access to /var/www/glpi/marketplace has been validated. Timezones seems loaded in database.
GLPI constants
GLPI_ROOT: /var/www/glpi GLPI_CONFIG_DIR: /var/www/glpi/config GLPI_VAR_DIR: /var/www/glpi/files GLPI_MARKETPLACE_DIR: /var/www/glpi/marketplace GLPI_USE_CSRF_CHECK: 1 GLPI_CSRF_EXPIRES: 7200 GLPI_CSRF_MAX_TOKENS: 100 GLPI_USE_IDOR_CHECK: 1 GLPI_IDOR_EXPIRES: 7200 GLPI_ALLOW_IFRAME_IN_RICH_TEXT: GLPI_TELEMETRY_URI: https://telemetry.glpi-project.org GLPI_INSTALL_MODE: TARBALL GLPI_NETWORK_MAIL: [email protected] GLPI_NETWORK_SERVICES: https://services.glpi-network.com GLPI_MARKETPLACE_ALLOW_OVERRIDE: 1 GLPI_MARKETPLACE_MANUAL_DOWNLOADS: 1 GLPI_USER_AGENT_EXTRA_COMMENTS: GLPI_DISABLE_ONLY_FULL_GROUP_BY_SQL_MODE: 1 GLPI_AJAX_DASHBOARD: 1 GLPI_CALDAV_IMPORT_STATE: 0 GLPI_DEMO_MODE: 0 GLPI_CENTRAL_WARNINGS: 1 GLPI_DOC_DIR: /var/www/glpi/files GLPI_CACHE_DIR: /var/www/glpi/files/_cache GLPI_CRON_DIR: /var/www/glpi/files/_cron GLPI_DUMP_DIR: /var/www/glpi/files/_dumps GLPI_GRAPH_DIR: /var/www/glpi/files/_graphs GLPI_LOCAL_I18N_DIR: /var/www/glpi/files/_locales GLPI_LOCK_DIR: /var/www/glpi/files/_lock GLPI_LOG_DIR: /var/www/glpi/files/_log GLPI_PICTURE_DIR: /var/www/glpi/files/_pictures GLPI_PLUGIN_DOC_DIR: /var/www/glpi/files/_plugins GLPI_RSS_DIR: /var/www/glpi/files/_rss GLPI_SESSION_DIR: /var/www/glpi/files/_sessions GLPI_TMP_DIR: /var/www/glpi/files/_tmp GLPI_UPLOAD_DIR: /var/www/glpi/files/_uploads GLPI_INVENTORY_DIR: /var/www/glpi/files/_inventories GLPI_NETWORK_REGISTRATION_API_URL: https://services.glpi-network.com/api/registration/ GLPI_MARKETPLACE_PLUGINS_API_URI: https://services.glpi-network.com/api/glpi-plugins/ GLPI_I18N_DIR: /var/www/glpi/locales GLPI_VERSION: 10.0.2 GLPI_SCHEMA_VERSION: 10.0.2@a130db99c7d9b131c2e2ea59fe0d6260fe93d831 GLPI_MARKETPLACE_PRERELEASES: GLPI_MIN_PHP: 7.4.0 GLPI_MAX_PHP: 8.2.0 GLPI_YEAR: 2022
Libraries
htmlawed/htmlawed version 1.2.6 in (/var/www/glpi/vendor/htmlawed/htmlawed) phpmailer/phpmailer version 6.6.0 in (/var/www/glpi/vendor/phpmailer/phpmailer/src) simplepie/simplepie version 1.5.8 in (/var/www/glpi/vendor/simplepie/simplepie/library) tecnickcom/tcpdf version 6.4.4 in (/var/www/glpi/vendor/tecnickcom/tcpdf) michelf/php-markdown in (/var/www/glpi/vendor/michelf/php-markdown/Michelf) true/punycode in (/var/www/glpi/vendor/true/punycode/src) iamcal/lib_autolink in (/var/www/glpi/vendor/iamcal/lib_autolink) sabre/dav in (/var/www/glpi/vendor/sabre/dav/lib/DAV) sabre/http in (/var/www/glpi/vendor/sabre/http/lib) sabre/uri in (/var/www/glpi/vendor/sabre/uri/lib) sabre/vobject in (/var/www/glpi/vendor/sabre/vobject/lib) laminas/laminas-i18n in (/var/www/glpi/vendor/laminas/laminas-i18n/src) laminas/laminas-servicemanager in (/var/www/glpi/vendor/laminas/laminas-servicemanager/src) monolog/monolog in (/var/www/glpi/vendor/monolog/monolog/src/Monolog) sebastian/diff in (/var/www/glpi/vendor/sebastian/diff/src) donatj/phpuseragentparser in (/var/www/glpi/vendor/donatj/phpuseragentparser/src/UserAgent) elvanto/litemoji in (/var/www/glpi/vendor/elvanto/litemoji/src) symfony/console in (/var/www/glpi/vendor/symfony/console) scssphp/scssphp in (/var/www/glpi/vendor/scssphp/scssphp/src) laminas/laminas-mail in (/var/www/glpi/vendor/laminas/laminas-mail/src/Protocol) laminas/laminas-mime in (/var/www/glpi/vendor/laminas/laminas-mime/src) rlanvin/php-rrule in (/var/www/glpi/vendor/rlanvin/php-rrule/src) blueimp/jquery-file-upload in (/var/www/glpi/vendor/blueimp/jquery-file-upload/server/php) ramsey/uuid in (/var/www/glpi/vendor/ramsey/uuid/src) psr/log in (/var/www/glpi/vendor/psr/log/Psr/Log) psr/simple-cache in (/var/www/glpi/vendor/psr/simple-cache/src) psr/cache in (/var/www/glpi/vendor/psr/cache/src) league/csv in (/var/www/glpi/vendor/league/csv/src) mexitek/phpcolors in (/var/www/glpi/vendor/mexitek/phpcolors/src/Mexitek/PHPColors) guzzlehttp/guzzle in (/var/www/glpi/vendor/guzzlehttp/guzzle/src) guzzlehttp/psr7 in (/var/www/glpi/vendor/guzzlehttp/psr7/src) glpi-project/inventory_format in (/var/www/glpi/vendor/glpi-project/inventory_format/lib/php) wapmorgan/unified-archive in (/var/www/glpi/vendor/wapmorgan/unified-archive/src) paragonie/sodium_compat in (/var/www/glpi/vendor/paragonie/sodium_compat/src) symfony/cache in (/var/www/glpi/vendor/symfony/cache) html2text/html2text in (/var/www/glpi/vendor/html2text/html2text/src) symfony/css-selector in (/var/www/glpi/vendor/symfony/css-selector) symfony/dom-crawler in (/var/www/glpi/vendor/symfony/dom-crawler) twig/twig in (/var/www/glpi/vendor/twig/twig/src) twig/string-extra in (/var/www/glpi/vendor/twig/string-extra) symfony/polyfill-ctype not found symfony/polyfill-iconv not found symfony/polyfill-mbstring not found symfony/polyfill-php80 not found symfony/polyfill-php81 not found
Plugins list
Anything else?
No response
Please provide the full stack trace for the provided warnings/errors from the files/_log/php-errors.log file.
Hi,
with GLPI v10.0.2, php v8.1.7
Same problem when I force synchronization : However, user can logon but rules not apply assigns to a group for example.
Output from files/_log/php-errors.php:
[2022-07-28 11:40:05] glpiphplog.WARNING: *** PHP Warning (2): ldap_search(): Search: Bad search filter in /srv/glpi/prod/src/User.php at line 2008 Backtrace : src/User.php:2008 ldap_search() src/User.php:1696 User->ldap_get_user_groups() src/User.php:1848 User->getFromLDAPGroupDiscret() src/AuthLDAP.php:2785 User->getFromLDAP() src/AuthLDAP.php:2696 AuthLDAP::ldapImportUserByServerId() front/user.form.php:117 AuthLDAP::forceOneUserSynchronization()
[2022-07-28 11:40:05] glpiphplog.CRITICAL: *** Uncaught Exception TypeError: ldap_get_entries(): Argument #2 ($result) must be of type LDAP\Result, bool given in /srv/glpi/prod/src/AuthLDAP.php at line 4227 Backtrace : src/AuthLDAP.php:4227 ldap_get_entries() src/User.php:2011 AuthLDAP::get_entries_clean() src/User.php:1696 User->ldap_get_user_groups() src/User.php:1848 User->getFromLDAPGroupDiscret() src/AuthLDAP.php:2785 User->getFromLDAP() src/AuthLDAP.php:2696 AuthLDAP::ldapImportUserByServerId() front/user.form.php:117 AuthLDAP::forceOneUserSynchronization()
Edit : seems to be related to "Authentication > LDAP Directory > "LDAP NAME" > tab "Groups" > search type" who search type is [Users+groups or Groups Only] or if "Filter to search in groups" is not defined correctly.
There has been no activity on this issue for some time and therefore it is considered stale and will be closed automatically in 10 days.
If this issue is related to a bug, please try to reproduce on latest release. If the problem persist, feel free to add a comment to revive this issue. If it is related to a new feature, please open a topic to discuss with community about this enhancement on suggestion website.
You may also consider taking a subscription to get professionnal support or contact GLPI editor team directly.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
Just stumbled upon this and I think the error message in your log is caused by a failing unsanitize() of the ldap group search filter, as I described in #11497. I'm patching for this since 10.0.0 (with one of the quick&dirty fixes included in my bug report and I'm running on Debian 11's PHP 7.4.30 btw).
You should be able to elude the effects of this bug, if you could manage to get rid of any characters in your GROUP (!) search filter, that require escaping (like '&'). (Or by trying one of the temporary patches from my bug report, until this is properly fixed.)
There has been no activity on this issue for some time and therefore it is considered stale and will be closed automatically in 10 days.
If this issue is related to a bug, please try to reproduce on latest release. If the problem persist, feel free to add a comment to revive this issue. If it is related to a new feature, please open a topic to discuss with community about this enhancement on suggestion website.
You may also consider taking a subscription to get professionnal support or contact GLPI editor team directly.