LDAP - not all providers support 'WhoAmI'

[NiceRath]

Greetings.

Problem:

Not all LDAP providers support the extended action 'WhoAmI' (OID 1.3.6.1.4.1.4203.1.11.3)

For example -> see Google-LDAP

Google only supports the Extended action for StartTLS

This can be reproduced using 'ldapwhoami':

ldapwhoami -H ldap://server:389 -D "uid=user.name,ou=Users,dc=org,dc=com" -x -W -V -d1
> ...
> connect success
> ...
> ldap_bind: Success (0)
>         additional info: Valid access code
> ...
> request done: ld 0x55667aa11a40 msgid 2
> res_errno: 2, res_error: <>, res_matched: <>
> ...
> ldap_parse_result: Protocol error (2)

If one comments out the 'WhoAmI' call (api/login.go) in the development environment - the login works.

// Bind as the user
userdn := sr.Entries[0].DN
if err = l.Bind(userdn, password); err != nil {
        return nil, err
}

// Ensure authentication and verify itself with whoami operation
//var res *ldap.WhoAmIResult
//if res, err = l.WhoAmI(nil); err != nil {
//        return nil, err
//}
//if len(res.AuthzID) <= 0 {
//        return nil, fmt.Errorf("error while doing whoami operation")
//}

// Second time bind as read only user
if err = l.Bind(util.Config.LdapBindDN, util.Config.LdapBindPassword); err != nil {
        return nil, err
}

possible Solutions:

• Replace the 'WhoAmI' call with some other logic that does not require extended LDAP-actions
• Add a config-flag to disable this post-bind check if needed

- Rath

[leanderjanssen]

I'm running into the same problem when trying to connect to an lldap instance I'm using. A flag to disable the whoami operation would be great to have as an option.

[NiceRath]

@fiftin Greetings! Your Input would be appreciated. It seems the 'WhoAmI' LDAP-check is a problem. If you want a config-flag 'ldap_whoami' (or something like that) I can add it in a PR!

- Rath

[fiftin]

@NiceRath looks 👍

[Imkerix]

Just as an additional information: The same problem seams to happen with Samba 4.17.4

[Zen3515]

I've been experiencing this for ages.

At first, around a year ago my LDAP works, but after a while it stop working exclusively with semaphore. And I was forced to use internal login ever since.

PS. I use GLAuth

[aaronnad]

Also experiencing this. Feature flag would be much appreciated. @NiceRath can you do the honors to add the config-flag please? Would be much appreciated

[koalaeagle]

Thanks for the information here. I am running in docker and was able to patch out the whoami section as you have shown and build my own docker container with the patch. Suddenly my LDAP problems went away (I was getting a vague LDAP protocol error).

This was my first application setup with a new Authentik deployment (supporting LDAP via "outpost"), wasted a lot of time thinking it was a configuration issue!

[NiceRath]

@aaronnad Sorry - have forgotten about it (; PR https://github.com/ansible-semaphore/semaphore/pull/1317 is here now.

- Rath

[CallMeTerdFerguson]

Also experiencing the same issue attempting to use LDAP authentication via Authentik. Any update on if/when this PR will be merged?

[Zen3515]

Also experiencing the same issue attempting to use LDAP authentication via Authentik. Any update on if/when this PR will be merged?

I wonder when it will get merge too, but I think people will just jump the ship to OIDC instead, take a look here

[NiceRath]

I don't see OIDC replacing LDAP completely. Not everybody has an Identiy Provider that supports that protocol.. No clue what is the problem with merging the PR :(

[CallMeTerdFerguson]

Thanks @Zen3515 , while this does still need merged because not everyone can move to OIDC as @NiceRath pointed out, since I'm using Authentik I went ahead and did and have that up and running perfectly. Appreciate the heads up.

[ohmer1]

Seem like this is the cause of the following error I get when trying to authenticate via LDAP.

semaphore[484204]: time="2023-10-17T16:39:53-04:00" level=warning msg="LDAP Result Code 2 \"Protocol Error\": Extended Operation(1.3.6.1.4.1.4203.1.11.3) not supported

The ldap server is samba running as a AD domain controller.

[csakaszamok]

Seem like this is the cause of the following error I get when trying to authenticate via LDAP.

semaphore[484204]: time="2023-10-17T16:39:53-04:00" level=warning msg="LDAP Result Code 2 \"Protocol Error\": Extended Operation(1.3.6.1.4.1.4203.1.11.3) not supported

The ldap server is samba running as a AD domain controller.

same error is here

[fiftin]

WhoAmI-check has been removed.