LDAP works but at the same time not?

[JTzLinux]

Hello everyone recently I tried to setup ldap with semaphore I keep on getting the error: "Incorrect login or password" but in the log I get: INFO[0003] User HIDDEN with email HIDDEN authorized via LDAP correctly This is my Configuration if that could help:

 	"ldap_binddn": "cn=None,ou=Benutzern,ou=IT,dc=HIDDEN,dc=HIDDEN",
 	"ldap_bindpassword": "HIDDEN",
 	"ldap_server": "HIDDEN:389",
 	"ldap_searchdn": "ou=Benutzern,ou=IT,dc=HIDDEN,dc=HIDDEN",
 	"ldap_searchfilter": "(sAMAccountName=%s)",
 	"ldap_mappings": {
 		"dn": "",
 		"mail": "mail",
 		"uid": "sAMAccountName",
 		"cn": "cn"
 	},
 	"ldap_enable": true,
 	"ldap_needtls": false,

Thanks in advance

[markuman]

same here

[JTzLinux]

glad I am not the only one who has the same problem

[markuman]

I guess this is a duplicated issue to

https://github.com/ansible-semaphore/semaphore/issues/1522#issuecomment-1742050754, https://github.com/ansible-semaphore/semaphore/issues/1298

[JTzLinux]

Not 100% I did not use Docker I used the deb file to install it aka the Package Manager method but I am not sure if it makes that much of a difference

[markuman]

Not 100% I did not use Docker I used the deb file to install it aka the Package Manager method but I am not sure if it makes that much of a difference

I guess not .... by the way. I'm also using .deb installation.

[JTzLinux]

Ok welp I hope there will be a fix soon x)

[vdudejon]

I'm running into this same issue, and it seems like there's some sort of issue with the mapping of mail and uid. In my org, our logins are first initial lastname @ company.corp, ie [email protected]. But our emails are [email protected].

WORKS:

"mail": "userPrincipalName", # [email protected]
"uid": "sAMAccountName",     # jdoe

WORKS:

"mail": "userPrincipalName", # [email protected]
 "uid": "userPrincipalName", # [email protected]

BROKEN:

"mail": "mail",          # [email protected]
"uid": "sAMAccountName", # jdoe

BROKEN:

"mail": "mail",             # [email protected]
"uid": "userPrincipalName", # [email protected]

[fiftin]

Hi @vdudejon

Could you please provide more details. What the problem with mail: [email protected]?

If you have user [email protected] / jdoe and you trying create [email protected] / jdoe you will get an error. Because login and email both must be unique keys. If you have issue with this, I think you can do following:

"mail": "mail",
"uid": "mail"

why not?

Or we can implement more flexible mapping (if it important feature) to allow following scenario:

"mail": "{{userPrincipalName}}@company.com",
"uid": "userPrincipalName"

[vdudejon]

Thanks for your feedback, yes this solution will work as long as I set the ldap_searchfilter to use mail instead of uid.

"mail": "mail",
"uid": "mail"

It's a little odd for us, just because of how our domains are set up. Most technical things we log in as jdoe, so basically in this case it will come down to whether we need our emails at all