osTicket 1.17 and LDAP UPN logins

geseronta

Good day, we just upgraded to 1.17 to utilize oauth2 for IMAP and MS 365 (thank you!). One thing that has changed, is we used to be able to login as agents etc. via our active directory UPN - ie username@parentdomain.com. Now, we can only login via username ie username. We have a two domain setup, with the parent being parentdomain.com, and sub domain sub.parentdomain.com. User accounts exist in sub.parent.domain.com, which is what we have in osTicket settings, but UPN are set to username@parentdomain.com. This worked on 1.15.4

geseronta

Getting this in our logs when trying to sign in via a new username (not full UPN even).. and then the page throws error 500. Can anyone help us?

[06-Oct-2022 13:16:21 UTC] PHP Fatal error: Uncaught Error: Call to a member function dn() on bool in phar://C:/inetpub/wwwroot/include/plugins/auth-ldap.phar/authentication.php:390
Stack trace:
#0 phar://C:/inetpub/wwwroot/include/plugins/auth-ldap.phar/authentication.php(225): LDAPAuthentication->lookupAndSync()
#1 phar://C:/inetpub/wwwroot/include/plugins/auth-ldap.phar/authentication.php(479): LDAPAuthentication->authenticate()
#2 C:\inetpub\wwwroot\include\class.auth.php(341): ClientLDAPAuthentication->authenticate()
#3 C:\inetpub\wwwroot\login.php(51): AuthenticationBackend::process()
#4 {main}
thrown in phar://C:/inetpub/wwwroot/include/plugins/auth-ldap.phar/authentication.php on line 390
[06-Oct-2022 13:17:44 UTC] PHP Fatal error: Uncaught Error: Call to a member function dn() on bool in phar://C:/inetpub/wwwroot/include/plugins/auth-ldap.phar/authentication.php:390
Stack trace:
#0 phar://C:/inetpub/wwwroot/include/plugins/auth-ldap.phar/authentication.php(225): LDAPAuthentication->lookupAndSync()
#1 phar://C:/inetpub/wwwroot/include/plugins/auth-ldap.phar/authentication.php(479): LDAPAuthentication->authenticate()
#2 C:\inetpub\wwwroot\include\class.auth.php(341): ClientLDAPAuthentication->authenticate()
#3 C:\inetpub\wwwroot\login.php(51): AuthenticationBackend::process()
#4 {main}
thrown in phar://C:/inetpub/wwwroot/include/plugins/auth-ldap.phar/authentication.php on line 390

geseronta

I rolled back to PHP 8.0.24 after reading another comment. Partially fixed, now users can login with username but NOT email. Both agents and users still must use username instead of email address or UPN of username@domain.com. Sigh. This is quite an ordeal!

ntozier

Did you also upgrade the ldap auth plugin?

geseronta

ntozier

Yes we did, we overwrote the plugin during the upgrade process with the one that was downloaded with osTicket 1.17. Another person is reporting the same problem in thread https://forum.osticket.com/d/101553-ldap-not-enter-whit-user

"
abeermuh33 minutes ago
I rolled back to PHP 8.0.24 after reading the above. Partially fixed, now users can login with their username (but NOT email address). Both agents and users still must use username instead of email address or UPN of username@domain.com. With email it throws access denied. Sigh. This is quite an ordeal!

Yes!!! Same issue for me. Do we have any solution on that?"

KevinTheJedi

geseronta

It's on our list to look into eventually. The code is open source so you have the possibility of debugging this and providing a pull request. Otherwise, you can wait for us to look into it.

Cheers.

geseronta

KevinTheJedi

Thanks for the update, so it's not something wrong with our setup or plugin config (which I did not have to re-do with the upgrade as the config must live in the DB), but something with 1.17 and the new plugin?

KevinTheJedi

geseronta

I am unsure as I'm unable to replicate the issue so I'm not sure if it's a bug or setup issue. You can continue to debug on your setup/config/settings/etc. As I mentioned above it's on our todo list to look into eventually.

Cheers.

tek1979

We've just upgraded from 1.15.6 (also for OAuth support for O365 emails) to 1.17 and run into the same issue; UPN logins for users are no longer working, only sAMAccountName works now.

UPDATE: Additionally, it appears that if a user used their email address at the first login, that is what got recorded for 'username' in the 'ost_user_account' table of the database. I have had to change these to their sAMAccountName to allow login.

tlamoureux

I can confirm same bug, osticket 1.17 php 8.0.24 ldap plugin 0.6.2
Can login with samaccountname but not with email address