whowe-ppd

Okay, that all seems fine. At this point the next step involves very extensive debugging which I currently don't have the time for as I'm focusing on other issues. I also currently don't have time to setup a full AD server at the moment.

If you want to unpack your plugin and debug to speed up this process I can provide some debug statements. This will however break user authentication with ldap completely and output debug statements to the browser so you may want to setup a separate test environment if you choose to debug.

Cheers.

    whowe-ppd

    Also, have you tried applying the patch I referenced above to see if that addresses the issue?

    Cheers.

      For Search User, set it to a username.

      i.e. instead of cn=helpdesk,ou=IT,ou=Users,dc=ourdomain,dc=dom
      set it to helpdesk or OURDOMAIN\helpdesk

      We're in production so I downgraded to PHP8.0 and all works. If I get some time I'll spin up another instance where we can debug.

        2 months later

        whowe-ppd

        I was finally able to revisit this with a legitimate MSAD server setup on Windows Server 2019. After extensive testing I can finally say without a doubt there should be no issues with User/Agent logins with PHP 8.1, v1.17.3, and latest build of LDAP plugin with correct LDAP settings configured.

        If you still have issues check to see if you have more than one instance of the LDAP plugin enabled. If so, disable one of the instances and retest. Also, check to make sure your Search User and Search Base is correct. These two settings are very important. You can find the appropriate Search User string by running the following in a command prompt on the domain controller (this is assuming the administrator's username is Administrator):

        dsquery user -name "Administrator"

        This should give you something like:

        "CN=Administrator,CN=Users,DC=domain,DC=com"

        Cheers.

          10 days later

          We are having the same issue. I've diligently read through all options in this thread. We are running IIS on Server 2019, PHP 8.1.17, and OSticket v1,17,3. Agents can login fine using LDAP authentication. I can even create brand new agents and they can authenticate via LDAP exclusively. Users are not able to at all. I just get Access Denied. I even tried manually creating and registering a user with a password. Access Denied. Really frustrated. Dept of Homeland Security is demanding that we move to PHP 8.1.16 or greater so we don't have a choice on PHP version. Incidentally, I get the same results with 8.1.16 and 8.1.17. Any help appreciated!

            eagletech

            What is the format of your Search User and Search Base strings? What is the ost_user_account.backend value of the Users unable to login?

            Cheers.

              Search User and Search Base fields are empty as they have been for years.

              ost_user_account.backend is ldap.client.

              *I guess I should add that I HAVE tried adding a search and bind user just to troubleshoot, but it has yielded no difference.

                eagletech

                That's one problem. You didn't update your plugin before upgrading osTicket. You will need to first update your plugin with the latest build from the website. Next, set the backend for every affected user to ldap.client.p123i123. Replace 123 in each part with the plugin ID and instance ID respectively. You can look at this thread for more info:

                This would've happened automatically on upgrade if you updated your plugin first.

                Cheers.

                  I just want to clarify. I have good backups and have had to spin them up several times already. You are telling me that if I go BACK to OSticket\PHP version that is working and update my LDAP plugin first, THEN do the PHP and Osticket updates that I should be able to get this to work? I only asked because I have multiple sites to update. I appreciate the help.

                    eagletech

                    That will correct the Users' and Agents' backend but not sure if that will address your issue. For clarity I am using PHP 8.1, v1.17.3, and latest LDAP plugin with a real MSAD server with no issues.

                    Cheers.

                      It appears I am already using LDAP Plugin 0.6.2 on my non-updated server (v1.16.5). Is there a newer version? The version listed in OSticket v1.17.3 is also 0.6.2.

                        Taking this in steps - for me and maybe others.

                        1. I recovered to Osticket v1.16.3 and PHP 8.0.20. LDAP works splendidly.
                        2. I updated the LDAP plugin by downloading the phar file from the website and copying into the plugin directory. LDAP still works great.
                        3. I update to PHP 8.1.17 and LDAP breaks for users - not agents. I get the Invalid CSRF Token CSRFToken error when I try to login.

                        Is this normal and a motivation to update to OSticket v1.17.3? Or should I stop now and try to diagnose? (Toggling back to PHP 8.0.20 fixes the issue.)

                          eagletech

                          Well v1.16.3 is old, the latest release in that series is v1.16.6. v1.16.3 is also not compatible with the LDAP plugin build for 1.17.x. So it'd be advisable to upgrade to v1.17.3 (latest stable release) or v1.16.6 (latest maintenance release for 1.16.x series). If you do v1.16.6 then you need to download the latest plugin build from our website specifically for 1.16.x series (there is a dropdown to choose your version when downloading plugins). The same goes for v1.17.3 except you'd need the plugin build for 1.17.x.

                          Cheers.

                            Kevin, that is the goal here buddy. I want to get upgraded. I am trying desperately. I have tried several times, but it breaks the LDAP functionality each time.

                            So, going back to your comment yesterday regarding updating the plugin first.... if I have a working copy at v1.16.3 and I updated that plugin as instructed, it should stand to reason that if I now update OSTicket to V1.17.3 at this point it should solve my LDAP issue? Is my logic sound?

                              eagletech

                              That should be the process but like I said before not sure if that will address you particular issue.

                              Cheers.

                                The upgrade appears to go smoothly - but I am right back to Access Denied on the client side. Agent side is fine.

                                  eagletech

                                  Any errors in any of your logs (general server logs, webserver error logs, PHP error logs, MySQL/MariaDB error logs, osTicket System Logs, Browser Console logs, etc.)?

                                  Cheers.