{"action":"created","issue":{"url":"https://api.github.com/repos/firefly-iii/firefly-iii/issues/1933","repository_url":"https://api.github.com/repos/firefly-iii/firefly-iii","labels_url":"https://api.github.com/repos/firefly-iii/firefly-iii/issues/1933/labels{/name}","comments_url":"https://api.github.com/repos/firefly-iii/firefly-iii/issues/1933/comments","events_url":"https://api.github.com/repos/firefly-iii/firefly-iii/issues/1933/events","html_url":"https://github.com/firefly-iii/firefly-iii/issues/1933","id":394723797,"node_id":"MDU6SXNzdWUzOTQ3MjM3OTc=","number":1933,"title":"FreeIPA LDAP integration not working","user":{"login":"MrShibe","id":22443628,"node_id":"MDQ6VXNlcjIyNDQzNjI4","avatar_url":"https://avatars3.githubusercontent.com/u/22443628?v=4","gravatar_id":"","url":"https://api.github.com/users/MrShibe","html_url":"https://github.com/MrShibe","followers_url":"https://api.github.com/users/MrShibe/followers","following_url":"https://api.github.com/users/MrShibe/following{/other_user}","gists_url":"https://api.github.com/users/MrShibe/gists{/gist_id}","starred_url":"https://api.github.com/users/MrShibe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MrShibe/subscriptions","organizations_url":"https://api.github.com/users/MrShibe/orgs","repos_url":"https://api.github.com/users/MrShibe/repos","events_url":"https://api.github.com/users/MrShibe/events{/privacy}","received_events_url":"https://api.github.com/users/MrShibe/received_events","type":"User","site_admin":false},"labels":[{"id":110192331,"node_id":"MDU6TGFiZWwxMTAxOTIzMzE=","url":"https://api.github.com/repos/firefly-iii/firefly-iii/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-12-28T21:35:57Z","updated_at":"2018-12-30T05:11:25Z","closed_at":null,"author_association":"NONE","body":"I am running Firefly III version 4.7.8\r\n\r\n**Description**\r\nLong time listener, first time caller. Was quite excited to see the new LDAP support, but I've been having a bit of trouble getting it up and running.\r\n\r\nFirstly I appreciate that this may be down to my configuration/LDAP server, so if that's the case let me know, but I've been unable to get this to work so far and my current theory is that it's due to how the LDAP Search query is constructed.\r\n\r\nI have setup a fresh install of Firefly-III and tried to enable authentication using FreeIPA LDAP. The requests are going through to my LDAP server, but no user is able to authenticate. Firefly-III logs are empty, but the LDAP logs reveal:\r\n\r\n```\r\n[28/Dec/2018:19:52:33.445822995 +0000] conn=1540 fd=127 slot=127 connection from [IP address of Firefly-III server] to [IP address of FreeIPA server]\r\n[28/Dec/2018:19:52:33.446216398 +0000] conn=1540 op=0 BIND dn=\"uid=firefly,cn=sysaccounts,cn=etc,dc=example,dc=com\" method=128 version=3\r\n[28/Dec/2018:19:52:33.446582144 +0000] conn=1540 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0000687768 dn=\"uid=firefly,cn=sysaccounts,cn=etc,dc=example,dc=com\"\r\n[28/Dec/2018:19:52:33.451612889 +0000] conn=1540 op=1 SRCH base=\"dc=example,dc=com\" scope=2 filter=\"(&(objectClass=person)(userprincipalname=*)(uid=tshibe))\" attrs=\"* aci\"\r\n[28/Dec/2018:19:52:33.452634743 +0000] conn=1540 op=1 RESULT err=0 tag=101 nentries=0 etime=0.0001125688\r\n[28/Dec/2018:19:52:33.464429168 +0000] conn=1540 op=2 UNBIND\r\n```\r\n\r\n From looking at the 4th line, it appears that the LDAP search is using three criteria:\r\n\r\n- objectClass=person (this is fine)\r\n- userprincipalname=* (this returns 0 results when I try to search it myself, I do not believe FreeIPA has a UPN field)\r\n- uid=tshibe (this is fine)\r\n\r\nIt appears to me that the attempt to find a UPN is causing the search to return 0 results, failing the authentication. Is this due to how Firefly-III is making the request, or is it something I've missed on the FreeIPA side? (Or alternatively is it something else entirely?)\r\n\r\nIn my Firefly-III .env file, I have the following set for my LDAP settings:\r\n\r\n```\r\nADLDAP_CONNECTION_SCHEME=FreeIPA\r\nADLDAP_AUTO_CONNECT=true\r\n\r\n# LDAP connection settings\r\nADLDAP_CONTROLLERS= [IP address of FreeIPA server]\r\nADLDAP_PORT=389\r\nADLDAP_TIMEOUT=5\r\nADLDAP_BASEDN=\"dc=example,dc=com\"\r\nADLDAP_FOLLOW_REFFERALS=false\r\nADLDAP_USE_SSL=false\r\nADLDAP_USE_TLS=false\r\n\r\nADLDAP_ADMIN_USERNAME=firefly\r\nADLDAP_ADMIN_PASSWORD=[Firefly LDAP account password]\r\n\r\nADLDAP_ACCOUNT_PREFIX=\"uid=\"\r\nADLDAP_ACCOUNT_SUFFIX=\",cn=users,cn=accounts,dc=example,dc=com\"\r\nADLDAP_ADMIN_ACCOUNT_PREFIX=\"uid=\"\r\nADLDAP_ADMIN_ACCOUNT_SUFFIX=\",cn=sysaccounts,cn=etc,dc=example,dc=com\"\r\n\r\n# LDAP authentication settings.\r\nADLDAP_PASSWORD_SYNC=false\r\nADLDAP_LOGIN_FALLBACK=false\r\n\r\nADLDAP_DISCOVER_FIELD=uid\r\nADLDAP_AUTH_FIELD=uid\r\n\r\n# Will allow SSO if your server provides an AUTH_USER field.\r\nWINDOWS_SSO_DISCOVER=samaccountname\r\nWINDOWS_SSO_KEY=AUTH_USER\r\n\r\n# field to sync as local username.\r\nADLDAP_SYNC_FIELD=uid\r\n```\r\n\r\n**Extra info**\r\nFirefly-III running on Ubuntu 18.04, FreeIPA running on CentOS 7"},"comment":{"url":"https://api.github.com/repos/firefly-iii/firefly-iii/issues/comments/450539697","html_url":"https://github.com/firefly-iii/firefly-iii/issues/1933#issuecomment-450539697","issue_url":"https://api.github.com/repos/firefly-iii/firefly-iii/issues/1933","id":450539697,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MDUzOTY5Nw==","user":{"login":"JC5","id":5889984,"node_id":"MDQ6VXNlcjU4ODk5ODQ=","avatar_url":"https://avatars0.githubusercontent.com/u/5889984?v=4","gravatar_id":"","url":"https://api.github.com/users/JC5","html_url":"https://github.com/JC5","followers_url":"https://api.github.com/users/JC5/followers","following_url":"https://api.github.com/users/JC5/following{/other_user}","gists_url":"https://api.github.com/users/JC5/gists{/gist_id}","starred_url":"https://api.github.com/users/JC5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JC5/subscriptions","organizations_url":"https://api.github.com/users/JC5/orgs","repos_url":"https://api.github.com/users/JC5/repos","events_url":"https://api.github.com/users/JC5/events{/privacy}","received_events_url":"https://api.github.com/users/JC5/received_events","type":"User","site_admin":false},"created_at":"2018-12-30T05:11:25Z","updated_at":"2018-12-30T05:11:25Z","author_association":"MEMBER","body":"I've pushed a change to Firefly III that will do this in the next release. @MrShibe, you'll have to do it manually until the next release comes out."}}
{"actor":{"display_login":"JC5"}}