paulcalabro
commented
7 years ago In https://github.com/Cacti/cacti/blob/480fbaac2cd701a173fd4d0e8e2e04a3ef9969c5/lib/ldap.php, you can find that particular error message (note the number 8 that's assigned to it):
Error codes:
# Text
==============================================================
0 User found
1 No username defined
2 Unable to create LDAP connection object
3 Unable to find users DN
4 Protocol error, unable to set version
5 Protocol error, unable to start TLS communications
6 Protocol error
7 Invalid credential
8 Insufficient access
9 Unable to connect to server
10 Timeout
11 General bind error
12 Unable to set referrals option
13 More than one matching user found
14 Specific DN and Password required
99 PHP LDAP not enabled
*/If you look a little bit further in the code, you can find this code which sets $ldap_group_response:
/* Process group membership if required */
if ($this->group_member_type == 1) {
$ldap_group_response = ldap_compare($ldap_conn, $this->group_dn, $this->group_attrib, $this->dn);
} else if ($this->group_member_type == 2) {
/* Do a lookup to find this user's true DN. */
/* ldap_exop_whoami is not yet included in PHP. For reference, the
* feature request: http://bugs.php.net/bug.php?id=42060
* And the patch against lastest PHP release:
* http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/databases/php-ldap/files/ldap-ctrl-exop.patch
*/
$true_dn_result = ldap_search($ldap_conn, $this->search_base, 'userPrincipalName=' . $this->dn, array('dn'));
$first_entry = ldap_first_entry($ldap_conn, $true_dn_result);
/* we will test in two ways */
if ($first_entry !== false) {
$true_dn = ldap_get_dn($ldap_conn, $first_entry);
$ldap_group_response = ldap_compare($ldap_conn, $this->group_dn, $this->group_attrib, $true_dn);
} else {
$ldap_group_response = ldap_compare($ldap_conn, $this->group_dn, $this->group_attrib, $this->username);
}
}...this code tries to do an ldap_compare using the provided DN OR resolves the DN using the given UID and THEN does the ldap_compare.
After that code, you finally arrive at your error message (note the error number - 8 - from above):
if ($ldap_group_response === true) {
/* Auth ok */
$output['error_num'] = '0';
$output['error_text'] = __('Authentication Success');
} else if ($ldap_group_response === false) {
$output['error_num'] = '8';
$output['error_text'] = __('Insufficient access');
cacti_log('LDAP: ' . $output['error_text'], false, 'AUTH');
ldap_close($ldap_conn);
$this->RestoreCactiHandler();
return $output;
}...so that fact that you arrived at this point indicates that $ldap_group_response is falsy from the previous section.
What do you see see if you run:
SELECT group_member_type
FROM user_domains_ldapagainst the MySQL database?
Do you see usernames or DNs when you perform the following query:
ldapsearch -v -x -h your_ldap_server.example.com -b 'OU=theGroup,OU=2ndLevelUnit,OU=1stLevelUnit,DC=domain,DC=local' memberUid Does the setting in the database match how the group members are represented in LDAP?
choefing
cigamit
netniV
Hi,
when upgrading from 1.1.7 to 1.1.22 (I know its quite a big jump) LDAP auth with multiple AD stopped working. I'm sorry that I can't specify the point better when this happened.
No changes in Cacti ldap config, no changes in AD. When trying to login I get the error message: Insufficient access
We have to use "specific search" with a dedicated search user, group membership is required.
As per log the search user finds the login user and afterwards throw the above error.
Not quite sure what exactly that means and what happens after the user is found, even not quite sure if its a AD related issue or a bug, but when reverting to backup using 1.1.7 LDAP auth works immediately again.
In case LDAP handling changed and it's a feature, I'd be glad to see a workaround and have this one closed :) Thanks so far for all your hard work.
Rgds Chris