Unable to successfully config LDAP

[bgpugh]

As per email, created admin account and first page, then configured LDAP as the following:

Strategy Configuration
LDAP_URL: ldap://localhost:389
Admin Bind DN: uid=svc_wikijs_ldap,ou=users,dc=yunohost,dc=org
Admin Bind Credential: [redacted]
Search Base: ou=users,dc=yunohost,dc=org
Search Filter: (uid={{username}})

Registration
Allow self-registration: Yes
Assign to group: Guest

Whenever I try to log in, I get "Invalid email / username or password" and can't progress. I've tried turning on LDAP debug logging as per https://github.com/Requarks/wiki/issues/1239, but nothing is logged in the yunohost nginx logs.

I suspect this isn't enough to go on, but I'd be happy to try to gather any helpful logging if I can

[yalh76]

Have you tried to login with the username instead of the full email address ?

[bgpugh]

Yup. That fails with “Missing or invalid email address from profile”

[bgpugh]

Interestingly, it looks like I can successfully log in to wiki.js with just the username & pass from another account in yunohost. The issue may be that having multiple email addresses (the default root@…, admin@…, etc) breaks the LDAP search?

[yalh76]

Exactly, it's why the search filter is (uid={{username}}).

I will add that information in the mail

[bgpugh]

The issue reproduces with that search filter (see screenshot in first comment)

[bgpugh]

That is to say, logging in as my yunohost admin user fails when logging in via username (“Missing or invalid email address from profile”)

[yalh76]

Yes, it's normal. If you logged first in wikijs with your yunohost admin user, wikijs created a local account for him. And I think you can't have the same username for a local account and an ldap account

[bgpugh]

I have two users in Yunohost/LDAP:

• Alice (admin user) - email alice@example.com, but with aliases for admin@example.com, root@example.com, etc
• Bob - email bob@example.com

In Wiki.js, if I go to Administration → Users, I have three:

• Administrator - Local user that was created during setup. email does not match any address of any LDAP user, password does not match any LDAP user, name does not match any LDAP user
• Guest - auto-created
• Bob - this is the account I tested in https://github.com/YunoHost-Apps/wikijs_ynh/issues/83#issuecomment-573927494

The "Bob" account shows as "ldap" in the provider column. The other two are both "local"

The root issue for this bug is "I can't log in to wiki.js with Alice"

I'm totally guessing, but I'm it seems from the error message that when I get "Missing or invalid email address from profile" it might be due to having the email aliases set up?

[yalh76]

Yes I also think that your issue comes from that Alice has several email addresses

[bgpugh]

So should I re-file the bug stating all of that in case we can create a better LDAP config to handle that case, or should I file a bug upstream to have wiki.js support LDAP accounts with multiple email addresses?

[yalh76]

Well, If you can create two additional ldap users.

1. first one with one email address
2. second one withe two or more email addresses

And test if you can or not login with both accounts