Problem: Ubuntu directions has 2.8.0 tarball, which doesn't have start tls, but User Authentication for LDAP for 2.8 mentions it as default.

[jtgorman]

I'm not sure if this is the right place to put this. We set up a server by followed the steps at....

https://www.accesstomemory.org/en/docs/2.8/admin-manual/installation/ubuntu/#installation-ubuntu

To setup a server, in particular, using the following to get a tarball...

wget https://storage.accesstomemory.org/releases/atom-2.8.0.tar.gz

Then we were setting up LDAP Auth following https://www.accesstomemory.org/en/docs/2.8/admin-manual/customization/authentication/#customization-authentication

It didn't work. In the process of adding some debugging statements to try to figure out what was happening, I found that our AD was refusing the connection based on the encryption level. Looking at the code, I didn't find any ldap_start_tls call like I expect and added it and things were suddenly working...

On the 2.8 docs at https://www.accesstomemory.org/en/docs/2.8/admin-manual/customization/authentication/#customization-authentication, it says...

LDAP authentication in AtoM, by default, uses StartTLS for encryption.

But...I'm guessing this is only true for some more recent version of AtoM than the tarball mentioned in the 2.8 docs? Or there's something else going wrong.

I might try to experiment with a newer version pulled from git, but for now at least I resolved this by

modified line 127 of lib/ldapUser.class.php

$this->ldapBound = @ldap_bind($conn, $dn, $password);

to

 if( ldap_start_tls( $conn ) ) {

             // The @ suppresses a warning if the auth fails
            $bind_result = @ldap_bind($conn, $dn, $password);

            if($bind_result == false ) {
                    $this->logger->debug( ldap_error( $conn ) ) ;
             }
               $this->ldapBound = $bind_result ;
               return $this->ldapBound;
             }
           else {
                   $this->logger->debug( "couldn't start tls for ldap" );
                   $this->logger->debug( ldap_error( $conn ) ) ;
                  return false;
           }