search

matomo-org / plugin-LoginLdap

LDAP authentication and synchronization for Matomo.
https://plugins.matomo.org/LoginLdap
GNU General Public License v3.0
39 stars 30 forks source link

Having issue connecting to LDAPS (port 636) #94

Closed larrys closed 9 years ago

larrys commented 9 years ago

I click on the test for LDAP search filter, and it sits there with the icon. Once I change the port to the default (so it is not going over SSL), it will give me the number of users that matched the filter.

I need to be able to talk to LDAP over SSL.

diosmosis commented 9 years ago

From the PHP docs, as long as your PHP and LDAP are configured correctly, it should work (though there could be a bug in the plugin). Can you ensure a generic LDAP query works when you run it through an LDAP client, ie (objectClass=person)?

Also, if you're using the raw hostname (ie, myldaphost.com) instead of a ldaps:// URL, can you use ldaps://myldaphost.com/ instead and see if it works?

larrys commented 9 years ago

When I use ldaps://host.domain.com I got some other error, and now when I go to reproduce it, it says how many users match the filter. I blame gremlins.

larrys commented 9 years ago

The error was "Could not bind as LDAP admin", which I get now when I try to load a user from LDAP. I bind anonymously to LDAP. Is that an issue? Plus, if I were to bind, our admins would not let me bind as an admin.

diosmosis commented 9 years ago

It could be an issue, but a lot of this depends on your LDAP server config. The requirement is that whatever user is used (or if anonymous bind is used), the account must have read access to the users in LDAP.

You can get more information from the plugin by running the following command:

php /path/to/piwik/console loginldap:synchronise-users --login=someuserslogin -vvv

Also, it's probably a good idea to make sure you can bind & query LDAP from the machine Piwik is on from a different LDAP client (eg, ldapsearch). If you can verify it works, then we can be sure the plugin is doing something wrong, or a plugin setting is incorrect, rather than an error in the LDAP server.

larrys commented 9 years ago

"Generate Random token_auth For New Users" needs to be set when you bind anonymously. But I added it. I got my username synched over in the test. but now I can't log in.

I see the LdapFunctionsMissing message at the top, but they have been installed, and apache restarted. Is there something else amiss?

larrys commented 9 years ago

Is there a way to run this not as root, or the apache user?

[InvalidArgumentException]
The directory "/var/www/html/piwik/tmp/cache/tracker/" does not exist and could not be created.

diosmosis commented 9 years ago

I see the LdapFunctionsMissing message at the top, but they have been installed, and apache restarted. Is there something else amiss?

Looks like there are two issues, PHP can't find the ldap_connect method, and for some reason text isn't being translated (LdapFunctionsMissing should have been replaced w/ "The PHP LDAP extension does not appear to be enabled. It is required for this plugin, please install it."). The first problem might just be the old error you've received not being cleared as a notification. For now, I'd ignore it unless it becomes persistent and nothing else works. The second problem is an issue w/ your Piwik install. It's not serious, but you may want to look into it later.

Is there a way to run this not as root, or the apache user?

The tmp/cache/tracker issue is a known issue w/ Piwik. I think at the moment you have to run it as the web user at least once to create the folder (note: you can do this w/ su). I wouldn't recommend running it as root.

larrys commented 9 years ago

I put LdapFunctionsMissing so it was shorter, and that is what I found in code, sorry for the confusion.

Here's an oddity, I click on the test on the LDAP search filter, and sometimes it will list the users matched by the filter, and sometimes it puts "Could not bind as LDAP admin."

I can click it over and over, and it will randomly switch between the two.

diosmosis commented 9 years ago

W/o debug information and w/o your attempting to connect & query LDAP it will be impossible to diagnose this error. If you can't run the command, you can try enabling debug logging (see here: http://piwik.org/faq/troubleshooting/faq_115/) and trying to use LDAP functionality. If you'd like to share the logs, email them to hello@piwik.org (in case there is sensitive information in them).

larrys commented 9 years ago

I figured since sometimes testing the filter showed the number of users, it shows that it sometimes works. I also was able through the UI synch my username over.

Now every time I click on the test button for the filter, I get the error... here is the debug log content

DEBUG Piwik\Db[2015-04-15 17:01:12] [0bb9e] Db::fetchAll() executing SQL: SELECT DATABASE() DEBUG Piwik\Db[2015-04-15 17:01:12] [0bb9e] Db::fetchAll() executing SQL: SELECT option_value, option_name FROM piwik_option WHERE autoload = 1 DEBUG Piwik\Db[2015-04-15 17:01:12] [0bb9e] Db::fetchOne() executing SQL: SELECT option_value FROM piwik_option WHERE option_name = ? DEBUG Piwik\Plugin\Manager[2015-04-15 17:01:12] [0bb9e] Loaded plugins: CorePluginsAdmin, CoreAdminHome, CoreHome, CoreVisualizations, Proxy, API, ExamplePlugin, Widgetize, Transitions, LanguagesManager, Actions, Dashboard, MultiSites, Referrers, UserSettings, UserLanguage, DevicesDetection, Ecommerce, SEO, Events, UserCountry, VisitsSummary, VisitFrequency, VisitTime, VisitorInterest, ExampleAPI, ExampleRssWidget, Provider, Feedback, Monolog, UsersManager, SitesManager, Installation, CoreUpdater, CoreConsole, ScheduledReports, UserCountryMap, Live, CustomVariables, PrivacyManager, ImageGraph, Annotations, MobileMessaging, Overlay, SegmentEditor, Insights, ZenMode, LeftMenu, Morpheus, Contents, BulkTracking, Resolution, DevicePlugins, InterSites, LoginLdap DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] ServerInfo::makeConfigured: configuring with hostname = ldaps://ldap.company.com, baseDn = ou=People,o=company.com,o=company,c=us, port = 636, adminUser = ..., adminPass = DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] UserMapper::makeConfigured: configuring with uidField = uid, aliasField = cn firstNameField = givenName, lastNameField = sn mailField = mail, ldapUserPasswordField = userPassword, userEmailSuffix = , isRandomTokenAuthGenerationEnabled = 0 DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] LdapUsers::makeConfigured: configuring with userEmailSuffix = , requiredMemberOf = , filter = (&(objectClass=person)(objectClass=inetOrgPerson)), timeoutSecs = 15 DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] UserMapper::makeConfigured: configuring with uidField = uid, aliasField = cn firstNameField = givenName, lastNameField = sn mailField = mail, ldapUserPasswordField = userPassword, userEmailSuffix = , isRandomTokenAuthGenerationEnabled = 0 DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] UserSynchronizer::makeConfigured(): LDAP access synchronization not enabled. DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] UserSynchronizer::makeConfigured: configuring with defaultSitesWithViewAccess = DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] LdapAuth::makeConfigured: creating with configured components DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] Auth\Base::tryFallbackAuth: trying normal auth with token auth DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] Auth\Base::tryFallbackAuth: normal auth returned result code 0 for user '' DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] authenticateByPassword: empty login encountered DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] Auth\Base::tryFallbackAuth: trying normal auth with token auth DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] Auth\Base::tryFallbackAuth: normal auth returned result code 42 for user '' DEBUG SitesManager[2015-04-15 17:01:12] [0bb9e] Db::fetchAll() executing SQL: SELECT idsite FROM piwik_site DEBUG LanguagesManager[2015-04-15 17:01:12] [0bb9e] Db::fetchOne() executing SQL: SELECT language FROM piwik_user_language WHERE login = ? DEBUG SitesManager[2015-04-15 17:01:12] [0bb9e] Db::fetchAll() executing SQL: SELECT idsite FROM piwik_site DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] ServerInfo::makeConfigured: configuring with hostname = ldaps://ldap.company.com, baseDn = ou=People,o=company.com,o=company,c=us, port = 636, adminUser = ..., adminPass = DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] UserMapper::makeConfigured: configuring with uidField = uid, aliasField = cn firstNameField = givenName, lastNameField = sn mailField = mail, ldapUserPasswordField = userPassword, userEmailSuffix = , isRandomTokenAuthGenerationEnabled = 0 DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] LdapUsers::makeConfigured: configuring with userEmailSuffix = , requiredMemberOf = , filter = (&(objectClass=person)(objectClass=inetOrgPerson)), timeoutSecs = 15 DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] UserMapper::makeConfigured: configuring with uidField = uid, aliasField = cn firstNameField = givenName, lastNameField = sn mailField = mail, ldapUserPasswordField = userPassword, userEmailSuffix = , isRandomTokenAuthGenerationEnabled = 0 DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] UserSynchronizer::makeConfigured(): LDAP access synchronization not enabled. DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] UserSynchronizer::makeConfigured: configuring with defaultSitesWithViewAccess = DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] Model\LdapUsers: start getCountOfUsersMatchingFilter() with (&(objectClass=person)(objectClass=inetOrgPerson)) DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] Calling ldap_connect('ldaps://ldap.company.com', 636) DEBUG LoginLdap[2015-04-15 17:01:12] [0bb9e] ldap_connect result is Resource id #357 WARNING LoginLdap[2015-04-15 17:01:13] [0bb9e] /var/www/html/piwik/plugins/LoginLdap/Ldap/Client.php(82): Warning - ldap_bind(): Unable to bind to server: Can't contact LDAP server - Piwik 2.12.1 - Please report this message in the Piwik forums: http://forum.piwik.org (please do a search first as it might have been reported already) DEBUG LoginLdap[2015-04-15 17:01:13] [0bb9e] anonymous ldap_bind call finished; connection ok INFO LoginLdap[2015-04-15 17:01:13] [0bb9e] LdapUsers::makeLdapClient: Using LDAP server ldaps://ldap.company.com:636 DEBUG LoginLdap[2015-04-15 17:01:13] [0bb9e] Calling ldap_bind(Resource id #357, '', <password[length=0]>) WARNING LoginLdap[2015-04-15 17:01:13] [0bb9e] /var/www/html/piwik/plugins/LoginLdap/Ldap/Client.php(132): Warning - ldap_bind(): Unable to bind to server: Can't contact LDAP server - Piwik 2.12.1 - Please report this message in the Piwik forums: http://forum.piwik.org (please do a search first as it might have been reported already) DEBUG LoginLdap[2015-04-15 17:01:13] [0bb9e] ldap_bind result is '0' DEBUG LoginLdap[2015-04-15 17:01:13] [0bb9e] Calling ldap_close(Resource id #357) DEBUG LoginLdap[2015-04-15 17:01:13] [0bb9e] ldap_close returned true DEBUG API[2015-04-15 17:01:13] [0bb9e] /var/www/html/piwik/plugins/LoginLdap/Model/LdapUsers.php(538): Could not bind as LDAP admin.

0 /var/www/html/piwik/plugins/LoginLdap/Model/LdapUsers.php(245): Piwik\Plugins\LoginLdap\Model\LdapUsers->bindAsAdmin(Object(Piwik\Plugins\LoginLdap\Ldap\Client), Object(Piwik\Plugins\LoginLdap\Ldap\ServerInfo))

1 /var/www/html/piwik/plugins/LoginLdap/Model/LdapUsers.php(462): Piwik\Plugins\LoginLdap\Model{closure}(Object(Piwik\Plugins\LoginLdap\Model\LdapUsers), Object(Piwik\Plugins\LoginLdap\Ldap\Client), Object(Piwik\Plugins\LoginLdap\Ldap\ServerInfo))

2 /var/www/html/piwik/plugins/LoginLdap/Model/LdapUsers.php(248): Piwik\Plugins\LoginLdap\Model\LdapUsers->doWithClient(Object(Closure))

3 /var/www/html/piwik/plugins/LoginLdap/API.php(116): Piwik\Plugins\LoginLdap\Model\LdapUsers->getCountOfUsersMatchingFilter('(&(objectClass=...')

4 [internal function]: Piwik\Plugins\LoginLdap\API->getCountOfUsersMatchingFilter('(&(objectCl...')

5 /var/www/html/piwik/core/API/Proxy.php(211): call_user_func_array(Array, Array)

6 /var/www/html/piwik/core/API/Request.php(231): Piwik\API\Proxy->call('\Piwik\Plugins...', 'getCountOfUsers...', Array)

7 /var/www/html/piwik/plugins/API/Controller.php(33): Piwik\API\Request->process()

8 [internal function]: Piwik\Plugins\API\Controller->index()

9 /var/www/html/piwik/core/FrontController.php(530): call_user_func_array(Array, Array)

10 /var/www/html/piwik/core/FrontController.php(96): Piwik\FrontController->doDispatch(NULL, NULL, NULL)

11 /var/www/html/piwik/core/dispatch.php(31): Piwik\FrontController->dispatch()

12 /var/www/html/piwik/index.php(27): require_once('/var/www/html/p...')

13 {main}

diosmosis commented 9 years ago

Is ldaps://ldap.company.com an actual server? Can you confirm through another LDAP client you can connect, bind and query this server w/ the credentials supplied in Piwik settings?

larrys commented 9 years ago

I'm starting to suspect SSL cert issues... working with my IT department through possible problems.

Thanks for your help so far. I'll keep you updated.

On Wed, Apr 15, 2015 at 4:46 PM, Benaka notifications@github.com wrote:

Is ldaps://ldap.company.com an actual server? Can you confirm through another LDAP client you can connect, bind and query this server w/ the credentials supplied in Piwik settings?

— Reply to this email directly or view it on GitHub https://github.com/piwik/plugin-LoginLdap/issues/94#issuecomment-93589972 .

larrys commented 9 years ago

Looks like it was an SSL problem, the ldap.conf file has TLS_CACERTDIR /etc/openldap/cacerts

and /etc/openldap/cacerts directory is only readable by root...