LDAP Group Synchronization

[ivory-mischke]

### Steps to reproduce Configure Teampass to connect to Windows Active Directory. Click on Roles and then click LDAP synchronization. ### Expected behaviour I thought all groups would show for me to assign to roles in Teampass ### Actual behaviour I was able to successfully connect to AD for user authentication but when I try to connect to AD for group to role mapping, I can only see 1 group in the menu. I also notice that it only takes the last group I created in AD. If I create a new group, that would be the one in the menu.  ### Server configuration **Operating system**: Rocky Linux 9.3 (Blue Onyx) **Web server:** **Database:** 10.5.22-MariaDB **PHP version:** 8.2.18 **Teampass version:** Current version loaded 3.1.2.29 **Teampass configuration file:** global $SETTINGS; $SETTINGS = array ( 'max_latest_items' => '10', 'enable_favourites' => '1', 'show_last_items' => '1', 'enable_pf_feature' => '1', 'log_connections' => '1', 'log_accessed' => '1', 'time_format' => 'H:i:s', 'date_format' => 'd/m/Y', 'duplicate_folder' => '0', 'item_duplicate_in_same_folder' => '0', 'duplicate_item' => '0', 'number_of_used_pw' => '3', 'manager_edit' => '1', 'cpassman_dir' => '/var/www/html/teampass', 'cpassman_url' => '**OMITTED**', 'favicon' => '**OMITTED**', 'path_to_upload_folder' => '/var/www/html/teampass/upload', 'path_to_files_folder' => '/var/www/html/teampass/files', 'url_to_files_folder' => '**OMITTED**', 'activate_expiration' => '0', 'pw_life_duration' => '0', 'maintenance_mode' => '0', 'enable_sts' => '0', 'encryptClientServer' => '1', 'teampass_version' => '3.1.2', 'ldap_mode' => '1', 'ldap_type' => 'ActiveDirectory', 'ldap_suffix' => '0', 'ldap_domain_dn' => '0', 'ldap_domain_controler' => '0', 'ldap_user_attribute' => 'samaccountname', 'ldap_ssl' => '0', 'ldap_tls' => '0', 'ldap_search_base' => '0', 'ldap_port' => '389', 'richtext' => '0', 'allow_print' => '0', 'roles_allowed_to_print' => '0', 'show_description' => '1', 'anyone_can_modify' => '0', 'anyone_can_modify_bydefault' => '0', 'nb_bad_authentication' => '0', 'utf8_enabled' => '1', 'restricted_to' => '0', 'restricted_to_roles' => '0', 'enable_send_email_on_user_login' => '1', 'enable_user_can_create_folders' => '0', 'insert_manual_entry_item_history' => '0', 'enable_kb' => '0', 'enable_email_notification_on_item_shown' => '1', 'enable_email_notification_on_user_pw_change' => '1', 'custom_logo' => '', 'custom_login_text' => '', 'default_language' => 'english', 'send_stats' => '0', 'send_statistics_items' => 'stat_country;stat_users;stat_items;stat_items_shared;stat_folders;stat_folders_shared;stat_admins;stat_managers;stat_ro;stat_mysqlversion;stat_phpversion;stat_teampassversion;stat_languages;stat_kb;stat_suggestion;stat_customfields;stat_api;stat_2fa;stat_agses;stat_duo;stat_ldap;stat_syslog;stat_stricthttps;stat_fav;stat_pf;', 'send_stats_time' => '1710698418', 'get_tp_info' => '1', 'send_mail_on_user_login' => '0', 'sending_emails' => '0', 'nb_items_by_query' => 'auto', 'enable_delete_after_consultation' => '0', 'enable_personal_saltkey_cookie' => '0', 'personal_saltkey_cookie_duration' => '31', 'email_smtp_server' => '**OMITTED**', 'email_smtp_auth' => '', 'email_auth_username' => '', 'email_auth_pwd' => '', 'email_port' => '25', 'email_security' => '', 'email_server_url' => '', 'email_from' => '**OMITTED**', 'email_from_name' => '**OMITTED**', 'pwd_maximum_length' => '40', 'google_authentication' => '0', 'delay_item_edition' => '0', 'allow_import' => '0', 'proxy_ip' => '', 'proxy_port' => '', 'upload_maxfilesize' => '10mb', 'upload_docext' => 'doc,docx,dotx,xls,xlsx,xltx,rtf,csv,txt,pdf,ppt,pptx,pot,dotx,xltx', 'upload_imagesext' => 'jpg,jpeg,gif,png', 'upload_pkgext' => '7z,rar,tar,zip', 'upload_otherext' => 'sql,xml', 'upload_imageresize_options' => '1', 'upload_imageresize_width' => '800', 'upload_imageresize_height' => '600', 'upload_imageresize_quality' => '90', 'use_md5_password_as_salt' => '0', 'ga_website_name' => '**OMITTED**', 'api' => '0', 'subfolder_rights_as_parent' => '0', 'show_only_accessible_folders' => '0', 'enable_suggestion' => '0', 'otv_expiration_period' => '7', 'default_session_expiration_time' => '20', 'duo' => '0', 'enable_server_password_change' => '0', 'ldap_object_class' => '0', 'bck_script_path' => '/var/www/html/teampass/backups', 'bck_script_filename' => 'bck_teampass', 'syslog_enable' => '0', 'syslog_host' => 'localhost', 'syslog_port' => '514', 'manager_move_item' => '0', 'create_item_without_password' => '0', 'otv_is_enabled' => '0', 'agses_authentication_enabled' => '0', 'item_extra_fields' => '0', 'saltkey_ante_2127' => 'none', 'migration_to_2127' => 'done', 'files_with_defuse' => 'done', 'timezone' => 'America/New_York', 'enable_attachment_encryption' => '1', 'personal_saltkey_security_level' => '50', 'ldap_new_user_is_administrated_by' => '0', 'disable_show_forgot_pwd_link' => '1', 'offline_key_level' => '0', 'enable_http_request_login' => '0', 'ldap_and_local_authentication' => '1', 'secure_display_image' => '1', 'upload_zero_byte_file' => '0', 'upload_all_extensions_file' => '0', 'bck_script_passkey' => '**OMITTED**', 'admin_2fa_required' => '1', 'password_overview_delay' => '4', 'copy_to_clipboard_small_icons' => '1', 'duo_ikey' => '', 'duo_skey' => '', 'duo_host' => '', 'duo_failmode' => 'secure', 'roles_allowed_to_print_select' => '', 'clipboard_life_duration' => '30', 'mfa_for_roles' => '', 'tree_counters' => '0', 'settings_offline_mode' => '0', 'settings_tree_counters' => '0', 'enable_massive_move_delete' => '0', 'email_debug_level' => '0', 'ga_reset_by_user' => '', 'onthefly-backup-key' => '', 'onthefly-restore-key' => '', 'ldap_user_dn_attribute' => 'distinguishedname', 'ldap_dn_additional_user_dn' => '', 'ldap_user_object_filter' => '', 'ldap_bdn' => '**OMITTED**', 'ldap_hosts' => '**OMITTED**', 'ldap_password' => '**OMITTED**', 'ldap_username' => '**OMITTED**', 'api_token_duration' => '60', 'last_folder_change' => '', 'enable_tasks_manager' => '1', 'task_maximum_run_time' => '300', 'tasks_manager_refreshing_period' => '20', 'maximum_number_of_items_to_treat' => '100', 'ldap_tls_certifacte_check' => 'LDAP_OPT_X_TLS_NEVER', 'enable_tasks_log' => '1', 'upgrade_timestamp' => '1713290418', 'enable_ad_users_with_ad_groups' => '1', 'enable_ad_user_auto_creation' => '0', 'ldap_group_object_filter' => '(objectClass=group)', 'ldap_guid_attibute' => 'objectGUID', 'sending_emails_job_frequency' => '1', 'user_keys_job_frequency' => '1', 'items_statistics_job_frequency' => '5', 'users_personal_folder_task' => 'hourly;00:00', 'clean_orphan_objects_task' => '', 'purge_temporary_files_task' => '', 'rebuild_config_file' => '', 'reload_cache_table_task' => '', 'maximum_session_expiration_time' => '40', 'items_ops_job_frequency' => '1', 'enable_refresh_task_last_execution' => '1', 'ldap_group_objectclasses_attibute' => 'group', 'pwd_default_length' => '14', 'tasks_log_retention_delay' => '30', 'oauth2_azure' => '0', 'oauth2_azure_clientId' => '', 'oauth2_azure_clientSecret' => '', 'oauth2_azure_urlAuthorize' => '', 'oauth2_azure_urlAccessToken' => '', 'oauth2_azure_urlResourceOwnerDetails' => '', 'oauth2_azure_scopes' => 'openid,profile,email', ); ### Client configuration **Browser:** Chrome **Operating system:** Windows 11 ### Logs #### Web server error log Doesn't show any errors #### Log from the web-browser developer console (CTRL + SHIFT + i) No errors

[nilsteampassnet]

@ivory-mischke Unfortunately I cannot test on ActiveDirectory. As it seems that you always get at least one AD group when running the synchronization, I believe the issue comes from a condition in the query. The code managing the AD groups listing is the next one :

        // prepare query
        $query = $connection->query();

        // get all parameters to search
        foreach (static::$objectClasses as $objectClass) {
            $query->where('objectclass', '=', $objectClass);
        }
        try {
            // perform query and get data
            $groups = $query->get();

            $groupsArr = [];
            foreach($groups as $key => $group) {
                $adGroupId = (int) $group[(isset($settings['ldap_guid_attibute']) === true && empty($settings['ldap_guid_attibute']) === false ? $settings['ldap_guid_attibute'] : 'gidnumber')][0];
                $groupsArr[$adGroupId] = [
                    'ad_group_id' => $adGroupId,
                    'ad_group_title' => $group['cn'][0],
                    'role_id' => -1,
                    'id' => -1,
                    'role_title' => '',
                ];
            }            

            return [
                'error' => false,
                'message' => 'Groups fetched successfully.',
                'userGroups' => $groupsArr,
            ];
        } catch (\Throwable $e) {
            return [
                'error' => true,
                'message' => 'LDAP Error: ' . $e->getMessage(),
                'userGroups' => [],
            ];
        }

Can you please

• open file ./vendor/teampassclasses/ldapextra/src/ActiveDirectoryExtra.php
• search for

      foreach (static::$objectClasses as $objectClass) {
          $query->where('objectclass', '=', $objectClass);
      }

• replace by

  /*
      foreach (static::$objectClasses as $objectClass) {
          $query->where('objectclass', '=', $objectClass);
      }
  */

• save the file and try again

THis will remove the conditions added to the query. Please share the feedback

[ivory-mischke]

Thanks for the reply! This is what my file looks like:

I'm still seeing only 1 group show up:

These are the groups in AD for the base DN LDAP config setting that I'm expecting to see.

[nilsteampassnet]

@ivory-mischke Have you tried to check if your attributes are the correct ones Perhaps the attribute groupOfNames could be added to current group