APP_DEBUG=true Ignored in latest Turnkey Linux Image

[JacoRimere]

Attempted Debugging

• I have read the debugging page

Searched GitHub Issues

• I have searched GitHub for the issue.

Describe the Scenario

New install using the Turnkey Linux image.

I am trying to get LDAP working, by following https://www.bookstackapp.com/docs/admin/ldap-auth/ but I just get the following error:
"These credentials do not match our records."

I see no LDAP/auth errors in either the laravel.log nor the apache2/error.log, and I also don't see access attempts on the LDAP server (Authentik).

I have enabled APP_DEBUG=true in /var/www/bookstack/.env, but I don't get any debugging when trying to login and again no errors in the logs.

If I remove the LDAP config from .env, I can login as the admin. So it seems like the .env is being read properly... I just get nothing from debugging.

Please let me know if I can provide any specific information.

Exact BookStack Version

v23.10.1

Log Content

Hosting Environment

Proxmox 8.3

Turnkey Linux Image:
debian-12-turnkey-bookstack_18.0-1_amd64.tar.gz

[ssddanbrown]

Hi @JacoRimere,
I don't think the APP_DEBUG matters here since there's probably no error being thrown.

"These credentials do not match our records."

That generally means that BookStack is not finding any matching users, or the password check (via LDAP bind) is not passing.
This means that the connection is probably working though.

You could temporary try setting the LDAP_DUMP_USER_DETAILS=true env option.
If nothing changes on login attempt, then that means it's not finding the user in your LDAP system. This is often due to bad LDAP_USER_FILTER or LDAP_BASE_DN configuration.
If instead you see dumped details on login attempt, then that means it's likely the password check failing.

[JedMeister]

Hi, I'm lead dev on TurnKey and am commenting on the off chance that it is something that is related to our container.

I am not an expert with LDAP/AD integration so can't speak much to that. And obviously @ssddanbrown is the Bookstack expert. It sounds like the connection is working - so it seems unlikely that it is an issue on our end and/or an issue with the PHP LDAP module (not installed or not enabled). Given what Dan noted, my guess is that there would be an explicit error if the LDAP module was the issue, but just in case:

Here's the process to check the ldap module is installed and enabled:

 phpquery -v 8.2 -s apache2 -m ldap

If need be, here's how to install and enable:

# install
apt update
apt install -y php-ldap

# enable
phpenmod ldap
systemctl restart apache2

Apologies if this is just noise...

[JacoRimere]

Thank you both for your help!

I am still stuck and not exactly sure why... I do have the ldap module installed and loaded:

phpquery -v 8.2 -s apache2 -m ldap
ldap (Enabled for apache2 by maintainer script)

The only time I can get any error is when I completely screw up the search filter by changing the line: LDAP_USER_FILTER=(&(uid={user})) to something like: LDAP_USER_FILTER=user

Then I get an expected error:

Details

ErrorException
ldap_search(): Search: Bad search filter

#0 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Bootstrap/HandleExceptions.php(270): Illuminate\Foundation\Bootstrap\HandleExceptions->handleError()
#1 [internal function]: Illuminate\Foundation\Bootstrap\HandleExceptions->Illuminate\Foundation\Bootstrap\{closure}()
#2 /var/www/bookstack/app/Access/Ldap.php(59): ldap_search()
#3 /var/www/bookstack/app/Access/Ldap.php(80): BookStack\Access\Ldap->search()
#4 /var/www/bookstack/app/Access/LdapService.php(66): BookStack\Access\Ldap->searchAndGetEntries()
#5 /var/www/bookstack/app/Access/LdapService.php(87): BookStack\Access\LdapService->getUserWithAttributes()
#6 /var/www/bookstack/app/Access/Guards/LdapSessionGuard.php(72): BookStack\Access\LdapService->getUserDetails()
#7 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Auth/AuthManager.php(340): BookStack\Access\Guards\LdapSessionGuard->attempt()
#8 /var/www/bookstack/app/Access/LoginService.php(157): Illuminate\Auth\AuthManager->__call()
#9 /var/www/bookstack/app/Access/Controllers/LoginController.php(148): BookStack\Access\LoginService->attempt()
#10 /var/www/bookstack/app/Access/Controllers/LoginController.php(82): BookStack\Access\Controllers\LoginController->attemptLogin()
#11 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Controller.php(54): BookStack\Access\Controllers\LoginController->login()
#12 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(43): Illuminate\Routing\Controller->callAction()
#13 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(259): Illuminate\Routing\ControllerDispatcher->dispatch()
#14 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Route.php(205): Illuminate\Routing\Route->runController()
#15 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(798): Illuminate\Routing\Route->run()
#16 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(141): Illuminate\Routing\Router->Illuminate\Routing\{closure}()
#17 /var/www/bookstack/app/Http/Middleware/CheckGuard.php(27): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#18 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): BookStack\Http\Middleware\CheckGuard->handle()
#19 /var/www/bookstack/app/Http/Middleware/RedirectIfAuthenticated.php(31): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#20 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): BookStack\Http\Middleware\RedirectIfAuthenticated->handle()
#21 /var/www/bookstack/app/Http/Middleware/Localization.php(32): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#22 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): BookStack\Http\Middleware\Localization->handle()
#23 /var/www/bookstack/app/Http/Middleware/RunThemeActions.php(26): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#24 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): BookStack\Http\Middleware\RunThemeActions->handle()
#25 /var/www/bookstack/app/Http/Middleware/CheckEmailConfirmed.php(47): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#26 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): BookStack\Http\Middleware\CheckEmailConfirmed->handle()
#27 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(78): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#28 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Foundation\Http\Middleware\VerifyCsrfToken->handle()
#29 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#30 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\View\Middleware\ShareErrorsFromSession->handle()
#31 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(121): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#32 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\Session\Middleware\StartSession->handleStatefulRequest()
#33 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Session\Middleware\StartSession->handle()
#34 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#35 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse->handle()
#36 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(67): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#37 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Cookie\Middleware\EncryptCookies->handle()
#38 /var/www/bookstack/app/Http/Middleware/ApplyCspRules.php(33): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#39 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): BookStack\Http\Middleware\ApplyCspRules->handle()
#40 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(116): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#41 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(797): Illuminate\Pipeline\Pipeline->then()
#42 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(776): Illuminate\Routing\Router->runRouteWithinStack()
#43 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(740): Illuminate\Routing\Router->runRoute()
#44 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Routing/Router.php(729): Illuminate\Routing\Router->dispatchToRoute()
#45 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(190): Illuminate\Routing\Router->dispatch()
#46 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(141): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}()
#47 /var/www/bookstack/app/Http/Middleware/PreventResponseCaching.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#48 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): BookStack\Http\Middleware\PreventResponseCaching->handle()
#49 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php(39): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#50 /var/www/bookstack/app/Http/Middleware/TrustProxies.php(41): Illuminate\Http\Middleware\TrustProxies->handle()
#51 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): BookStack\Http\Middleware\TrustProxies->handle()
#52 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#53 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php(40): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle()
#54 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Foundation\Http\Middleware\TrimStrings->handle()
#55 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#56 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Foundation\Http\Middleware\ValidatePostSize->handle()
#57 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php(86): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#58 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance->handle()
#59 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(116): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#60 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(165): Illuminate\Pipeline\Pipeline->then()
#61 /var/www/bookstack/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(134): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter()
#62 /var/www/bookstack/public/index.php(52): Illuminate\Foundation\Http\Kernel->handle()
#63 {main}

But if I just change the the uid to the correct user filter LDAP_USER_FILTER==(&(cn={user})), or to anything for that matter, I get no errors just the login message that the user doesn't match credentials... Meanwhile, I see no login attempts nor bind attempts on the LDAP server.

If there was a config issue, I would expect to see the failed attempts on the LDAP... Unless it can't reach the server, which I suspect could be the issue even though I can run ldapsearch from bookstack and get correct results.

If there is any other information I can provide, please let me know!

[ssddanbrown]

even though I can run ldapsearch from bookstack and get correct results

Are you running that search with the exact same bind user, filter and base DN?

Meanwhile, I see no login attempts nor bind attempts on the LDAP server.

Are you seeing bind attempts when running the ldapsearch command?

[JacoRimere]

My apologies, I am missing something simple here...

Yes I am using the same bind user and DN with ldapsearch, but the filter I am using is:
(objectClass=user)

That filter doesn't seem to work with the config, what would be best way of using that filter in the config? Thank you again for your help!

[ssddanbrown]

@JacoRimere That is not a unique filter. The filter needs to uniquely identify a user, based on the given username on the login form. What LDAP user property are you intending to use for the login username?

[JacoRimere]

My apologies, I would to use the "mail" attribute, or even the "cn".

[ssddanbrown]

In that case (using mail) you'd use a filter like:

LDAP_USER_FILTER="(&(mail={user})(objectClass=user))"

[ssddanbrown]

Since there's been no further follow-up I'm going to close this off.