Active Directory LDAP: issue while importing users

[vrindergyani]

Hi,

We are facing a quite annoying issue.
I don't know if this issue has been already reported but we can't import users through the import users in administration. Every time I tried to import I get the error:
Information
Failed operation
(0 authorization problems, 1 failures)
wdevos: Error on executing the action

I tried to upgrade to the latest version 0.90.5 but still the same.

To workaround this, we insert the users in the database manually then sync them and this works.

We are using Active Directory as LDAP.

To reproduce this issue:
Need to setup the LDAP config in GLPI
go to administration=>users=>LDAP Directory link
Import new users
Try to import new users =>action "import"
And here the error comes.

I don't know where to find the logs plus we don't know if it's the database logs which needed or the application logs.

I saw in the release notes of the version 0.90.4 that there was issue reported regarding importing users with LDAP and it has been closed but it's still not working as expected.

Please let me know also if it's a config issue or it's a known issue.

Regards,
Vrinder

[tomolimo]

Hello
Need to know your config please.
Regards
Tomolimo

[vrindergyani]

Hi,
Which config you need to know?

Regards,
Vrinder

[tomolimo]

Go to: 'Setup > General' Tab: 'System' and copy/paste here the texte below 'Information about system installation and configuration'

And

Go to: 'Setup > Authentication > LDAP directories', and in your directory, go to 'Advanced information', and paste here a screen copy.

thank you,

[vrindergyani]

GLPI 0.90.5 ( => /data/www/helpdesk.sia.bc)

Server

Operating system: Linux bms-web02.bms.11skynet.local 3.10.0-327.28.3.el7.x86_64 #1 SMP Thu Aug 18 19:05:49 UTC 2016 x86_64
PHP 5.6.14 fpm-fcgi (Core, PDO, Phar, Reflection, SPL, SimpleXML, bcmath, bz2, calendar, cgi-fcgi, ctype, curl, date, dba, dom,
ereg, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, imap, json, ldap, libxml, mbstring, mcrypt, mhash, mysql, mysqli,
mysqlnd, openssl, pcntl, pcre, pdo_mysql, pdo_sqlite, posix, session, soap, sockets, sqlite3, standard, tokenizer, wddx, xml,
xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib)
Setup: max_execution_time="120" memory_limit="128M" post_max_size="300M" safe_mode="" session.save_handler="files"
upload_max_filesize="300M"
Software: nginx/1.9.5
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Server Software: MariaDB Server
Server Version: 10.1.8-MariaDB
Server SQL Mode: NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
Parameters: glpiprodusr@10.46.137.31/helpdesk
Host info: 10.46.137.31 via TCP/IP

OK/data/www/helpdesk.sia.bc/config : OK
OK/data/www/helpdesk.sia.bc/files : OK
OK/data/www/helpdesk.sia.bc/files/_dumps : OK
OK/data/www/helpdesk.sia.bc/files/_sessions : OK
OK/data/www/helpdesk.sia.bc/files/_cron : OK
OK/data/www/helpdesk.sia.bc/files/_graphs : OK
OK/data/www/helpdesk.sia.bc/files/_lock : OK
OK/data/www/helpdesk.sia.bc/files/_plugins : OK
OK/data/www/helpdesk.sia.bc/files/_tmp : OK
OK/data/www/helpdesk.sia.bc/files/_rss : OK
OK/data/www/helpdesk.sia.bc/files/_uploads : OK
OK/data/www/helpdesk.sia.bc/files/_pictures : OK
OK/data/www/helpdesk.sia.bc/files/_log : OK
Web access to files directory is protectedWeb access to files directory is protected : OK
OKSELinux mode is Disabled

Libraries

htmLawed version 1.1.21 in (/data/www/helpdesk.sia.bc/lib/htmlawed)
phpCas version 1.3.4 in (/data/www/helpdesk.sia.bc/lib/phpcas)
PHPMailer version 5.2.8 in (/data/www/helpdesk.sia.bc/lib/phpmailer)
ZetaComponent ezcGraph installed in (/data/www/helpdesk.sia.bc/lib/zeta/Base): OK
Zend Framework version 2.4.9 in (/data/www/helpdesk.sia.bc/lib/Zend)
SimplePie version 1.3.1 in (/data/www/helpdesk.sia.bc/lib/simplepie)
TCPDF version 6.2.12 in (/data/www/helpdesk.sia.bc/lib/tcpdf)
ircmaxell/password-compat in (/data/www/helpdesk.sia.bc/lib/password_compat). Compatitility: Ok

LDAP directories

Server: 'bms.11skynet.local', Port: '389', BaseDN: 'DC=bms,DC=11skynet,DC=local', Connection filter:
'(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))', RootDN:
'CN=idp_glpi,OU=Services,OU=Accounts,OU=Company,DC=bms,DC=11skynet,DC=local', Use TLS: none

Mysql replicas

Not active

Notifications

Way of sending emails: SMTP (anonymous@10.46.137.20)

Mails receivers

Name: 'glpi-uat@siabms.be' Active: Yes
Server: '{BMS-EXCH01/imap/ssl/novalidate-cert/notls}INBOX' Login: 'idp_mailbox_glpi-uat' Password: Yes

Plugins list

dashboard            Name: Dashboard                      Version: 0.6.9      State: Enabled
fusioninventory      Name: FusionInventory                Version: 0.90+1.0   State: Enabled

and

[tomolimo]

Here is my AD - LDAP configuration:

and advanced config:

Could you check if the 'TEST' LDAP configuration is working?
Regards,
Tomolimo

[vrindergyani]

Yes it's working as I can sync the users but can't import them.

[tomolimo]

As the sync doesn't work the same way than the 'Test' (that's why I insist on this point).
Did you really push the button 'Test'?

[vrindergyani]

yes it's successful the test
Test successful: Main server AD

[tomolimo]

would you try with my settings?
like 'Page size' and 'LDAP aliases'?
Also: does the login field is well set? should be "samaccountname" for AD

[vrindergyani]

I have tried with your settings. It's still the same error.
The login field is set to sameaccountname.

[tomolimo]

sameaccountname or samaccountname?

[vrindergyani]

samaccountname

[vrindergyani]

sorry

[tomolimo]

no problem :)

[tomolimo]

Could look into the GLPi log files?

[vrindergyani]

Do you know where I can find them?

[tomolimo]

yes: glpi_folder/files/_log/*.log

[vrindergyani]

ok I will get you the logs. I have checked logs but don't seem to have any error or warning.

[wanderleihuttel]

Hello @tomolimo.

I was trying to use a LDAP filter to get only users for a specific group. I tested a lot of possibilities, but no one works.
Is it a limitation of LDAP or GLPI?

I would like to create a group (g_glpi) in Active Directory in include only users that will can use the GLPI and use this group in LDAP filter.

My LDAP Server

LDAP Import Users

Those users marked in red I wouldn't import.

Best regards
Wanderlei

[tomolimo]

Hello @wanderleihuttel,
Is there any link with the current issue?
If not, could you create another one? Otherwise it's impossible to distinguish the real root causes.
Thank you,
regards,
Tomolimo

[wanderleihuttel]

Hello @tomolimo!
After a lot of tests with php-ldap I got what I wanted.
I created a group on the LDAP server (Group_GLPI) and linked users who can access the GLPI.
And then I used the following filter:

(&(!(userAccountControl:1.2.840.113556.1.4.803:=2))(memberof=CN=Group_GLPI,OU=Grupos,DC=domain,DC=local))

Thank you!

Best Regards
Wanderlei

[tomolimo]

@vrindergyani: no news for initial issue: I close, feel free to re-open.

[bellah2629]

Hello everyone , I have struggled with this same issue for so long. Please assist me

[bendrissou]

@vrindergyani: I faced the same issue as yours. The solution was quite simple.

All what you need is go to: Setup --> Authentication --> Setup. Then Check "Yes" on the "Add a user without accreditation from a LDAP directory" field.

[Yasamal33]

@vrindergyani: I faced the same issue as yours. The solution was quite simple.

All what you need is go to: Setup --> Authentication --> Setup. Then Check "Yes" on the "Add a user without accreditation from a LDAP directory" field.

It looks like a workaround but it works. Thank you a lot

[bendrissou]

@Yasamal33 you are welcome.