mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 16:49:47 +03:00
LDAP Setup is nearly impossible #2760
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @saschabrockel on GitHub (Apr 24, 2022).
Describe the Bug
Hello there. I have really no idea how the hell this is coded but BookStack is the only app that I can't get working with LDAP for weeks. The documentation if something does not work is horrible. Debugging is simply not possible because it only tells me "malformed utf-8 characters possibly incorrectly encoded" when
LDAP_DUMP_USER_DETAILS=true. It seems like I also need to setAPP_DEBUG=trueto let the message occur. Otherwise, it's just invalid credentials.I mean even with the standard user filter
LDAP_USER_FILTER=(&(uid=${user}))it does not work for me. I got one user filter that works but does not recognize what the user enters and always logs in as the first user in LDAP. Using this default filter just tells me invalid credentials which is not true. I'm using OpenLDAP and the newest Docker Image of BookStack.This user filter does what I told you above:
LDAP_USER_FILTER=(&(|(objectclass=inetOrgPerson))(|(memberof=cn=admin,ou=groups,dc=sascha-brockel,dc=de)(memberof=cn=family,ou=groups,dc=sascha-brockel,dc=de)(memberof=cn=yass,ou=groups,dc=sascha-brockel,dc=de)))MemberOf also seems not to work.
Edit: I tried the following filter now:
LDAP_USER_FILTER=(&(uid=${user})(|(objectclass=inetOrgPerson))(|(memberof=cn=admin,ou=groups,dc=sascha-brockel,dc=de)(memberof=cn=family,ou=groups,dc=sascha-brockel,dc=de)(memberof=cn=yass,ou=groups,dc=sascha-brockel,dc=de)))This now ends up in invalid credentials too.
Steps to Reproduce
Expected Behaviour
Get logged in.
Screenshots or Additional Context
No response
Browser Details
Google Chrome 100.0.4896.88 (64 Bit) on Windows 11
Exact BookStack Version
v22.03.1
PHP Version
No response
Hosting Environment
Docker Container:
lscr.io/linuxserver/bookstack:latest@ssddanbrown commented on GitHub (Apr 24, 2022):
Hi @saschabrockel,
LDAP_USER_FILTERfor your BookStack setup/install?LDAP_USER_FILTERwork when querying the LDAP server manually outside of BookStack, when replacing${user}with a valid uid?@saschabrockel commented on GitHub (Apr 25, 2022):
Hi @ssddanbrown,
I'm setting it as an environment variable in my docker-compose.yml.
What exactly do you mean with outside of BookStack? How to test it? I'm running the same LDAP things with for example NextCloud and Authelia without problems. But the configuration options are clearer.
@ssddanbrown commented on GitHub (Apr 25, 2022):
In that case, could you try using two
$signs instead of one? Like so:And let me know if that works?
I just meant using something like the
ldapsearchcommand to test the same settings from another perspective.Try the change above first though, it's probably that.
@saschabrockel commented on GitHub (Apr 25, 2022):
LDAP_USER_FILTER=(&(uid=$${user}))Nope does not work either sadly. I already tried it.
And that was the strange thing.
@ssddanbrown commented on GitHub (Apr 25, 2022):
Okay,
memberOfwork with OpenLDAP?@saschabrockel commented on GitHub (Apr 25, 2022):
Yes. Like in this manual: https://kifarunix.com/how-to-create-openldap-member-groups/
I've needed to activate it.
The docker image: osixia/openldap:latest
@ssddanbrown commented on GitHub (Apr 25, 2022):
Just to confirm, before I attempt to emulate your environment:
memberofqueries)?docker-compose.ymlconfig?ou=users,dc=sascha-brockel,dc=detree of your LDAP system? Just checking because the admin user in use in your config does not appear to be.@saschabrockel commented on GitHub (Apr 26, 2022):
@ssddanbrown commented on GitHub (Apr 26, 2022):
Okay, just spent a couple of hours on this. I replicated the LDAP side the best I could. I used my local dev bookstack instance though instead of a docker setup, I could attempt using the linuxserver.io image also with a similar config setup (using env_file) but it's late here. Maybe a next step if we don't get further from these findings.
My Setup
My
.envoptions (Not docker-based, BookStack .env file)My OpenLDAP setup
Just a direct use of this compose file, no changes.
My OpenLDAP structure
My Findings
The above functionally works fine for me, including group-sync once I read-up on the classes required in OpenLDAP.
Some notes though:
LDAP_DUMP_USER_DETAILS=falsedoes fail as you reported in some cases, this is likely due to theLDAP_THUMBNAIL_ATTRIBUTE=jpegphotooption. If you remove/comment-out that option then theLDAP_DUMP_USER_DETAILSfunctionality should work again. I've opened #3396 to address this case in the future.osixia/openldap:latestdocker container already hadmemberOfworking, I did not have to do any setup.Next Steps
While doing the above, I came up with the following additional questions and thoughts to diagnose:
uidof the user account? Definitely not the email, CN or some other username? Just want to be sure since by default all of these values would differ by default on OpenLDAP while being similar in some ways.LDAP_THUMBNAIL_ATTRIBUTEand see if the LDAP_DUMP_USER_DETAILS option yields any results.@saschabrockel commented on GitHub (Apr 26, 2022):
Okay sorry to hear that you've spent hours on that. I would have given you everything you need... because I already scripted enough files to exactly recreate the config. We can also have a call if it would help.
So first of all of course I'm using an adjusted
docker-compose-ymlfor OpenLDAP. But interesting that you havememberOfinstantly.The error with
LDAP_THUMBNAIL_ATTRIBUTEcommented andLDAP_DUMP_USER_DETAILS=true:The user I'll try to log in (you can see it is his
uid):I've used the exact same
.envfile now and I do not see any user information that is getting dumped. But of course it is Docker.I really have no idea why. I mean at least something should happen.
LDAP Env Stuff:
Or do I need
APP_DEBUG=trueto be set?@ssddanbrown commented on GitHub (Apr 26, 2022):
No, the data dump should show either way. Are you at least seeing JSON dumped to the screen (With lack of details) or does the option not seem to do anything?
I'll try and find some time later to spin up a linuxserver container to connect with the ldap setup to see if anything else shows up.
@saschabrockel commented on GitHub (Apr 26, 2022):
That's the exact problem. I have never seen anything from it with the exception of the malformed UTF-8 error. Tell me if I can help you in any way.
@ssddanbrown commented on GitHub (Apr 26, 2022):
Okay, Done some more testing, this time using docker for BookStack (via linuxserver.io container).
First of all, My recollection of
LDAP_DUMP_USER_DETAILSwas a bit off above, It will only dump when a user is found (Used more to check the values of a found user), sorry about that.From my testing, I think this may be down to differences in how environment variables are handled between the docker composer
environmentand theenv_fileoptions. I found this by a fair amount of debugging by accessing the bookstack container while it was running and printing vars.I could not get a way to get the user filter working in the
env_filebut if you move this option (Only need to do this single option due to its syntax) to theenvironmentpart of your docker-compose then things should work. Still need double-$here though. Here's a snippet from mydocker-comose.ymlas an example:I think this different in handling has already been reported to docker under these issues:
Can you give that config change a try and let me know how it goes?
@saschabrockel commented on GitHub (Apr 27, 2022):
Oh, my goooood... I remember this bullshit... I'm sorry for wasting your time. This bug exists for years. On my work, I had the same problem with Spring Boot variables years ago with Docker and now I remember... it works now... so it is not your fault. Neither mine but yea...
Even my own complicated filter above works now. Maybe you should give a hint in the documentation for that problem and also link the issue of docker-compose... thank you very much for your effort! I can also tell that dump user worked instantly.
So the solution is: just put in the
docker-compose.ymlenvironment part and not in theenv_file:Even this works:
@ssddanbrown commented on GitHub (Apr 27, 2022):
@saschabrockel No worries, I'm just happy we found the issue and got things going!
We already had a note on that option for docker-compose regarding the double-dollar, but I've now updated the docs with an extra line just to say it cannot be used with the
env_fileoption.