My server host upgraded our server from EasyApache3 to EasyApache4 and also upgraded the firewall. Once we got port 636 (LDAP over SSL) open, all my tests work great but no one can login. When they try to login they get the following errors:

Notice: Undefined index: user1_username in _ldap_authentication_user_login_authenticate_validate() (line 258 of /home/mysite/public_html/sites/all/modules/ldap/ldap_authentication/ldap_authentication.inc).

Sorry, unrecognized username or password. Have you forgotten your password?

We're using MS Active Directory as our user database of record and the application has worked great since launch (about 7 months ago.) Now it's exposing the user 1 username for some reason and no one can login despite valid tests of the server at /admin/config/people/ldap/servers/test/myservername

Comments

Saoirse1916 created an issue. See original summary.

Saoirse1916’s picture

Saoirse1916 commented
Issue summary: View changes
Saoirse1916’s picture

Saoirse1916 commented
Issue summary: View changes
grahl’s picture

grahl
he/him
Location Zürich
commented
Title: Error in ldap_authentication.inc - exposes user 1 username » Exception during login after upgrading to EasyApache4
Category: Bug report » Support request
Priority: Critical » Normal
Status: Active » Postponed (maintainer needs more info)

Can't really help you with that input. As with all support cases here, please provided the detailed watchdog logging from LDAP and a detailed description of your setup, it could literally be anything causing a failure on line 258.

Also, if it worked with EasyApache3 (whatever that is) and doesn't with EasyApache4 then please downgrade and consider retesting and comparing in a staging environment. I'll try and support that solution given that sufficient input is provided to act upon. I will not invest time in EasyApache myself.

Moving this to a regular support request.

Note that line 258 would indicate that we don't really have the right name attribute to act upon:
$drupal_accountname = $ldap_user['attr'][ldap_server_massage_text($ldap_server_authenticated_on->account_name_attr, 'attr_name', LDAP_SERVER_MASSAGE_QUERY_ARRAY)][0];

Now, account_name_attr should be a valid LDAP attribute in your configuration, if you see your user 1 username as the key being looked up, it's highly likely that your site is misconfigured.

Please also note that the PHP notice does not "expose" your user 1 username. If you have debug messages visible in production, your site is misconfigured.

Saoirse1916’s picture

Saoirse1916 commented

Thanks for your help, you got me on the right track to find the problem. Somehow the user 1 account name was entered into the AccountName attribute in the LDAP settings and I couldn't get it to clear, so I entered the same value that was entered for AuthName attribute (samaccountname) and it eventually worked.

Saoirse1916’s picture

Saoirse1916 commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)
grahl’s picture

grahl
he/him
Location Zürich
commented

Thanks for your feedback!