All searches return an empty collection

[cenzo81]

• Laravel Version: 5.5.48
• Adldap2-Laravel Version: 6.0
• PHP Version: 7.2.24
• LDAP Type: ActiveDirectory

I already checked the base_dn with the command dsquery user -name "Username"
so the base_dn must be correct.

I checked all the past issues but noting helped.
The connection to the server works fine but when i try to show all the users i get a empty collection

[stevebauman]

Hi @cenzo81,

A couple things:

• Do you have follow_referrals enabled?
• Is your base_dn scoped to any organization unit? Such as ou=Users,dc=acme,dc=org? Or simply dc=acme,dc=org?
• Can retrieve any records at all? Try retrieving all records for testing using: Adldap::search()->get()

[cenzo81]

Hi Steve,

thank's for your fast reply,

• Yes it is enabled but i changed it also to follow_referrals = false with no effect
• the result of the dsquery shows OU=Benutzer,OU=BEKON,OU=LAefer,DC=LAefer,DC=local
• No result just an empty collection

Beside Laravel i testet the ldap connection and it works fine so i think it must be a missconfiguration

[stevebauman]

Hey @cenzo81,

From the DN you've posted, this would be your base: DC=LAefer,DC=local.

Can you set your base_dn to the above and give it another shot (try retrieving records)?

[cenzo81]

My base_dn is exactly like that . I'll post you my whole config in a Minute

[stevebauman]

Ok, are you caching your configuration at all? If so, please try clearing it via php artisan cache:clear.

Also, can you enable logging inside your ldap.php config file, then try retrieving records again and post the logs that appear in your storage/logs directory?

[cenzo81]

I cleard the config cache after any change.
The idea activating the log is good.

Here is my config

'auto_connect' => env('LDAP_AUTO_CONNECT', true),
'connection' => Adldap\Connections\Ldap::class,
'settings' => [
    'schema' => Adldap\Schemas\ActiveDirectory::class,
    'account_prefix' => env('LDAP_ACCOUNT_PREFIX', ''),
    'account_suffix' => env('LDAP_ACCOUNT_SUFFIX', '@LAefer.local'),
    'hosts' => explode(' ', env('LDAP_HOSTS', 'dienste.LAefer.local backup.LAefer.local')),
    'port' => env('LDAP_PORT', 389),
    'timeout' => env('LDAP_TIMEOUT', 5),
    'base_dn' => env('LDAP_BASE_DN', 'DC=LAefer,DC=local'),
    'username' => env('username'),
    'password' => env('password'),
    'follow_referrals' => false,
    'use_ssl' => env('LDAP_USE_SSL', false),
    'use_tls' => env('LDAP_USE_TLS', false),

[cenzo81]

After enabling the logging nothing is outputted to the laravel.log

[stevebauman]

Very strange... Can you verify that the following statement returns true in your application?

$connected = Adldap::getConnection()->isBound();

dd($connected);

[cenzo81]

Yes the function returns true

[stevebauman]

That's so bizarre. Enabling logs and making any attempt to connect to your LDAP servers will show up as a bind request in your logs...

Do you have multiple connections setup in your ldap.php config file?

[cenzo81]

No there is just one connection in the config, i am diving deep i your code right now and i think there is something wrong with the binding. When i insert my own binding with hard coded username an password then it works. Seems like the username and password is null when i don't use my own binding. I'll continue analyzing

[cenzo81]

Ok, so finally i found the Problem! It was sitting right behind the keyboard. (ISO/OSI Layer 8 Problem)
My big fault was to set the unsername and password the wrong way.

I did this in the config
'username' => env('username'), 'password' => env('1234'),

But of cause i need to set it like that
'username' => env('LDAP_USERNAME', 'username'), 'password' => env('LDAP_PASSWORD', '1234'),

Maybe you could change that in your ldap.php to prevent other people doing the same
by putting an empty string or the word username and password as placeholder like you did it with the account_suffix? It's just a suggestion
'account_suffix' => env('LDAP_ACCOUNT_SUFFIX', '')

[stevebauman]

Great! I'm glad you were able to resolve it 😄

Maybe you could change that in your ldap.php to prevent other people doing the same
by putting an empty string or the word username and password as placeholder like you did it with the account_suffix?

I think I'll do that, thanks for the suggestion!