Setting up LDAP to authenticate against Active Directory in v8.10.1

📦 Install & Upgrade Help
,
1

Hi,

I am struggling to set up LDAP in a clean install of SuiteCRM 8.10.1. I want to authenticate users against Active Directory. Ideally against a specific group or groups, but that’s not the problem at hand.

I can query the Active Directory server using ldapsearch on the server command line, so I have the right bind and search information, but I can’t even see SuiteCRM trying to connect via LDAP in any of the logs I know about. I have, in the past, had both SugarCRM 6 and SuiteCRM 7 talking very happily to LDAP, but I never managed to get anywhere upgrading my old SuiteCRM7 install, hence the clean attempt.

So my .env.local config file looks like this (redacted, of course):

=============================

LDAP Setup for ABC

AUTH_TYPE=ldap

LDAP CONFIG

LDAP_HOST=host.abc.local
LDAP_PORT=389
LDAP_ENCRYPTION=none
LDAP_PROTOCOL_VERSION=3
LDAP_REFERRALS=false
LDAP_DN_STRING=‘dc=abc,dc=local’
LDAP_QUERY_STRING=‘sAMAccountName={username}’
LDAP_SEARCH_DN=‘cn=CRMAUTH,cn=Users,dc=abc,dc=local’
LDAP_SEARCH_PASSWORD=‘PASSWORD’

EXTRA BITS

LDAP_CONNECTION_OPTION_DEBUG_LEVEL=7

===============================

As far as I can tell from the docs ( LDAP configuration reference :: SuiteCRM Documentation ) , .env.local is the only place I need to set anything, and I have run the Quick Repair and Rebuild every time I make a change.

So are there more logs somewhere that would or should show LDAP connections? Am I missing a part of the config, or is it just wrong. But even if it were wrong, why can I not see any ldap messages in the logs?

Any help gratefully accepted.

2

Future me here updating this in case anyone is having similar issues.

First of all, tucked down in the Auto Creation section is this snipped of wisdom:

“User auto creation is disabled by default for LDAP. When disabled you will only be able to authenticate users using LDAP if you first create them on SuiteCRM.”

It is quite a long scroll past the half-dozen options that are relevant to the LDAP connection. It was only when I realised that the only ldap look-ups were for existing users that I realised I was missing something.

So I then tried adding the auto-creation stuff and it did not work. However, but adding a test user to both SuiteCRM and Active Directory, I was able to confirm that authentication was working by having different passwords in the two back-ends. This tested not only the two different methods, but that fail-over was working.

The final bit of the puzzle was the realisation the answers to these very similar questions are different:

LDAP_QUERY_STRING=‘sAMAccountName={username}’

LDAP_PROVIDER_UID_KEY=‘sAMAccountName’

The documentation is not very clear, but to be honest, neither is Symfony’s. I think the only thing that would help would be better examples in the documentation.

What really helped in solving this was finding out that for some reason, the ldap logging ended up in the general Apache error logs, not the logs set in the virtual host for the CRM hosting.

1 Like
3

Check out how you could contribute to the documentation.