Enabling TLS generates exception when attempting login

[nerdalertdk]

• Laravel Version: 5.8
• Adldap2-Laravel Version: 6.0
• PHP Version: 7.2.17
• LDAP Type: FreeIPA

Description:

When fallback is true and the site have not connection to ldap I get this error

#File: /app/vendor/adldap2/adldap2/src/Connections/Ldap.php

ErrorException (E_WARNING)
ldap_start_tls(): Unable to start TLS: Can't contact LDAP server

Site works fine in fallover mode with no TLS

Steps To Reproduce:

Add this to you .env file

LDAP_USE_TLS=true
LDAP_LOGIN_FALLBACK=true

First login where the site have an LDAP connection (to sync user)
then block ldap connection and login will fail

[stevebauman]

Hi @nerdalertdk,

Unfortunately I'm not well-versed with FreeIPA - but I'll do my best to help you out.

On the server that hosts your web application, have you inserted your TLS certificate as instructed here?:

https://www.freeipa.org/page/HowTo/LDAP#Tool_configuration

#/etc/openldap/ldap.conf

TLS_CACERT /etc/ipa/ca.crt

This was required for me using ActiveDirectory to be able to connect via TLS with a server that is not connected to the domain - but required access to our AD server via TLS.

[nerdalertdk]

Tls works fine when the site have access to the ldap server, as soon as it looses connection (think vpn) I get the exception. It should fall over to use Laravel database as Auth

When I set tls=false in the .env the site works but the log gets spammed with exception on every page view

[stevebauman]

Oh okay I understand now, thanks for clarifying.

This is a bug, I'm able to reproduce this, fix is coming out shortly!

[nerdalertdk]

Greate, one last question when the site don't have ldap access can we stop the error spam in the log :)

Next Adldap\Auth\BindException: Can't contact LDAP server in /app/vendor/adldap2/adldap2/src/Auth/Guard.php:109
Stack trace:
#0 /app/vendor/adldap2/adldap2/src/Auth/Guard.php(121): Adldap\Auth\Guard->bind('uid=service-not...', '...')
#1 /app/vendor/adldap2/adldap2/src/Connections/Provider.php(234): Adldap\Auth\Guard->bindAsAdministrator()
#2 /app/vendor/adldap2/adldap2-laravel/src/AdldapServiceProvider.php(106): Adldap\Connections\Provider->connect()

[stevebauman]

Done! 😄

Connection exceptions will now only be sent to the log when logging is enabled.

[stevebauman]

Released v6.0.6 with these changes. Thanks!