Actions
Feature #16189
open
Better Logging for LDAP Connection Errors
Added by Björn Jakobsen over 1 year ago. Updated 21 days ago.
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.10
Release Notes:
Default
Description
LDAP Connection Errors are hard to debug, as they dont give out any error details. This should be fixable by reading ldap_error() to get the last error message.
Updated by Jim Pingle over 1 year ago
- Status changed from New to Waiting on Merge
- Assignee set to Jim Pingle
- Target version set to 2.9.0
- Plus Target Version set to 25.07
Updated by Jim Pingle over 1 year ago
Updated by Jim Pingle about 1 year ago
- Plus Target Version changed from 25.07 to 25.11
Updated by Jim Pingle 10 months ago
- Plus Target Version changed from 25.11 to 26.03
Updated by Jim Pingle 6 months ago
- Plus Target Version changed from 26.03 to 26.07
Updated by Jim Pingle 2 months ago
- Plus Target Version changed from 26.07 to 26.11
Updated by Jim Pingle about 2 months ago
- Plus Target Version changed from 26.11 to 26.10
Updated by Marcos M 21 days ago
- Status changed from Waiting on Merge to Feedback
- Assignee changed from Jim Pingle to Marcos M
- Target version changed from 2.9.0 to CE-Next
- % Done changed from 0 to 100
Implemented with f8a683677c1e16ddb1ce834a7b3cbea4b2972ecd.
diff --git a/src/etc/inc/auth.inc b/src/etc/inc/auth.inc
index 7c87c5c431..057230dc96 100644
--- a/src/etc/inc/auth.inc
+++ b/src/etc/inc/auth.inc
@@ -1086,13 +1086,14 @@ function ldap_test_connection($authcfg) {
}
/* connect and see if server is up */
- $error = false;
if (!($ldap = ldap_connect($ldapserver))) {
- $error = true;
- }
-
- if ($error == true) {
- logger(LOG_ERR, localize_text("Could not connect to server %s.", $authcfg['name']), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not connect to server "%s"%s',
+ (g_get('debug') ? 'ldap_test_connection() ' : ''),
+ $authcfg['name'],
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
return false;
}
@@ -1121,7 +1122,13 @@ function ldap_setup_caenv($ldap, $authcfg) {
$param = array('caref' => $authcfg['ldap_caref']);
$cachain = ca_chain($param);
if (!$caref) {
- logger(LOG_ERR, localize_text("Could not lookup CA by reference for host %s.", $authcfg['ldap_caref']), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not lookup CA by reference for host "%s"%s',
+ (g_get('debug') ? 'ldap_setup_caenv() ' : ''),
+ $authcfg['ldap_caref'],
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
/* XXX: Prevent for credential leaking since we cannot setup the CA env. Better way? */
ldap_set_option($ldap, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_HARD);
return;
@@ -1173,13 +1180,14 @@ function ldap_test_bind($authcfg) {
}
/* connect and see if server is up */
- $error = false;
if (!($ldap = ldap_connect($ldapserver))) {
- $error = true;
- }
-
- if ($error == true) {
- logger(LOG_ERR, localize_text("Could not connect to server %s.", $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not connect to server "%s"%s',
+ (g_get('debug') ? 'ldap_test_bind() ' : ''),
+ $ldapname
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
return false;
}
@@ -1194,7 +1202,14 @@ function ldap_test_bind($authcfg) {
if (strstr($authcfg['ldap_urltype'], "STARTTLS")) {
if (!(@ldap_start_tls($ldap))) {
- logger(LOG_ERR, localize_text("%s could not STARTTLS to server %s.", 'ldap_test_bind()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not STARTTLS to server "%s"%s',
+ (g_get('debug') ? 'ldap_test_bind() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
@ldap_close($ldap);
return false;
}
@@ -1204,10 +1219,26 @@ function ldap_test_bind($authcfg) {
$ldapbindpw = isset($authcfg['ldap_utf8']) ? mb_convert_encoding($ldapbindpw, 'UTF-8') : $ldapbindpw;
if ($ldapanon == true) {
if (!($res = @ldap_bind($ldap))) {
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not bind anonymously to server "%s"%s',
+ (g_get('debug') ? 'ldap_test_bind() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
@ldap_close($ldap);
return false;
}
} else if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not bind to server "%s"%s',
+ (g_get('debug') ? 'ldap_test_bind() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
@ldap_close($ldap);
return false;
}
@@ -1292,12 +1323,26 @@ function ldap_get_user_ous($show_complete_ou, $authcfg) {
$ldapbindpw = isset($authcfg['ldap_utf8']) ? mb_convert_encoding($ldapbindpw, 'UTF-8') : $ldapbindpw;
if ($ldapanon == true) {
if (!($res = @ldap_bind($ldap))) {
- logger(LOG_ERR, localize_text("%s could not bind anonymously to server %s.", 'ldap_get_user_ous()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not bind anonymously to server "%s"%s',
+ (g_get('debug') ? 'ldap_get_user_ous() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
@ldap_close($ldap);
return $ous;
}
} else if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
- logger(LOG_ERR, localize_text("%s could not bind to server %s.", 'ldap_get_user_ous()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not bind anonymously to server "%s"%s',
+ (g_get('debug') ? 'ldap_get_user_ous() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
@ldap_close($ldap);
return $ous;
}
@@ -1403,13 +1448,14 @@ function ldap_get_groups($username, $authcfg) {
$memberof = array();
/* connect and see if server is up */
- $error = false;
if (!($ldap = ldap_connect($ldapserver))) {
- $error = true;
- }
-
- if ($error == true) {
- logger(LOG_ERR, localize_text("%s Could not connect to server %s.", 'ldap_get_groups()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not connect to server "%s"%s',
+ (g_get('debug') ? 'ldap_get_groups() ' : ''),
+ $ldapname,
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
return $memberof;
}
@@ -1424,7 +1470,14 @@ function ldap_get_groups($username, $authcfg) {
if (strstr($authcfg['ldap_urltype'], "STARTTLS")) {
if (!(@ldap_start_tls($ldap))) {
- logger(LOG_ERR, localize_text("%s could not STARTTLS to server %s.", 'ldap_get_groups()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not STARTTLS to server "%s"%s',
+ (g_get('debug') ? 'ldap_get_groups() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
@ldap_close($ldap);
return array();
}
@@ -1435,12 +1488,26 @@ function ldap_get_groups($username, $authcfg) {
$ldapbindpw = isset($authcfg['ldap_utf8']) ? mb_convert_encoding($ldapbindpw, 'UTF-8') : $ldapbindpw;
if ($ldapanon == true) {
if (!($res = @ldap_bind($ldap))) {
- logger(LOG_ERR, localize_text("%s could not bind anonymously to server %s.", 'ldap_get_groups()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not bind anonymously to server "%s"%s',
+ (g_get('debug') ? 'ldap_get_groups() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
@ldap_close($ldap);
return array();
}
} else if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
- logger(LOG_ERR, localize_text("%s could not bind to server %s.", 'ldap_get_groups()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not bind to server "%s"%s',
+ (g_get('debug') ? 'ldap_get_groups() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
@ldap_close($ldap);
return $memberof;
}
@@ -1528,7 +1595,13 @@ function ldap_backed($username, $passwd, $authcfg, &$attributes = array()) {
}
if (!function_exists("ldap_connect")) {
- logger(LOG_CRIT, localize_text("unable to find %s function.", 'ldap_connect()'), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_CRIT,
+ localize_text(
+ "%sunable to find %s function.",
+ (g_get('debug') ? 'ldap_backed() ' : ''),
+ 'ldap_connect()'
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
$attributes['error_message'] = gettext("Internal error during authentication.");
return null;
}
@@ -1609,17 +1682,14 @@ function ldap_backed($username, $passwd, $authcfg, &$attributes = array()) {
}
/* Make sure we can connect to LDAP */
- $error = false;
if (!($ldap = ldap_connect($ldapserver))) {
- $error = true;
- }
-
- if (g_get('debug')) {
- logger(LOG_DEBUG, localize_text("LDAP connection error flag: %s", var_export($error, true)), LOG_PREFIX_AUTHPROVIDER_LDAP);
- }
-
- if ($error == true) {
- $errormsg = sprintf(gettext("ERROR! Could not connect to server %s."), $ldapname);
+ logger(LOG_DEBUG,
+ localize_text(
+ '%scould not connect to server "%s"%s',
+ (g_get('debug') ? 'ldap_backed() ' : ''),
+ $ldapname
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
$attributes['error_message'] = gettext("Error : could not connect to authentication server.");
return null;
}
@@ -1635,7 +1705,14 @@ function ldap_backed($username, $passwd, $authcfg, &$attributes = array()) {
if (strstr($authcfg['ldap_urltype'], "STARTTLS")) {
if (!(@ldap_start_tls($ldap))) {
- logger(LOG_ERR, localize_text("could not connect to LDAP server %s using STARTTLS.", $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not STARTTLS to server "%s"%s',
+ (g_get('debug') ? 'ldap_backed() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
$attributes['error_message'] = gettext("Error : could not connect to authentication server.");
@ldap_close($ldap);
return null;
@@ -1643,20 +1720,32 @@ function ldap_backed($username, $passwd, $authcfg, &$attributes = array()) {
}
/* ok, its up. now, lets bind as the bind user so we can search it */
- $error = false;
$ldapbindun = isset($authcfg['ldap_utf8']) ? mb_convert_encoding($ldapbindun, 'UTF-8') : $ldapbindun;
$ldapbindpw = isset($authcfg['ldap_utf8']) ? mb_convert_encoding($ldapbindpw, 'UTF-8') : $ldapbindpw;
if ($ldapanon == true) {
if (!($res = @ldap_bind($ldap))) {
- $error = true;
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not bind anonymously to server "%s"%s',
+ (g_get('debug') ? 'ldap_backed() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
+ @ldap_close($ldap);
+ $attributes['error_message'] = gettext("Error : could not connect to authentication server.");
+ return null;
}
} else if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
- $error = true;
- }
-
- if ($error == true) {
+ logger(LOG_ERR,
+ localize_text(
+ '%scould not bind to server "%s"%s',
+ (g_get('debug') ? 'ldap_backed() ' : ''),
+ $ldapname,
+ (': ' . ldap_error($ldap))
+ ), LOG_PREFIX_AUTHPROVIDER_LDAP
+ );
@ldap_close($ldap);
- logger(LOG_ERR, localize_text("Could not bind to LDAP server %s. Please check the bind credentials.", $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
$attributes['error_message'] = gettext("Error : could not connect to authentication server.");
return null;
}
@@ -1675,7 +1764,7 @@ function ldap_backed($username, $passwd, $authcfg, &$attributes = array()) {
/* that way we don't have to search twice. */
/*****************************************************************/
if (g_get('debug')) {
- logger(LOG_ERR, localize_text("Now Searching for %s in directory.", $username), LOG_PREFIX_AUTHPROVIDER_LDAP);
+ logger(LOG_DEBUG, localize_text("Now Searching for %s in directory.", $username), LOG_PREFIX_AUTHPROVIDER_LDAP);
}
/* Iterate through the user containers for search */
foreach ($ldac_splits as $i => $ldac_split) {
Actions
Also available in: Atom