LDAP Sync works, but LDAP Auth Shows filter error

[jakeclever]

In v8.1.18 - build 18876, when configuring LDAP, test LDAP Sync works perfectly, usernames, first, last, etc, all correct. However, when testing LDAP auth, account creds correct and known good LDAP account permissions return error "ldap_search(): Search: Bad search filter"

If user credentials are invalid, receive login failed message. If LDAP BIND account has insufficient permissions, receive could not bind to LDAP and sync fails as well.

If LDAP sync is performed, users merge appropriately and sync with LDAP directory. However, users will be unable to login. Noted that users previously considered "local" users are able to still login with their merged/LDAP accounts using previous local credentials. LDAP user is located within BASE OU DN and is found using LDAP filter expression entered.

[snipe]

So it sounds like auth is working - the system is telling you your search filter is bad, and you should probably look into that a bit. LDAP implementation in Snipe-IT is rock solid, it's been tested for over a decade in the field. It would help a lot to see your search filter, since that's what the system is complaining about.

[jakeclever]

Here's the LDAP filter I was originally using. However, it also happens with the default &(cn=*) as well. Happens with the read only LDAP account and even with a domain admin as the LDAP query creds.

[jakeclever]

Apologies double posting. I've noticed that if I change the LDAP filter, the Test LDAP Sync test fails to pull any results and says the same error: "ldap_search(): Search: Bad search filter". But, when I have that filter or the default, then it comes back with test sync but fails test login (and real login for users without local accounts/passwords merged).

[swift2512]

@ Authentication query should end with '=' (samaccountname=) and your LDAP filter looks weird and complicated. According google, you specifically are using for disabled accounts (':=2). Why not use something simple like &(objectGUID=*)?