LDAP error (login) and problems (user sync)

[peko-hki]

Hi,
we are running snip-it on a sles 15 SP6. It is possible to connect to our LDAP (eDirectory) server.
The sync of the users IS working. However, not all attributes are used.
All users have the department stored in "ou". Using ldapsearch you can get it correctly. If we sync the users
now nobody is getting this attribute (some old entries have it). How can we debug the sync process and see what is wrong ?

Login for ldap users is not working. We tried to use debug and ldap:troubleshoot without any success.
We are using private certificates for ldaps which seems to make some trouble. So ldaps is never working, even when
we set "Use SSL certificate validation=NO" , but it does not work ...

Running
"php artisan ldap:troubleshoot"
"
....
I guess we're trying to do the ldap search here, but sometimes it takes too long?
Printing first 10 results:

Error

Cannot use object of type LDAP\Result as array

at app/Console/Commands/LdapTroubleshooter.php:460
456▕ $this->debugout("Base DN is: ".$settings->ldap_basedn." and filter is: ".parenthesized_filter($settings->ldap_filter));
457▕ $search_results = ldap_search($conn, $settings->ldap_basedn, parenthesized_filter($settings->ldap_filter));
458▕ $this->info("Printing first 10 results: ");
459▕ for($i=0;$i<10;$i++) {
➜ 460▕ $this->info($search_results[$i]);
461▕ }
462▕ } catch (\Exception $e) {
463▕ $this->error("WARNING: Exception caught during Authed bind to $username - ".$e->getMessage());
464▕ return false;

1 app/Console/Commands/LdapTroubleshooter.php:481
App\Console\Commands\LdapTroubleshooter::App\Console\Commands{closure}()

2 app/Console/Commands/LdapTroubleshooter.php:440
App\Console\Commands\LdapTroubleshooter::timed_boolean_execute()

"

OS: SLES 15SP6

php -v
PHP 8.2.29 (cli) (built: Jul 10 2025 12:00:00) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.29, Copyright (c) Zend Technologies
with Zend OPcache v8.2.29, Copyright (c), by Zend Technologies

Snip-IT 8.2.1

[mckaygerhard]

You pointed

We are using private certificates for ldaps which seems to make some trouble.

can you @peko-hki can try wiout certificate to confirm that? i guess others already trying and got sucess with private own made certificates

[peko-hki]

We did not configured any certificate in the ldap settings of snip-it. The ldapserver supports ldap and ldaps, but sometimes
authentication always switches to ldaps or at least starttls.
On the server we can not remove or disable the certificate (eDirectory).
Maybe this output will help:

sudo -u wwwrun php artisan ldap:troubleshoot

WARNING: This command will make several attempts to connect to your LDAP server. Are you sure this is ok? (yes/no) [no]:

yes

STAGE 1: Checking settings
Determined LDAP hostname to be: orla.hki-jena.de
Performing DNS lookup of: orla.hki-jena.de
WARNING: Using an RFC1918 Private address for LDAP server. This may be correct, but it can be a problem if your Snipe-IT instance is not hosted on your private network
STAGE 2: Checking basic network connectivity
Attempting to connect to port: 389 - may take up to 30 seconds
Success!
Attempting to connect to port: 636 - may take up to 30 seconds
Success!
STAGE 3: Determine encryption algorithm, if any
Trying TLS first for port 389
WARNING: Unable to execute POSIX fork() commands, timeout may not be respected
gonna try to bind now, this can take a while if we mess it up
WARNING: Exception caught during bind - ldap_bind(): Unable to bind to server: Can't contact LDAP server
WARNING: Failed to bind to ldaps://orla.hki-jena.de:389 - trying without certificate checks.
WARNING: Unable to execute POSIX fork() commands, timeout may not be respected
gonna try to bind now, this can take a while if we mess it up
WARNING: Exception caught during bind - ldap_bind(): Unable to bind to server: Can't contact LDAP server
WARNING: Failed to bind to ldaps://orla.hki-jena.de:389 with certificate checks disabled. Trying unencrypted with STARTTLS
WARNING: Unable to execute POSIX fork() commands, timeout may not be respected
WARNING: Exception caught during bind - ldap_start_tls(): Unable to start TLS: Connect error
WARNING: Failed to bind to ldap://orla.hki-jena.de:389 with STARTTLS enabled. Trying without STARTTLS
WARNING: Unable to execute POSIX fork() commands, timeout may not be respected
gonna try to bind now, this can take a while if we mess it up
Bind results are: 1 which translate into boolean: 1
Plain connection to ldap://orla.hki-jena.de:389 succesful!
Trying TLS first for port 636
WARNING: Unable to execute POSIX fork() commands, timeout may not be respected
gonna try to bind now, this can take a while if we mess it up
WARNING: Exception caught during bind - ldap_bind(): Unable to bind to server: Can't contact LDAP server
WARNING: Failed to bind to ldaps://orla.hki-jena.de:636 - trying without certificate checks.
WARNING: Unable to execute POSIX fork() commands, timeout may not be respected
gonna try to bind now, this can take a while if we mess it up
WARNING: Exception caught during bind - ldap_bind(): Unable to bind to server: Can't contact LDAP server
WARNING: Failed to bind to ldaps://orla.hki-jena.de:636 with certificate checks disabled. Trying unencrypted with STARTTLS
WARNING: Unable to execute POSIX fork() commands, timeout may not be respected
WARNING: Exception caught during bind - ldap_start_tls(): Unable to start TLS: Can't contact LDAP server
WARNING: Failed to bind to ldap://orla.hki-jena.de:636 with STARTTLS enabled. Trying without STARTTLS
WARNING: Unable to execute POSIX fork() commands, timeout may not be respected
gonna try to bind now, this can take a while if we mess it up
WARNING: Exception caught during bind - ldap_bind(): Unable to bind to server: Can't contact LDAP server
WARNING: Failed to bind to ldap://orla.hki-jena.de:636. Giving up on port 636
Found working LDAP URL's:
LDAP URL: ldap://orla.hki-jena.de:389
ldap://orla.hki-jena.de:389 certificate checks enabled STARTTLS Disabled
+-----------------------------+----------------------+-------------------+
| URL | Cert Checks Enabled? | STARTTLS Enabled? |
+-----------------------------+----------------------+-------------------+
| ldap://orla.hki-jena.de:389 | YES | no |
+-----------------------------+----------------------+-------------------+
STAGE 4: Test Administrative Bind for LDAP Sync
WARNING: Unable to execute POSIX fork() commands, timeout may not be respected
SUCCESS - Able to bind to ldap://orla.hki-jena.de:389 as cn=ldapzeus,o=HKI
STAGE 5: Test BaseDN
WARNING: Unable to execute POSIX fork() commands, timeout may not be respected
SUCCESS - Able to bind to ldap://orla.hki-jena.de:389 as cn=ldapzeus,o=HKI
Array
(
[0] => Array
(
[subschemasubentry] => cn=schema
[supportedgroupingtypes] => 2.16.840.1.113719.1.27.103.8
[namingcontexts] => Array
(
[0] =>
[1] => o=HKI
)

        [altserver] => Array
            (
                [0] => ldap://10.16.1.10:389/
                [1] => ldaps://10.16.1.10:636/
                [2] => ldap://10.16.1.19:389/
                [3] => ldaps://10.16.1.19:636/
                [4] => ldap://10.16.1.10:389/o=HKI
                [5] => ldaps://10.16.1.10:636/o=HKI
                [6] => ldap://10.16.1.19:389/o=HKI
                [7] => ldaps://10.16.1.19:636/o=HKI
            )

        [supportedextension] => Array
            (
                [0] => 2.16.840.1.113719.1.27.100.113
                [1] => 2.16.840.1.113719.1.27.100.115
                [2] => 2.16.840.1.113719.1.27.100.117
                [3] => 2.16.840.1.113719.1.27.100.119
                [4] => 2.16.840.1.113719.1.27.100.121
                [5] => 2.16.840.1.113719.1.27.100.1
                [6] => 2.16.840.1.113719.1.27.100.3
                [7] => 2.16.840.1.113719.1.27.100.5
                [8] => 2.16.840.1.113719.1.27.100.7
                [9] => 2.16.840.1.113719.1.27.100.11
                [10] => 2.16.840.1.113719.1.27.100.13
                [11] => 2.16.840.1.113719.1.27.100.15
                [12] => 2.16.840.1.113719.1.27.100.17
                [13] => 2.16.840.1.113719.1.27.100.19
                [14] => 2.16.840.1.113719.1.27.100.21
                [15] => 2.16.840.1.113719.1.27.100.23
                [16] => 2.16.840.1.113719.1.27.100.25
                [17] => 2.16.840.1.113719.1.27.100.27
                [18] => 2.16.840.1.113719.1.27.100.29
                [19] => 2.16.840.1.113719.1.27.100.31
                [20] => 2.16.840.1.113719.1.27.100.33
                [21] => 2.16.840.1.113719.1.27.100.35
                [22] => 2.16.840.1.113719.1.27.100.37
                [23] => 2.16.840.1.113719.1.27.100.39
                [24] => 2.16.840.1.113719.1.27.100.41
                [25] => 2.16.840.1.113719.1.27.100.96
                [26] => 2.16.840.1.113719.1.27.100.98
                [27] => 2.16.840.1.113719.1.27.100.101
                [28] => 2.16.840.1.113719.1.27.100.103
                [29] => 2.16.840.1.113719.1.27.100.105
                [30] => 2.16.840.1.113719.1.27.100.107
                [31] => 2.16.840.1.113719.1.27.100.109
                [32] => 2.16.840.1.113719.1.27.100.111
                [33] => 2.16.840.1.113719.1.39.42.100.1
                [34] => 2.16.840.1.113719.1.39.42.100.3
                [35] => 2.16.840.1.113719.1.39.42.100.5
                [36] => 2.16.840.1.113719.1.39.42.100.7
                [37] => 2.16.840.1.113719.1.39.42.100.9
                [38] => 2.16.840.1.113719.1.39.42.100.11
                [39] => 2.16.840.1.113719.1.39.42.100.13
                [40] => 2.16.840.1.113719.1.39.42.100.15
                [41] => 2.16.840.1.113719.1.39.42.100.17
                [42] => 2.16.840.1.113719.1.39.42.100.19
                [43] => 2.16.840.1.113719.1.39.42.100.21
                [44] => 2.16.840.1.113719.1.39.42.100.23
                [45] => 2.16.840.1.113719.1.39.42.100.25
                [46] => 2.16.840.1.113719.1.39.42.100.27
                [47] => 1.3.6.1.4.1.4203.1.11.1
                [48] => 2.16.840.1.113719.1.39.42.100.29
                [49] => 2.16.840.1.113719.1.148.100.1
                [50] => 2.16.840.1.113719.1.148.100.3
                [51] => 2.16.840.1.113719.1.148.100.5
                [52] => 2.16.840.1.113719.1.148.100.7
                [53] => 2.16.840.1.113719.1.148.100.9
                [54] => 2.16.840.1.113719.1.148.100.11
                [55] => 2.16.840.1.113719.1.148.100.13
                [56] => 2.16.840.1.113719.1.148.100.15
                [57] => 2.16.840.1.113719.1.148.100.17
                [58] => 2.16.840.1.113719.1.142.100.1
                [59] => 2.16.840.1.113719.1.142.100.4
                [60] => 2.16.840.1.113719.1.142.100.6
                [61] => 2.16.840.1.113719.1.27.100.9
                [62] => 2.16.840.1.113719.1.27.100.43
                [63] => 2.16.840.1.113719.1.27.100.45
                [64] => 2.16.840.1.113719.1.27.100.47
                [65] => 2.16.840.1.113719.1.27.100.49
                [66] => 2.16.840.1.113719.1.27.100.51
                [67] => 2.16.840.1.113719.1.27.100.53
                [68] => 2.16.840.1.113719.1.27.100.55
                [69] => 1.3.6.1.4.1.1466.20037
                [70] => 2.16.840.1.113719.1.27.100.79
                [71] => 2.16.840.1.113719.1.27.100.84
                [72] => 2.16.840.1.113719.1.27.103.1
                [73] => 2.16.840.1.113719.1.27.103.2
                [74] => 2.16.840.1.113719.1.27.100.123
            )

        [supportedcontrol] => Array
            (
                [0] => 2.16.840.1.113719.1.27.101.6
                [1] => 2.16.840.1.113719.1.27.101.5
                [2] => 1.2.840.113556.1.4.319
                [3] => 2.16.840.1.113730.3.4.3
                [4] => 2.16.840.1.113730.3.4.2
                [5] => 2.16.840.1.113719.1.27.101.57
                [6] => 2.16.840.1.113719.1.27.103.7
                [7] => 2.16.840.1.113719.1.27.101.40
                [8] => 2.16.840.1.113719.1.27.101.41
                [9] => 1.2.840.113556.1.4.1413
                [10] => 1.2.840.113556.1.4.805
                [11] => 2.16.840.1.113730.3.4.18
                [12] => 1.2.840.113556.1.4.529
            )

        [supportedsaslmechanisms] => Array
            (
                [0] => NMAS_LOGIN
                [1] => EXTERNAL
                [2] => DIGEST-MD5
            )

        [supportedldapversion] => Array
            (
                [0] => 2
                [1] => 3
            )

        [supportedfeatures] => Array
            (
                [0] => 1.3.6.1.4.1.4203.1.5.1
                [1] => 2.16.840.1.113719.1.27.99.1
            )

        [vendorname] => NetIQ Corporation
        [vendorversion] => LDAP Agent for NetIQ eDirectory 9.2.9 (402010.00)
        [dsaname] => cn=orla,ou=SERVER_OES,o=HKI
        [directorytreename] => CAMPUS
        [outbytes] => 18656636334
        [inbytes] => 3004392353
        [repupdatesout] => 0
        [repupdatesin] => 0
        [errors] => 220458
        [securityerrors] => 578
        [chainings] => 4
        [referralsreturned] => 0
        [extendedops] => 1448129
        [abandonops] => 3739
        [wholesubtreesearchops] => 6644184
        [onelevelsearchops] => 35883
        [searchops] => 18590585
        [listops] => 0
        [modifyrdnops] => 0
        [modifyentryops] => 25
        [removeentryops] => 0
        [addentryops] => 0
        [compareops] => 45524
        [readops] => 11910518
        [inops] => 28310407
        [bindsecurityerrors] => 578
        [strongauthbinds] => 4
        [simpleauthbinds] => 3078619
        [unauthbinds] => 2709115
    )

)

I guess we're trying to do the ldap search here, but sometimes it takes too long?
Printing first 10 results:

Error

Cannot use object of type LDAP\Result as array

at app/Console/Commands/LdapTroubleshooter.php:460
456▕ $this->debugout("Base DN is: ".$settings->ldap_basedn." and filter is: ".parenthesized_filter($settings->ldap_filter));
457▕ $search_results = ldap_search($conn, $settings->ldap_basedn, parenthesized_filter($settings->ldap_filter));
458▕ $this->info("Printing first 10 results: ");
459▕ for($i=0;$i<10;$i++) {
➜ 460▕ $this->info($search_results[$i]);
461▕ }
462▕ } catch (\Exception $e) {
463▕ $this->error("WARNING: Exception caught during Authed bind to $username - ".$e->getMessage());
464▕ return false;

1 app/Console/Commands/LdapTroubleshooter.php:481
App\Console\Commands\LdapTroubleshooter::App\Console\Commands{closure}()

2 app/Console/Commands/LdapTroubleshooter.php:440
App\Console\Commands\LdapTroubleshooter::timed_boolean_execute()

[snipe]

Can you upgrade to latest and give it a try? If it still doesn't work, can you try running the LDAP Troubleshooter?