Could not bind to LDAP: Strong(er) authentication required

[DeepakSingh04-debug]

Hello,
We configured LDAP for all OUs, but it’s not working. It was working earlier, but now it shows the error: “Could not bind to LDAP: Strong(er) authentication required.”

Attached is a configuration snippet of the LDAP setup.
Kindly review the snippet and advise how to fix this issue so that users can successfully bind to our domain server.

[uberbrady]

Maybe you want to try using ldaps:// instead of ldap:// ? I've definitely seen that before where the directory server wants you to try to connect via ldaps instead of ldap

[snipe]

@DeepakSingh04-debug any luck?

[DeepakSingh04-debug]

Hello Brady,

Thanks for your reply. Where can I update the LDAPS in Snip IT, please guide me.

[snipe]

In the LDAP server field from your screenshot above.

[DeepakSingh04-debug]

I change it, but showing the same error.

[snipe]

Okay, so ldaps won't work.

Might try looking at this article - https://community.fortinet.com/t5/FortiGate/Technical-Tip-LDAP-connection-status-Strong-er-authentication/ta-p/277689

Technical Tip: LDAP connection status 'Strong(er) authentication required'

Description This article describes how to fix the LDAP connection status 'Strong(er) authentication required'.   Under Users & Authentication -> LDAP Servers, 'double-click' on the LDAP server name, and the connection status is shown below:     Based on the logs: 2023-08-14 16:06:10 [987] fnbamd_...

[DeepakSingh04-debug]

Hello,
You shared with me the settings of the Fortigate firewall, but as we have checked, it's working in the firewall and LDAPS configuration and successfully synced. Snippet attached. We also check our server's registry for that option to integrate the LDAPS; it's set up (2).
But in the firewall, it's working fine.
Is it possible we need to change the integrated file in the registry (2) to check LDAPS in SnipIT?

[deathstone]

Hello,

I'm experiencing a similar issue.
I'm using the latest version of Snipe-IT (8.3.1) deployed via Docker.
We have an LDAP over SSL (LDAPS) setup.

When I run the command:

php artisan ldap:troubleshoot

I get the following prompt:

Do you wish to try to authenticate to this directory: ldaps://mydomain:636 without TLS and not using STARTTLS?

And the result is:

SUCCESS - Able to bind to ldaps://mydomain:636 as myuser@mydomain
Success authenticating with myuser@mydomain

However, when I try to configure LDAP through the Snipe-IT web interface, I get the following error:

Could not bind to LDAP: Can't contact LDAP server

[uberbrady]

We've had some trouble in older versions of Snipe-IT around invalid certificates and TLS - you should update to the latest. The LDAP troubleshooter has gotten a little better too.

What's strange is that you're connecting to LDAPS on port 636 (which is good) but not using actual TLS - and not even using STARTTLS. Is it possible your firewall has mapped port 636 to port 389? That would be weird.