Login not possible with new user

Hey there.

This sounds really weird. Can you provide me with the configuration of authLdap and the content of the existing and the new User from the LDAP?

I need to see some more details to figure out why it is working in some cases and not in others…

And does that happen for all new users? Since when is that an issue? Or is that one specific user that has this problem?

Feel free to send the sanitized information directly to authldap AT heigl DOT org if you don’t feel comfortable sharing it here in public.

From what I read from the logs, there is either an issue with finding the new user in the LDAP or with the password of that user.

Thanks for your help in solving that!

Hi Andreas,

thanks for your quick reply and your support! I’m sorry to have bothered you with this as it’s my mistake. Your comment “an issue with finding the new user” pointed me to the solution: some time in the past the underlying LDAP management obviously changed from setting the user supplied e-mail for a new user to “mail” and “mailPrimaryAddress” in the directory to setting it only to “mailPrimaryAddress”. But I had AuthLDAP configured to look into “mail”…

Digging into this with your hints I stumbled upon another thing: a user who has been an author but got this right revoked (and therefore is in no WordPress-related group in LDAP anymore) can still login (this is expected) but continues to have his old rights (which I did not expect, as I’ve set “LDAP Groups override role of existing users?” to yes). I expected the old right/group-membership to get deleted then, resetting the user to “subscriber”?! What is more, the user is recognized as not having an entry in the WP-Database but the creation of said entry fails then as of course the entry is already there?

[30-Jan-2021 09:04:49 UTC] [AuthLDAP] User '[email protected]' logging in
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] about to do LDAP authentication
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] connect to LDAP server
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] LDAP authentication successfull
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] Array
(
    [administrator] => 5078
    [editor] => 5081
    [author] => 5079
    [contributor] => 5080
    [subscriber] => 5083
)

[30-Jan-2021 09:04:49 UTC] [AuthLDAP] Array
(
    [administrator] => 5078
    [editor] => 5081
    [author] => 5079
    [contributor] => 5080
    [subscriber] => 5083
)

[30-Jan-2021 09:04:49 UTC] [AuthLDAP] Group Filter: "(&(objectClass=posixGroup)(uniqueMember=uid=existinguser1,ou=Users,ou=MyOrg,dc=int,dc=my-org,dc=de))"
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] Group Base: 
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] LDAP groups: []
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] Role from LDAP group: 
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] role from group mapping: 
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] no role yet, set default role
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] The LDAP user does not have an entry in the WP-Database, a new WP account will be created
[30-Jan-2021 09:04:49 UTC] [AuthLDAP] Error creating user : Diese E-Mail-Adresse wird bereits verwendet!

What’s the best way to show the configuration of AuthLDAP here for you?

Thanks!

• This reply was modified 3 years, 10 months ago by wpandi.

Hey. Great to hear that that problem was solved ??

Let’s now tackle the other issue ??
The easiest would be to either send some screenshots or the result of `SELECT *
option_value from wp_options WHERE option_name = ‘authLDAPOptions’`

• This reply was modified 3 years, 10 months ago by heiglandreas.

The most interesting question is why the user is identified as not being available within wordpress. Did the username change?

And you were right again!

I mixed the identification of existing users up, I matched the wrong fields. After fixing this (setting the right “User-ID Attribute”) now the user is recognized as “old and existing” on repeated login and the rights revocation via removing the corresponding LDAP group works, too!

Thanks again for patiently pointing me to the right places!

You are welcome. Anything else that needs fixing? ??

Currently not but I will come back to you whenever that should be the case. ??

Thanks a lot! ??