User cannot authenticate against LDAP

Resolved neilpryde1984
(@neilpryde1984)

9 years, 7 months ago

Hi there

Today, one of our employees told me, that he cannot login to WordPress. After some testing and debugging we found out, that
– his username is correct
– his password is correct (working when using a LDAP client, Softerra LDAP Browser) and/or logging in to his client
– LDAP connection is ok (no other user has problems)

– his password contains several special cahracters (at least one of +”*ç%&/()=?).

May it be possible, that the quotation marks in a password can cause problems?

Setup:
WP 4.6.1
Authorizer 2.6.3
LDAP connection as authentication method

any help is welcome

Best Regards
Nick

Viewing 7 replies - 1 through 7 (of 7 total)

Thread Starter neilpryde1984
(@neilpryde1984)

9 years, 7 months ago

Ok some more information:

It seems, that the double quotes causes the error. Passes without are working well.

I tried sucessfully a local user (no authorizer involved) wit and without double quotes in the pass.

So it seems that it is a problem of the authorizer plugin an the interface to the wordpress login function.

Plugin Author Paul Ryan
(@figureone)

9 years, 7 months ago

Thanks, I’ll investigate to see where the quotation mark character is causing problems (either on the PHP side or the LDAP server). Which LDAP server are you using?

Thread Starter neilpryde1984
(@neilpryde1984)

9 years, 7 months ago

Hi Paul

Thanks for investigating.
It’s a Microsoft AD server but i dont now if it’s 2008 oder 2012 (R2)..

Best Regards
Nick

Plugin Author Paul Ryan
(@figureone)

9 years, 7 months ago

Thanks! I think the problem is at the PHP layer. I found a similar problem that someone else ran into:
https://github.com/thorsten/phpMyFAQ/issues/1114

Can you try editing a line in the Authorizer plugin and let me know if that fixes the problem? If so, I can push out an update that includes the fix.

https://github.com/uhm-coe/authorizer/blob/master/authorizer.php#L1317

Replace:
$result = @ldap_bind( $ldap, $ldap_user_dn, $password );

With:
$result = @ldap_bind( $ldap, $ldap_user_dn, htmlspecialchars_decode( $password ) );

Thread Starter neilpryde1984
(@neilpryde1984)

9 years, 7 months ago

Hi Paul

The fix did not help:

Password = Net”1234

$result = @ldap_bind( $ldap, $ldap_user_dn, htmlspecialchars_decode( $password ) );
var_dump( htmlspecialchars_decode( $password ));
==> string(9) “Net\”1234”
var_dump($result);
==> bool(false)

and the authentication fails :/

Plugin Author Paul Ryan
(@figureone)

9 years, 7 months ago

Hm. Can you try html_entity_decode() instead of htmlspecialchars_decode()? This stackoverflow thread implies that that might work.
http://stackoverflow.com/questions/12858493/php-ldap-bind-fails-when-password-contains-ampersand

Plugin Author Paul Ryan
(@figureone)

9 years ago

This should have been fixed in version 2.6.9:
https://github.com/uhm-coe/authorizer/commit/6ab11ce552dd8921ce471e0f79825df9e87da123

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘User cannot authenticate against LDAP’ is closed to new replies.