Egroupware & active directory Not working

[itdpt]

Hello,

We are new to egroupware and we really want to give it a through try for our environment.

We are facing a problem with AD (&ldap) authentication and login.

We’ve followed the instructions very carefully, every check is fine the software works fine ( with local users ) but we can’t get ads authetication to work

here’s a pic of our config

We’ve tried also ldap config but without success
We’ve also tried " select where you want to store/retrieve user accounts to SQL
We’ve also tried changing the sql encription to md5 and plain

everything looks fine but it’s not working

• The machine on which egroupware is installed is a new clean one with centos 6.6-64
• The ads domain is a separate win2008R2 server in our domain

Can anyone please give us a help with this configuration ?

we’ve already read “almost any” topic regarding this issue and we are really not able to figure out what’s going wrong with it

Thank You !!

[Ralf_Becker_Stylite]

Hi,

Hello,

We are new to egroupware and we really want to give it a through try for our
environment.

We are facing a problem with AD (&ldap) authentication and login.

We’ve followed the instructions very carefully, every check is fine the
software works fine ( with local users ) but we can’t get ads authetication
to work

here’s a pic of our config

http://egroupware.219119.n3.nabble.com/file/n4007104/egrp.jpg
I’ll take your AD domain is either “DOMAIN.COM” or you used that for
illustration only.

It has to be your AD domain, or nothing will work!

We’ve tried also ldap config but without success
We’ve also tried " select where you want to store/retrieve user accounts to
SQL
We’ve also tried changing the sql encription to md5 and plain
Password encryption does NOT matter for AD.

Only thing that will matter: you cant change passwords, if you use no
encryption, but that comes after login.

Using encryption requires a correct certificate setup in your PHP
installation or to switch certificate checks off in your ldap.conf!

everything looks fine but it’s not working

• The machine on which egroupware is installed is a new clean one with
  centos 6.6-64
• The ads domain is a separate win2008R2 server in our domain

Can anyone please give us a help with this configuration ?
Sure, we offer support for our software:

http://www.egroupware.org/en/products-and-prices/egroupware-workshops-and-support-plans.html

We have many customers using Active Directory, Samba 4 or LDAP. I can
assure you it is working.

we’ve already read “almost any” topic regarding this issue and we are really
not able to figure out what’s going wrong with it
Does Apache error-log contains anything, when you try to log in?
Does setup give any error, when you store AD configuration?
Does it say “Accounts exist” above [Create admin account] button?

Ralf

–
Ralf Becker
Director Software Development

Stylite AG

Morschheimer Strasse 15 | Tel. +49 6352 70629 0
D-67292 Kirchheimbolanden | Fax. +49 6352 70629 30

Email: rb@stylite.de

www.stylite.de | www.egroupware.org

Managing Directors: Andre Keller | Ralf Becker | Gudrun Mueller
Chairman of the supervisory board: Prof. Dr. Birger Leon Kropshofer

VAT DE214280951 | Registered HRB 31158 Kaiserslautern Germany

[itdpt]

Hello Ralf !! Thank You for the reply

We have many customers using Active Directory, Samba 4 or LDAP. I can
assure you it is working.

I Know i’ve seen many suxceed in this task so I’m trying to understand what’s going wrong

Does setup give any error, when you store AD configuration?

nope nothing

Does it say “Accounts exist” above [Create admin account] button?

nope nothing

Does Apache error-log contains anything, when you try to log in?

Well it does

and this got me to think about it…Maybe i’m missing something… or got it completely wrong.

• Shouldn’t once configured all the AD users be able to login with the username OR the username@domain based on the preferences used in the "site configuration " tab ? in our case initial.lastname@domain

if i create a user d.duck in AD and set a password, Shouldn’t i be able to login with this user into egroupware ?

• Or Do i need to create the user within egroupware ? if yes isn’t there a way to import them from AD ?

Thank You !!
Cheerios !

[Ralf_Becker_Stylite]

Hi,

We have many customers using Active Directory, Samba 4 or LDAP. I can
assure you it is working.

Yuo i Know i’ve seen many suxceed in this task so I’m trying to understand
what’s going wrong

we’ve already read “almost any” topic regarding this issue and we are
really
not able to figure out what’s going wrong with it
Does Apache error-log contains anything, when you try to log in?

/Does setup give any error, when you store AD configuration? /

nope nothing

/Does it say “Accounts exist” above [Create admin account] button?/

nope nothing
But also no connection error?

Then it could be the context you filled out is wrong, or the domain. You
dont need to fill out the context, it will be automatic detected.

/Does Apache error-log contains anything, when you try to log in? /

Well it does

and this got me to think about it…Maybe i’m missing something… or got
it completely wrong.
What does it say?

• Shouldn’t once configured all the AD users be able to login with the
  username OR the username@domain based on the preferences used in the "site
  configuration " tab ? in our case initial.lastname@domain
  Everyone should be able to log in with his username (samAccountName), do
  NOT add the domain.
  if i create a user d.duck in AD and set a password, Shouldn’t i be able to
  login with this user into egroupware ?
  Yeap.
• Or Do i need to create the user within egroupware ? if yes isn’t there a
  way to import them from AD ?
  No, as you choose to not only authenticate against AD but also use it as
  account-storage, there is nothing you need to do to be able to log in.

What does it say when you try to log in? Unknown user or password

To use EGroupware you need to set ACL to give run rights for
applications. Most easy is to create an admin user in setup. This can
also be an existing AD user. It will create 2 groups “Default” and
"Admins" with typical user and administrator rights.
With that user you can then log into EGroupware or use AD and add all
your AD users to “Default” and your admins to “Admins”.

Ralf

Thank You !!
Cheerios !

–
Ralf Becker
Director Software Development

Stylite AG

Morschheimer Strasse 15 | Tel. +49 6352 70629 0
D-67292 Kirchheimbolanden | Fax. +49 6352 70629 30

Email: rb@stylite.de

www.stylite.de | www.egroupware.org

Managing Directors: Andre Keller | Ralf Becker | Gudrun Mueller
Chairman of the supervisory board: Prof. Dr. Birger Leon Kropshofer

VAT DE214280951 | Registered HRB 31158 Kaiserslautern Germany

[itdpt]

Hello Ralf !

Thanks for the reply

So, this weeekend i got a bit on this and :

this is what is happening :

The AD integration works, but only in this way :

• If i have an existing user in AD, and i create the same user account in EGroupware the thing works and the users are able to autenticate.

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

If i DON’T create the user in Egroupware i get this error in the apavhe error log :

[Mon Apr 27 09:27:44 2015] [error] [client XXX.XXX.XXX.XXX] auth_ads::authenticate(‘XXX@MYEMAILDOMAIN’, $passwd) adldap->authenticate() returned false --> returning false, referer: http://egroupware/egroupware/login.php?phpgw_forward=%2Findex.php

[Mon Apr 27 09:27:52 2015] [error] [client XXX.XXX.XXX.XXX] auth_ads::authenticate(‘XXXXX’) authenticated, but user NOT found!, referer: http://egroupware/egroupware/login.php?cd=5

and on the web interface the user gets

Bad login or password

if i modify the field Auto create account records for authenticated users: to yes

the error becomes :

[Mon Apr 27 09:27:52 2015] [error] [client XXX.XXX.XXX.XXX] auth_ads::authenticate(‘XXXXX’) authenticated, but user NOT found!, referer: http://egroupware/egroupware/login.php?cd=5

but the first refeering to the email like above is not showing

The fields

• Select which type os authentication you are using
• Select where you want to store/retrieve user passwords

are both set to AD

so i think something in our config is missing.

I was thinking in the “mail Domain” I’ve inserted our mail domain which differs (obviously) form our local domain … is this field in some way responsible for the first login attempt ? where i can read authenticate(‘XXX@MYEMAILDOMAIN’

What am i missing ?

Thank You very Much for your help

Cheers

[Ralf_Becker_Stylite]

Hi,

Hello Ralf !

Thanks for the reply

So, this weeekend i got a bit on this and :

this is what is happening :

The AD integration works, but only in this way :

• If i have an existing user in AD, and i create the same user account in
  EGroupware the thing works and the users are able to autenticate.
  That means EGroupware can not find the user in AD, after he
  authenticated successfull.

Try it with an empty user context, so EGroupware searches the complete tree.

Given you authenticate AND store accounts in AD, then auto-creating
accounts does NOT matter, nor do you need to create accounts, as
EGroupware uses AD to store/retrieve accounts.

Ralf

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

If i DON’T create the user in Egroupware i get this error in the apavhe
error log :

/[Mon Apr 27 09:27:44 2015] [error] [client XXX.XXX.XXX.XXX]
auth_ads::authenticate(‘XXX@MYEMAILDOMAIN’, $passwd) adldap->authenticate()
returned false --> returning false, referer:
http://egroupware/egroupware/login.php?phpgw_forward=%2Findex.php

[Mon Apr 27 09:27:52 2015] [error] [client XXX.XXX.XXX.XXX]
auth_ads::authenticate(‘XXXXX’) authenticated, but user NOT found!, referer:
http://egroupware/egroupware/login.php?cd=5/

and on the web interface the user gets

Bad login or password

if i modify the field /Auto create account records for authenticated users:/
to yes

the error becomes :

[Mon Apr 27 09:27:52 2015] [error] [client XXX.XXX.XXX.XXX]
auth_ads::authenticate(‘XXXXX’) authenticated, but user NOT found!, referer:
http://egroupware/egroupware/login.php?cd=5/

but the first refeering to the email like above is not showing

The fields

• Select which type os authentication you are using
• Select where you want to store/retrieve user passwords

are both set to AD

so i think something in our config is missing.

I was thinking in the “mail Domain” I’ve inserted our mail domain which
differs (obviously) form our local domain … is this field in some way
responsible for the first login attempt ? where i can read
/authenticate(‘XXX@MYEMAILDOMAIN’/

What am i missing ?

Thank You very Much for your help

Cheers

–
View this message in context: http://egroupware.219119.n3.nabble.com/Egroupware-active-directory-Not-working-tp4007104p4007136.html
Sent from the egroupware-users mailing list archive at Nabble.com.

---

One dashboard for servers and applications across Physical-Virtual-Cloud
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y

---

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

–
Ralf Becker
Director Software Development

Stylite AG

Morschheimer Strasse 15 | Tel. +49 6352 70629 0
D-67292 Kirchheimbolanden | Fax. +49 6352 70629 30

Email: rb@stylite.de

www.stylite.de | www.egroupware.org

Managing Directors: Andre Keller | Ralf Becker | Gudrun Mueller
Chairman of the supervisory board: Prof. Dr. Birger Leon Kropshofer

VAT DE214280951 | Registered HRB 31158 Kaiserslautern Germany

[Mgr_Peter_Tuharsky_M]

Hi,

after the recent upgrade of EGW 14.2 CE, I am unable to create a new
Infolog entry. The Infolog is no longer listed in the general EGW
"ADD" (plus) button. Attempt to create entry using the "Add Task"
button from within Infolog leads to this error:

egw.open() app “infolog” NOT defined in link registry!

Does anybody else have this problem?

Peter

---

One dashboard for servers and applications across Physical-Virtual-Cloud
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y

---

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

[ilserver]

Hi,
I have got same problem: My fresh egw 14.2 CE don’t work using AD authentication.
Only difference is that I choose to store accounts into SQL db. But nothing change if I change to use AD repository.

Plus I can’t see any error in the apache’s error log.

My question is if there is some other logs that I can read to see what it’s going on…
I can’t find any egw error log but apache error logs.

Is there a way to set up more informational logging system??

Thanks for help me!

[ilserver]

Solved.
For me it was sufficent a machine reboot after setted up AD auth with Account stored on SQL