@NCKNE were you able to run that command? trying to see if we can fix the code to simply auto-detect this and disable paging automatically (instead of adding an option) . my understanding is that paging is optional to ldap servers.

That's a great idea! I ran the command but got the following response:

root@ldap-wrapper-r90:~# ldapsearch -x -s base -b "" supportedControl -H ldap://localhost:13389
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: supportedControl 
#

# domain.de
dn: dc=domain,dc=de

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

paged: true

to

paged: false

in

/home/yellowtent/box/src/externalldap.js

Makes LDAP Sync work. Maybe adding a GUI option for paging in the LDAP sync configuration settings would be a good idea?

2025-02-25T07:37:57.542Z box:taskworker Starting task 10372. Logs are at /home/yellowtent/platformdata/logs/tasks/10372.log
2025-02-25T07:37:57.566Z box:taskworker Running task of type syncExternalLdap
2025-02-25T07:37:57.566Z box:tasks update 10372: {"percent":10,"message":"Starting ldap user sync"}
2025-02-25T07:37:59.860Z box:taskworker Task took 2.366 seconds
2025-02-25T07:37:59.860Z box:tasks setCompleted - 10372: {"result":null,"error":{"stack":"BoxError: missing paged control\n    at SearchPager.<anonymous> (/home/yellowtent/box/src/externalldap.js:162:48)\n    at SearchPager.emit (node:events:519:28)\n    at SearchPager.emit (/home/yellowtent/box/node_modules/ldapjs/lib/corked_emitter.js:44:33)\n    at SearchPager._onEnd (/home/yellowtent/box/node_modules/ldapjs/lib/client/search_pager.js:103:12)\n    at EventEmitter.emit (node:events:519:28)\n    at sendResult (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:1194:22)\n    at messageCallback (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:1222:16)\n    at Parser.onMessage (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:888:14)\n    at Parser.emit (node:events:519:28)\n    at Parser.write (/home/yellowtent/box/node_modules/ldapjs/lib/messages/parser.js:107:8)","name":"BoxError","reason":"External Error","details":{},"message":"missing paged control","nestedError":{"stack":"PagedError: missing paged control\n    at SearchPager._onEnd (/home/yellowtent/box/node_modules/ldapjs/lib/client/search_pager.js:93:17)\n    at EventEmitter.emit (node:events:519:28)\n    at sendResult (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:1194:22)\n    at messageCallback (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:1222:16)\n    at Parser.onMessage (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:888:14)\n    at Parser.emit (node:events:519:28)\n    at Parser.write (/home/yellowtent/box/node_modules/ldapjs/lib/messages/parser.js:107:8)\n    at end (/home/yellowtent/box/node_modules/ldapjs/lib/messages/parser.js:62:36)\n    at Parser.write (/home/yellowtent/box/node_modules/ldapjs/lib/messages/parser.js:108:10)\n    at Socket.onData (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:875:22)","name":"PagedError","message":"missing paged control"}}}
2025-02-25T07:37:59.861Z box:tasks update 10372: {"percent":100,"result":null,"error":{"stack":"BoxError: missing paged control\n    at SearchPager.<anonymous> (/home/yellowtent/box/src/externalldap.js:162:48)\n    at SearchPager.emit (node:events:519:28)\n    at SearchPager.emit (/home/yellowtent/box/node_modules/ldapjs/lib/corked_emitter.js:44:33)\n    at SearchPager._onEnd (/home/yellowtent/box/node_modules/ldapjs/lib/client/search_pager.js:103:12)\n    at EventEmitter.emit (node:events:519:28)\n    at sendResult (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:1194:22)\n    at messageCallback (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:1222:16)\n    at Parser.onMessage (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:888:14)\n    at Parser.emit (node:events:519:28)\n    at Parser.write (/home/yellowtent/box/node_modules/ldapjs/lib/messages/parser.js:107:8)","name":"BoxError","reason":"External Error","details":{},"message":"missing paged control","nestedError":{"stack":"PagedError: missing paged control\n    at SearchPager._onEnd (/home/yellowtent/box/node_modules/ldapjs/lib/client/search_pager.js:93:17)\n    at EventEmitter.emit (node:events:519:28)\n    at sendResult (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:1194:22)\n    at messageCallback (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:1222:16)\n    at Parser.onMessage (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:888:14)\n    at Parser.emit (node:events:519:28)\n    at Parser.write (/home/yellowtent/box/node_modules/ldapjs/lib/messages/parser.js:107:8)\n    at end (/home/yellowtent/box/node_modules/ldapjs/lib/messages/parser.js:62:36)\n    at Parser.write (/home/yellowtent/box/node_modules/ldapjs/lib/messages/parser.js:108:10)\n    at Socket.onData (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:875:22)","name":"PagedError","message":"missing paged control"}}}
BoxError: missing paged control
    at SearchPager.<anonymous> (/home/yellowtent/box/src/externalldap.js:162:48)
    at SearchPager.emit (node:events:519:28)
    at SearchPager.emit (/home/yellowtent/box/node_modules/ldapjs/lib/corked_emitter.js:44:33)
    at SearchPager._onEnd (/home/yellowtent/box/node_modules/ldapjs/lib/client/search_pager.js:103:12)
    at EventEmitter.emit (node:events:519:28)
    at sendResult (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:1194:22)
    at messageCallback (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:1222:16)
    at Parser.onMessage (/home/yellowtent/box/node_modules/ldapjs/lib/client/client.js:888:14)
    at Parser.emit (node:events:519:28)
    at Parser.write (/home/yellowtent/box/node_modules/ldapjs/lib/messages/parser.js:107:8)

The ldapjs server that is being queried logs the following in debug mode:

DEBUG: 2025-02-25T07:37:59.816Z:  %s: sending: %j 1.2.3.4:54938 { status: 0, matchedDN: '', diagnosticMessage: '', referrals: [] }
TRACE: 2025-02-25T07:37:59.883Z:  %s shutdown 1.2.3.4:54938
TRACE: 2025-02-25T07:37:59.884Z:  %s close; had_err=%j 1.2.3.4:54938 false

Could this be related to paging? Can paging be disabled in Cloudron to test if that is the cause?

Cheers

Cheers for the assistance

wget https://raw.githubusercontent.com/glauth/glauth/e7195ed983715383bd5df1dc521f8c17d34d6a50/v2/sample-simple.cfg -O /tmp/ldap.cfg

the releases section has precompiled bins here https://github.com/glauth/glauth/releases/

if using docker
docker run -d --name glauth -p 389:3893 -v /tmp/ldap.cfg:/app/config/config.cfg glauth/glauth-plugins

inside cloudron

Provider: other
Server URL: ldap://127.0.0.1:389
BseDN: dc=glauth,dc=com
Filter: (objectClass=posixAccount)
Username Field: uid
Bind DN: serviceuser,dc=glauth,dc=com | cn=serviceuser,ou=svcaccts,dc=glauth,dc=com # either work
Bind Password: mysecret

save and synchronize

user accounts load into users section correctly. Logging into the accounts produces the following error in glauth:

15:52:23.394913 findUser ▶ WARN 00c  "level"=2 "msg"="BindDN not part of our BaseDN"  "basedn"="dc=glauth,dc=com" "binddn"="johndoe"

pcap:

15:52:23.394496 IP localhost.60316 > localhost.ldap: Flags [P.], seq 1:28, ack 1, win 512, options [nop,nop,TS val 293
1810893 ecr 2931810893], length 27
0x0000:  4500 004f 6b42 4000 4006 d164 7f00 0001  E..OkB@.@..d....
0x0010:  7f00 0001 eb9c 0185 6c39 a418 9a16 2259  ........l9...."Y
0x0020:  8018 0200 fe43 0000 0101 080a aebf e24d  .....C.........M
0x0030:  aebf e24d 3019 0201 0160 1402 0103 0407  ...M0....`......
0x0040:  6a6f 686e 646f 6580 0664 6f67 6f6f 64    johndoe..dogood

ldapsearch -LLL -H ldap://localhost:389 -D serviceuser,dc=glauth,dc=com -w mysecret -x -bdc=glauth,dc=com
succeeds

ldapsearch -LLL -H ldap://localhost:389 -D serviceuser -w mysecret -x -bdc=glauth,dc=com
ldap_bind: Invalid credentials (49)

ldapsearch -LLL -H ldap://localhost:3893 -D johndoe,dc=glauth,dc=com -w dogood -x -bdc=glauth,dc=com '(objectClass=posixAccount)'
succeeds if I add

[[users.capabilities]]
    action = "search"
    object = "*"

but I still get

ldapsearch -LLL -H ldap://localhost:389 -D johndoe -w dogood -x -bdc=glauth,dc=com '(objectClass=posixAccount)'
ldap_bind: Invalid credentials (49)

What Im looking at is potentially adding an External Directory Provider that simply appends "dc=glauth,dc=com" to the result of the search prior to the bind.

ie: johndoe@dc=glauth,dc=com or johndoe@glauth.com rather than just johndoe

The baseDN is only used for searching and not for auth.

However, Im having a bit of a time trying to get the LDAP authentication to succeed. It works for the user I specify as the BindDN/username portion of the Connect to External Directory when this user is in the form of user@domain.tld. The search succeeds and returns the user account for testing authentication but the subsequent bind to validate authentication fails as I cannot specify user@domain.tld but instead it attempts to authenticate as just user.

On the glauth side it fails as its looking for the the BindDN to contain the BaseDN string. Is the BaseDN field in the LDAP authentication getting applied because it appears it is not when looking at /home/yellowtent/box/src/externalldap.js.

Is there anyway to append the BaseDn to the BindDn in these cases?

138: paged: truefalse,
157: paged: truefalse,
178: paged: truefalse,

This produced the results Im looking for. I think ....