<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Consolas",serif;}
span.EmailStyle23
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thank you, that fixed it.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I was using multi to test if it was failing on any auth or just failing on just AD auth.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I was surprised aswell, seems like that kind of thing that would be more widespread/reported by now indeed.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I did find the settings to get the AD connections working at all to be somewhat different from those documented in the preference file/we weren’t forced to ldaps:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="mso-fareast-language:EN-US">‘authLDAPServers1’ => array (‘<the dc host name, with nod ldap or ldaps prefix>’).<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="mso-fareast-language:EN-US">‘authLDAPUseSSL1’ = > false<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="mso-fareast-language:EN-US">‘authLDAPUseTLS1’ => false<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="mso-fareast-language:EN-US">‘authLDAPBindUser1’ => ‘ <the full distinguished name of the service account to bind to>’<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="mso-fareast-language:EN-US">‘authLDAPUsernameAttribute1’ => ‘sAMAccountName’<o:p></o:p></span></p>
<p class="MsoNormal" style="text-indent:36.0pt"><span style="mso-fareast-language:EN-US">The domain controller is running windows server 2019.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Maybe some part of that config just doesn’t ‘play nicely’?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Yes, I know we should get the certs/tls playing nicely, but we were having issues with them and we needed to have a working demo together.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Cheers for the fix, and Merry Christmas (or your regional /personal equivalent).
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Kind regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Bailey <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Jules <Jules@Zend.To>
<br>
<b>Sent:</b> 14 December 2020 17:59<br>
<b>To:</b> ZendTo Users <zendto@zend.to><br>
<b>Cc:</b> Bailey Coole <Bailey.Coole@outlook.com><br>
<b>Subject:</b> Re: [ZendTo] 500 server error on successful AD authentication<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Bailey,<br>
<br>
Bother, thumped Send by mistake.<br>
<br>
Bar a bit of formatting, that actually does contain the change I want you to try making.<br>
<br>
BTW Why are you using the "Multi" authenticator? Can't you just do it all with AD? It's simpler to administer (in years time, after you've left the organisation) if all the users come from the same place.<br>
<br>
Cheers,<br>
Jules.<o:p></o:p></p>
<div>
<p class="MsoNormal">On Mon 14/12/20 09:56, Julian Field via ZendTo wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:12.0pt">Bailey,<br>
<br>
Interesting one, slightly surprised that (a) it causes an error in your case, and that (b) in that case, no one has seen it before.<br>
<br>
Edit /opt/zendto/lib/NSSADAuthenticator.php and change line 658<br>
from<br>
<tt><span style="font-size:10.0pt"> if ( @$value['count'] >= 1 ) {</span></tt><br>
to<br>
if ( is_array($value) && @$value['count'] >= 1 ) {<br>
<br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal">On Fri 11/12/20 23:47, Bailey Coole via ZendTo wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">We're running 6.05-4 on CentOS 8.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">If an AD user successfully authenticates, they get a 500-server error. </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">If an AD user inputs an incorrect password, they are warned that "The username or password was incorrect" (as expected).</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">If a local (i.e., admin) user authenticates, everything 'works' properly. </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I don't *think* this is an issue with the ldap/AD config as ldapsearch with the same inputs returns all the expected users and the same settings (different bind account) are in use elsewhere in our infrastructure. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Nothing showing in the apache logs, but there is a Fatal error in the php log:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">[11-Dec-2020 17:45:36 Australia/Perth] PHP Warning: Attempt to read property "value" on null in /var/zendto/templates_c/9da848d4b67ceaa147b62c8524dedce691bc7ce2_0.file.header.tpl.cache.php on line 424
<o:p></o:p></p>
<div>
<p class="MsoNormal">[11-Dec-2020 17:45:42 Australia/Perth] PHP Fatal error: Uncaught TypeError: Cannot access offset of type string on string in /opt/zendto/lib/NSSADAuthenticator.php:658<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Stack trace:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">#0 /opt/zendto/lib/NSSADAuthenticator.php(485): NSSADAuthenticator->Tryauthenticate()<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">#1 /opt/zendto/lib/NSSMultiAuthenticator.php(154): NSSADAuthenticator->authenticate()<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">#2 /opt/zendto/lib/NSSDropbox.php(2332): NSSMultiAuthenticator->authenticate()<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">#3 /opt/zendto/lib/NSSDropbox.php(620): NSSDropbox->userFromAuthentication()<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">#4 /opt/zendto/www/index.php(35): NSSDropbox->__construct()<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">#5 {main}<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> thrown in /opt/zendto/lib/NSSADAuthenticator.php on line 658<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal">Any ideas on what could be causing this behaviour?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thank you<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>ZendTo mailing list<o:p></o:p></pre>
<pre><a href="mailto:ZendTo@zend.to">ZendTo@zend.to</a><o:p></o:p></pre>
<pre><a href="http://jul.es/mailman/listinfo/zendto">http://jul.es/mailman/listinfo/zendto</a><o:p></o:p></pre>
</blockquote>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<pre>Jules<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-- <o:p></o:p></pre>
<pre>Julian Field MEng CEng CITP MBCS MIEEE MACM<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>'Intelligence is quickness to apprehend as distinct from ability,<o:p></o:p></pre>
<pre> which is capacity to act wisely on the thing apprehended.'<o:p></o:p></pre>
<pre> - Alfred North Whitehead<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><a href="http://www.Zend.To">www.Zend.To</a><o:p></o:p></pre>
<pre>Twitter: @JulesFM<o:p></o:p></pre>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>ZendTo mailing list<o:p></o:p></pre>
<pre><a href="mailto:ZendTo@zend.to">ZendTo@zend.to</a><o:p></o:p></pre>
<pre><a href="http://jul.es/mailman/listinfo/zendto">http://jul.es/mailman/listinfo/zendto</a><o:p></o:p></pre>
</blockquote>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<pre>Jules<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-- <o:p></o:p></pre>
<pre>Julian Field MEng CEng CITP MBCS MIEEE MACM<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>'Think globally, act locally.' - Friends of the Earth<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><a href="http://www.Zend.To">www.Zend.To</a><o:p></o:p></pre>
<pre>Twitter: @JulesFM<o:p></o:p></pre>
</div>
</body>
</html>