LDAP authentication not working

[skeet16]

I've enabled LDAP authentication and am providing my .env below.

# -- NGINX
NGINX_IMAGE_NAME=ghcr.io/dfir-iris/iriswebapp_nginx
NGINX_IMAGE_TAG=latest

SERVER_NAME=iris.app.dev
KEY_FILENAME=iris_dev_key.pem
CERT_FILENAME=iris_dev_cert.pem

# -- DATABASE
DB_IMAGE_NAME=ghcr.io/dfir-iris/iriswebapp_db
DB_IMAGE_TAG=latest

POSTGRES_USER=********
POSTGRES_PASSWORD=********
POSTGRES_ADMIN_USER=********
POSTGRES_ADMIN_PASSWORD=********
POSTGRES_DB=********

POSTGRES_SERVER=db
POSTGRES_PORT=5432

# -- IRIS
APP_IMAGE_NAME=ghcr.io/dfir-iris/iriswebapp_app
APP_IMAGE_TAG=latest

DOCKERIZED=1

IRIS_SECRET_KEY=********
IRIS_SECURITY_PASSWORD_SALT=********
IRIS_UPSTREAM_SERVER=app
IRIS_UPSTREAM_PORT=8000

# -- WORKER
CELERY_BROKER=amqp://rabbitmq

# -- AUTH
#IRIS_AUTHENTICATION_TYPE=local
## optional
#IRIS_ADM_PASSWORD=********
#IRIS_ADM_API_KEY=********
#IRIS_ADM_EMAIL=********
#IRIS_ADM_USERNAME=administrator
# requests the just-in-time creation of users with ldap authentification (see https://github.com/dfir-iris/iris-web/issues/203)
IRIS_AUTHENTICATION_CREATE_USER_IF_NOT_EXIST=True
# the group to which newly created users are initially added, default value is Analysts
#IRIS_NEW_USERS_DEFAULT_GROUP=Analysts

# -- FOR LDAP AUTHENTICATION
IRIS_AUTHENTICATION_TYPE=ldap
LDAP_SERVER=********
LDAP_AUTHENTICATION_TYPE=SIMPLE
LDAP_PORT=********
LDAP_USER_PREFIX=uid=
LDAP_USER_SUFFIX=ou=users,dc=example,dc=com
LDAP_USE_SSL=False
# base DN in which to search for users
LDAP_SEARCH_DN=cn=admin,dc=example,dc=com
# unique identifier to search the user
LDAP_ATTRIBUTE_IDENTIFIER=cn
# name of the attribute to retrieve the user's display name
LDAP_ATTRIBUTE_DISPLAY_NAME=displayName
# name of the attribute to retrieve the user's email address
LDAP_ATTRIBUTE_MAIL=mail
#LDAP_VALIDATE_CERTIFICATE=False
#LDAP_TLS_VERSION=1.2
#LDAP_SERVER_CERTIFICATE=
#LDAP_PRIVATE_KEY=
#LDAP_PRIVATE_KEY_PASSWORD=

# -- LISTENING PORT
INTERFACE_HTTPS_PORT=8081

# -- FOR OIDC AUTHENTICATION
#IRIS_AUTHENTICATION_TYPE=oidc
#OIDC_ISSUER_URL=
#OIDC_CLIENT_ID=
#OIDC_CLIENT_SECRET=
# endpoints only required if provider doesn't support metadata discovery
#OIDC_AUTH_ENDPOINT=
#OIDC_TOKEN_ENDPOINT=
# optional to include logout from oidc provider
#OIDC_END_SESSION_ENDPOINT=

When trying to login to a user in LDAP, I receive the error shown below. I've enabled the IRIS_AUTHENTICATION_CREATE_USER_IF_NOT_EXIST=True.

2024-12-23 08:48:34 :: ERROR :: login_routes :: _validate_ldap_login :: list index out of range

Can anyone help me with this?

[whikernel]

Hi @skeet16

IRIS uses direct binding and not an account to bind, so the following is not interpreter by IRIS

# base DN in which to search for users
LDAP_SEARCH_DN=cn=admin,dc=example,dc=com
# unique identifier to search the user
LDAP_ATTRIBUTE_IDENTIFIER=cn
# name of the attribute to retrieve the user's display name
LDAP_ATTRIBUTE_DISPLAY_NAME=displayName
# name of the attribute to retrieve the user's email address
LDAP_ATTRIBUTE_MAIL=mail

Are you using an Active Directory env or is this a raw LDAP server?

[skeet16]

I'm using a raw LDAP server which I'm hosting in my local environment

[mogilaad]

Hi, I have a similar problem. I can't set up binding to LDAP.
If I make the following settings:

-- FOR LDAP AUTHENTICATION

IRIS_AUTHENTICATION_TYPE=ldap
LDAP_SERVER=192.168.1.5
LDAP_AUTHENTICATION_TYPE=simple
LDAP_PORT=389
LDAP_USER_PREFIX= USER ID=
LDAP_USER_SUFFIX=ou=Avr,dc=avr,dc=com
LDAP_USE_SSL=False

basic user ID for user search

#LDAP_SEARCH_DN=division=users,dc=example,dc=organization

unique identifier for user search

#LDAP_ATTRIBUTE_IDENTIFIER=cn

name of the attribute for getting the user's display name

#LDAP_ATTRIBUTE_DISPLAY_NAME=Display Name

the name of the attribute for getting the user's email address

#LDAP_ATTRIBUTE_MAIL=mail
#LDAP_VALIDATE_CERTIFICATE=True
#LDAP_TLS_VERSION=1.2
#LDAP_SERVER_CERTIFICATE=
#LDAP_PRIVATE_KEY=
#LDAP_PRIVATE_KEY_ PASSWORD=

then I get a docker error iriswebapp_worker | IRISwebapp is unavailable - sleeping