Unable to locate a user without a entryuuid

[travisobregon]

• Laravel Version: 5.8
• Adldap2-Laravel Version: 6.0.2
• PHP Version: 7.1
• LDAP Type: OpenLDAP

Description:

I'm not sure if this issue applies to Active Directory as well, but I am unable to import a user using the console command. This issue is related to #693. I have extended the OpenLDAP schema as you've described, but since the entryuuid exists, I was hoping to avoid having to create another file just for development.

The problem is that the ldap search query used by the import command has the columns set to ['*']. At least with OpenLDAP, the results of the query will not contain the entryuuid, unless you ask for it explicitly it seems. Do you know why this is the case? I've come across articles saying that entryuuid is a virtual attribute, but I am not sure what that means.

I guess if you think this is an issue, a fix would have to go in the Adldap package?

Thanks for your help.

Steps To Reproduce:

1. Try importing a user using the console command or logging in.

[stevebauman]

Hey @travisobregon,

Unfortunately I haven't used OpenLDAP very much, so I don't know why you must specify selecting the entryuuid for LDAP queries. I've also never heard of virtual attributes, so I'm the wrong person to ask for this.

However, if you need to specify select attributes, simply create a scope and call the select method:

Note: Be sure to include all the select attributes you need to synchronize users. Otherwise logging in and importing will fail.

namespace App\Scopes;

use Adldap\Query\Builder;
use Adldap\Laravel\Scopes\ScopeInterface;

class OpenLdapScope implements ScopeInterface
{
    /**
     * Apply the scope to a given LDAP query builder.
     *
     * @param Builder $query
     *
     * @return void
     */
    public function apply(Builder $query)
    {
        $query->select([
            'entryuuid',
            'cn',
            'mail'
        ]);
    }
}

Then, insert the scope into your ldap_auth.php file.

[travisobregon]

Thanks for the help. I only use OpenLDAP for development so I will just extend the OpenLDAP schema as you've suggested here: #693 (comment)

[stevebauman]

No problem @travisobregon! If you need any other help or have questions just give me a shout 😄

[fzoske]

@travisobregon @stevebauman
According to the OpenLDAP documentation 'entryUUID' is a so called 'operational' attribute.
"Operational attributes are attributes used for directory administration, and a directory server only returns them if you request them." https://www.ibm.com/support/knowledgecenter/sr/SSKTMJ_9.0.1/admin/conf_usingldapsearchtoreturnoperationalattributes_t.html

I guess it would be best, to always select the configured "objectGuid" when using OpenLDAP scheme

Best regards,
Fabian

[stevebauman]

Thanks @fzoske! I've re-opened this issue so I know to patch this. Update will be coming shortly!