Single ldap user = Authentication rejected

Keeebs

Yes, the username and password are 100% correct.
Yes, the user can logon outside of grommunio.
Yes, other ldap users can logon to grommunio.
Yes, I can successfully sync this user.
The problem is just with this one user.

Any ideas? All I see in the logs for gromox-zcore is authentication rejected.

Thank you.

WalterH

Keeebs Hi, on console, runjournalctl -f and report the errors you see on login.
Question, do this user have an German Umlaut in password?

ckd

Please paste us the contents of /etc/gromox/ldap_adaptor.cfg. Make sure to comment out any passwords or domain related information you don't want to disclose. 🙂

Keeebs

Configuration automatically generated by grommunio-admin.

ldap_disabled=False
ldap_host=ldap://<ip>:389/
ldap_bind_user=CN=<username>,OU=<OU>,DC=<sub>,DC=<domain>,DC=<ext>
ldap_bind_pass=<password>
ldap_start_tls=False
ldap_search_base=OU=<OU>,DC=<sub>,DC=<domain>,DC=<ext>
ldap_object_id=objectGUID
ldap_mail_attr=mail
ldap_user_displayname=displayName
ldap_user_filter=(objectClass=user)
ldap_contact_filter=objectclass=contact
ldap_user_search_attrs=mail
ldap_user_search_attrs=givenName
ldap_user_search_attrs=cn
ldap_user_search_attrs=sn
ldap_user_search_attrs=name
ldap_user_search_attrs=displayName
ldap_user_templates=common
ldap_user_templates=ActiveDirectory
ldap_user_aliases=proxyAddresses
ldap_group_addr=mail
ldap_group_filter=(objectclass=group)
ldap_group_name=cn
ldap_group_memberof=memberOf

ckd

Could you please confirm, that you didn't exceed the license limit of maximum allowed users?

Keeebs

Only 3 users are sync'd

ckd

Could you please double check, whether the mail attribute contains a valid e-mail address and perhaps set a new temporary password? It has happened to me before, that I had a typo in the mail address / login name or forgot to the set the expected password. Don't forget to sync after.

Keeebs

mail does contain a valid email address and there have been no configuration changes since it was working last.
I tried resetting the password and resyncing several times as well.
still no... 🙁

ckd

Try to logon to Active Directory from Shell using ldapsearch.

ldapsearch -x -D "<user>@ads.domain.tld" -b "ou=<ou containing that user>,dc=ads,dc=domains,dc=tld" -H ldap://<AD server name>.ads.domain.tld:389/ -W sAMAccountName=<user>

Test for both, the bind user and the user not working. Both should give back the same result.

Example:
https://community.grommunio.com/d/1558-active-directory-ldap-sync-with-starttls-not-working/4

Keeebs

typo disregard

Keeebs

I get a complete result for both

ckd

Strange! Try deleting the user in Grommunio Admin and resync / Import User.

Keeebs

Delete or detach? zi don't see a delete option?

ckd

Go to Users and click the red bin icon on the right side next to that user. Just confirm deletion, do not check anything. Now re-import it and try to login again.

Keeebs

I'm starting to feel pretty dumb today.... There are no red trash cans in the user menu!?!?
nevermind - had top use a bigger screen....

Keeebs

it's not finding the deleted user user when I resync...

Keeebs

I tried deleting a second user and now sync says 0/1 sync'd. 1 error.
Sync is ignoring 2 users now.
no errors show under journalctl -f
no German Umlaut in password.
This is an appliance install

Reboot and sync = 1 sync'd successfully
import added bad the users deleted
login still fails

WalterH

Keeebs Which program: Outlook or G-WEB do have this issue?

Keeebs

I'm only trying the grommunio web at the moment

Keeebs

Both users that I deleted and restored cannot login

crpb

Keeebs Both users that I deleted and restored cannot login

you have to do some shenanigans in those scenarios. or how di you du that exactly?
https://docs.grommunio.com/man/gromox-mbop.8.html