Authentication failed after upgrade to 24.10.18

Hello,

 This documentation should help you:

Hello Sebastien.

Thank you for the reply.

I can log on with the admin password now, only the ldap authentication is failing.

Have a nice day.

HI ​@OlivierV can you enable LDAP authentication debug through Administration > Parameters > Debug menu.

Try to authenticate using a LDAP account.
Then check LDAP log files in /var/log/centreon/ directory.

Hello ​@lpinsivy 

All the debugging options are enabled. In ldap.log I read :

2026-01-30 11:44:44|0|0|0|LDAP AUTH : CN=xxx,OU=Priviledged Accounts,DC=my,DC=domain :: Authentication in progress
2026-01-30 11:44:44|0|0|0|LDAP AUTH : Success
2026-01-30 11:44:44|0|0|0|LDAP AUTH : Updating user DN of xxx
2026-01-30 11:44:44|0|0|0|LDAP AUTH : Updating user DN of xxx

But the interface still displays the following message (twice)  : an error occured during authentication.

Hi ​@OlivierV which LDAP directory and which version are you using?

Hi ​@lpinsivy 

Windows AD, w2012 forest and domain level.

Note that importing a new ldap user works fine.

How strange : with my ldap admin account the connection fails, but with my ‘normal’ ldap user account it works.

I imported a new ldap account : it doesn’t work.

​@OlivierV Could you please share the latest error from the log file, along with the LDAP configuration?

/var/log/centreon/centAcl.log
mysql centreon -e 'select * from auth_ressource_info' > /tmp/auth_ressource_info.sql

Don't forget to anonymise your information!

​@Sébastien : the last centAcl.log entries :

[2026-01-30 13:16:01] According to DB another instance of centAcl.php is already running and I found 0 process...
Correcting the state in the DB, by setting the `running` value to 0 for id =  1
PHP Warning:  ldap_search(): Search: Bad search filter in /usr/share/centreon/www/class/centreonLDAP.class.php on line 369
PHP Fatal error:  Uncaught TypeError: ldap_get_entries(): Argument #2 ($result) must be of type LDAP\Result, bool given in /usr/share/centreon/www/class/centreonLDAP.class.php:370
Stack trace:
#0 /usr/share/centreon/www/class/centreonLDAP.class.php(370): ldap_get_entries()
#1 /usr/share/centreon/www/class/centreonContactgroup.class.php(442): CentreonLDAP->findGroupDn()
#2 /usr/share/centreon/cron/centAcl.php(137): CentreonContactgroup->syncWithLdap()
#3 {main}
  thrown in /usr/share/centreon/www/class/centreonLDAP.class.php on line 370
[2026-01-30 13:18:01] According to DB another instance of centAcl.php is already running and I found 0 process...
Correcting the state in the DB, by setting the `running` value to 0 for id =  1
PHP Warning:  ldap_search(): Search: Bad search filter in /usr/share/centreon/www/class/centreonLDAP.class.php on line 369
PHP Fatal error:  Uncaught TypeError: ldap_get_entries(): Argument #2 ($result) must be of type LDAP\Result, bool given in /usr/share/centreon/www/class/centreonLDAP.class.php:370
Stack trace:
#0 /usr/share/centreon/www/class/centreonLDAP.class.php(370): ldap_get_entries()
#1 /usr/share/centreon/www/class/centreonContactgroup.class.php(442): CentreonLDAP->findGroupDn()
#2 /usr/share/centreon/cron/centAcl.php(137): CentreonContactgroup->syncWithLdap()
#3 {main}
  thrown in /usr/share/centreon/www/class/centreonLDAP.class.php on line 370
[2026-01-30 13:20:01] According to DB another instance of centAcl.php is already running and I found 0 process...
Correcting the state in the DB, by setting the `running` value to 0 for id =  1
PHP Warning:  ldap_search(): Search: Bad search filter in /usr/share/centreon/www/class/centreonLDAP.class.php on line 369
PHP Fatal error:  Uncaught TypeError: ldap_get_entries(): Argument #2 ($result) must be of type LDAP\Result, bool given in /usr/share/centreon/www/class/centreonLDAP.class.php:370
Stack trace:
#0 /usr/share/centreon/www/class/centreonLDAP.class.php(370): ldap_get_entries()
#1 /usr/share/centreon/www/class/centreonContactgroup.class.php(442): CentreonLDAP->findGroupDn()
#2 /usr/share/centreon/cron/centAcl.php(137): CentreonContactgroup->syncWithLdap()
#3 {main}
  thrown in /usr/share/centreon/www/class/centreonLDAP.class.php on line 370
[2026-01-30 13:22:01] According to DB another instance of centAcl.php is already running and I found 0 process...
Correcting the state in the DB, by setting the `running` value to 0 for id =  1

This seem to be a known error message, not sure it’s related to the case. The events are not time related to the logon.

Now the SQL result :

+-------+-------------------------+---------------------------------------------------------------------+
| ar_id | ari_name                | ari_value                                                           |
+-------+-------------------------+---------------------------------------------------------------------+
|     1 | alias                   | samaccountname                                                      |
|     1 | bind_dn                 |                                                                     |
|     1 | bind_pass               |                                                                     |
|     1 | group_base_search       | dc=my,dc=domain                                                     |
|     1 | group_filter            | (&(samAccountName=%s)(objectClass=group)(samAccountType=268435456)) |
|     1 | group_member            | member                                                              |
|     1 | group_name              | samaccountname                                                      |
|     1 | ldap_auto_import        | 0                                                                   |
|     1 | ldap_auto_sync          | 0                                                                   |
|     1 | ldap_connection_timeout |                                                                     |
|     1 | ldap_contact_tmpl       | 43                                                                  |
|     1 | ldap_default_cg         |                                                                     |
|     1 | ldap_dns_use_domain     |                                                                     |
|     1 | ldap_dns_use_ssl        | 0                                                                   |
|     1 | ldap_dns_use_tls        | 0                                                                   |
|     1 | ldap_search_limit       | 60                                                                  |
|     1 | ldap_search_timeout     | 60                                                                  |
|     1 | ldap_srv_dns            | 0                                                                   |
|     1 | ldap_store_password     | 0                                                                   |
|     1 | ldap_sync_interval      | 1                                                                   |
|     1 | ldap_template           | Active Directory                                                    |
|     1 | protocol_version        | 3                                                                   |
|     1 | user_base_search        | dc=my,dc=domain                                                     |
|     1 | user_email              | mail                                                                |
|     1 | user_filter             | (&(samAccountName=%s)(objectClass=user)(samAccountType=805306368))  |
|     1 | user_firstname          | givenname                                                           |
|     1 | user_group              | memberOf                                                            |
|     1 | user_lastname           | sn                                                                  |
|     1 | user_name               | name                                                                |
|     1 | user_pager              | mobile                                                              |
+-------+-------------------------+--------------------------------------------------------------------∓

As said before, some Ldap accounts can log on Centreon, some don’t. But at this time I don’t know where to look at. There is no evident setting difference between the users in Centreon, and there was no change in the AD. I’m going to digg in the database.

Regards.

Hello, could you try to modify two lines in usr/share/centreon/www/class/centreonLDAP.class.php.

l 367.368 

    public function findGroupDn($group): string|false
    {
        if (trim($this->groupSearchInfo['filter']) == '') {
            return false;
        }
        $this->setErrorHandler();
        $escapedGroup = ldap_escape($group, '', LDAP_ESCAPE_FILTER);
        $filter = preg_replace('/%s/', $escapedGroup, $this->groupSearchInfo['filter']);
        $result = ldap_search($this->ds, $this->groupSearchInfo['base_search'], $filter);
        $entries = ldap_get_entries($this->ds, $result);
        restore_error_handler();
        if ($entries['count'] === 0) {
            return false;
        }

        return $entries[0]['dn'];
    }

here, i put you the function with the modification, the filter should be correctly escaped with this. Could you try this modification and keep us on touch if it works for you ?

​@Sébastien the point for you ! I was looking at this table but not the correct field. The culprit was in the field contact_ldap_required_sync. All were 0 but mine was 1.

I changed with update contact set contact_ldap_required_sync='0' where contact_id=xx; and it’s ok.

I can’t tell where this value comes from nor what it means, I don’t see an equivalent parameter in parameters/contact-users in Centreon.

Anyway, it’s fixed.

Thank you all who took some time to answer me and helped me fix the issue.

Regards.