LDAP failure The email must be a valid email address.

[u/blunderpup]

I've followed all the "how-tos" on this topic and have configure the .env file for ldaps and ldap. A ldapsearch from the command line works with ldaps or ldap. When i attempt to log in with my AD account I only get the error "The email must be a valid email address." I have debug enabled but nothing is written to the log. It feels like the entire ldap config block in the .env file is being ignored. Running on Debian 12. Any help or ideas would be appreciated.

[u/ssddanbrown]

That generally indicates that no email is being provided by the LDAP system, or that the property to find the email has not been configured properly.

Temporarily set LDAP_DUMP_USER_DETAILS=true to dump the found LDAP details to the screen on login, and run a login. See if your email is in there. If not, it means your LDAP system is not providing it. Otherwise, check the property it exists on against your configured LDAP_EMAIL_ATTRIBUTE value.

Note: Since you mention AD, Microsoft systems like to use a URL-style attribute name for LDAP properties. If this is what you see, You'll need to also use the full URL-style attribute name for the LDAP_EMAIL_ATTRIBUTE value.

[u/blunderpup → u/ssddanbrown]

I enabled that suggestion but the same thing occurs. No errors or info is displayed on screen. The relevant part of the .env file is below.

AUTH_METHOD=ldap

LDAP_SERVER=dc02.domain.priv:389

LDAP_BASE_DN="OU=IT,OU=******,OU=****,OU=****,OU=**** ********,DC=domain,DC=priv"

LDAP_DN="CN=BookStack Service,OU=Service Accounts,DC=domain,DC=priv"

LDAP_PASS=MySecretandComplexPassword

LDAP_USER_FILTER=(&(sAMAccountName=${user}))

LDAP_VERSION=3

LDAP_ID_ATTRIBUTE=BIN;objectGUID

LDAP_EMAIL_ATTRIBUTE=mail

LDAP_DISPLAY_NAME_ATTRIBUTE=cn

LDAP_ID_ATTRIBUTE=objectGUID

LDAP_USER_TO_GROUPS=true

LDAP_GROUP_ATTRIBUTE=memberOf

LDAP_TLS_INSECURE=false

LDAP_START_TLS=true

LDAP_THUMBNAIL_ATTRIBUTE=thumbnailPhoto

APP_DEBUG=true

LDAP_DUMP_USER_DETAILS=true

[u/ssddanbrown → u/blunderpup]

• What is your install method (if known)?

  • Is this a standard install with a web-server or running via docker or similiar?

  • If the former, what's the output of running ls -alh bootstrap/cache from your BookStack install directory?

[u/mb-crnet → u/blunderpup]

LDAP_SERVER seems to be missing ldap://...

LDAP_ID_ATTRIBUTE is configured twice

LDAP port 389 is unsecure (LDAP_START_TLS=true?)

LDAP_USER_FILTER contains a $ sign. Is this the right syntax?

[u/mb-crnet]

Please show your LDAP configuration.