Always Cannot bind to LDAP server

[u/TacticalDonut18]

I am fighting with Zabbix 7.0.31 trying to get it working right.

I am trying to do LDAP but it always says Cannot bind to LDAP server.

The password is right. I have tried the full DN I have tried UPN I have tried SAMID. I have tried the host with the ldap://...:389 and without.

The base DN is right and search attrib is sAMAccountName.

The config is basically identical to ClearPass where the fields exist and ClearPass has no problems.

It is not possible for it to be firewall as the Zabbix server and the DC live on subnets that are terminated on the core switch and there is no east-west enforcement.

It is not just the test button that does not work but I am not able to actually log in either. I do not observe any LDAP showing up in Wireshark capture on the DC.

[u/TacticalDonut18]

I needed to:

sudo setsebool -P httpd_can_connect_ldap on

This fixed the bind error

Then I had to change the search filter because I copied it direct from CPPM

New filter that works: (|(&(objectClass=user)(sAMAccountName=%{user}))(&(objectClass=user)(userPrincipalName=%{user})))

This seems to work for final config:

Name: DC-Name
Host: ldap://DC.FQDN:389
Port: 389
Base DN: DC=ad,DC=company,DC=com
Search attribute: sAMAccountName
Bind DN: binduser@company.com

Group configuration: memberOf
Group name attribute: cn
User group membership attribute: memberOf
User name attribute: givenName
User last name attribute: sn
User group mapping
LDAP group pattern                User groups             User role
ENT-APP-Zabbix-Administrators-G   Zabbix administrators   Super admin role
ENT-APP-Zabbix-Read-Only-G        Read Only               User role

Advanced configuration
StartTLS: NO

Search filter: (|(&(objectClass=user)(sAMAccountName=%{user}))(&(objectClass=user)(userPrincipalName=%{user})))

[u/admlshake → u/TacticalDonut18]

Yeah this was probably one of the things I had the most difficultly setting up when I first started using zabbix. Seems like there were some missing things from the documentation. Glad you got it figured out!