: GLPI – AD accounts can't log in and LDAP import returns 0 results despite successful connection test[General]

[AMesaoudi]

Your question

I am doing an internship (first year IT technician degree) and I have been stuck on this GLPI/LDAP issue for a while.
Environment:

GLPI installed on Debian, Apache, PHP 8.2
Windows Server Active Directory

LDAP configuration in GLPI:

Server: <DC_IP>, port 389
BaseDN: dc=domain,dc=local
Bind DN: cn=glpi_bind,cn=users,dc=domain,dc=local
Filter: (&(objectClass=user)(objectCategory=person))
Login field: sAMAccountName
Sync field: objectguid

What works:

The LDAP connection test in the GLPI interface passes without error
The following ldapsearch from the Debian server returns 200+ entries:

bashldapsearch -x -H ldap://<DC_IP> -D "cn=glpi_bind,cn=users,dc=domain,dc=local" -W -b "dc=domain,dc=local" "(sAMAccountName=*)"

The php-ldap module is installed and enabled
AD users log in normally on Windows domain PCs

What does not work:

Logging in with an AD account on GLPI: always returns "Incorrect username or password"
Importing users from the GLPI interface: 0 results
Synchronizing users: 0 results
Only the local glpi account via "GLPI internal database" works

What I have already tried:

Resetting the bind account password in AD
Modifying the BaseDN to cover the entire domain
Switching the login field between userprincipalname and sAMAccountName
Trying different connection filters
Manually triggering import and sync from the GLPI interface
Checking profiles and entities assigned to accounts in GLPI
Reinstalling and verifying the php-ldap module

My question:
The LDAP connection test succeeds and ldapsearch returns results correctly from the server, but GLPI finds 0 users and refuses all AD logins. What could explain this inconsistency, and how can I debug it further?

[g-bougard]

Hi @AMesaoudi

for GLPI questions, you should ask them on the GLPI forum or eventually on the community Discord.