Paul Gilzow

Does the error start with
wpDirAuth Directory Authentication Error ?

If so, is the error message
Incorrect password|
or
Could not authenticate user. Please check your credentials. ?

Just came across this same issue, though with both FakerPress-generated terms as well as existing terms. Watched the network for the call when it attempts to retrieve the terms and noticed the response from admin-ajax is
{"status":false,"message":"Invalid nonce verification","results":[],"more":true}
Captured the payload and sure enough, the _nonce field is missing.

Just a head’s up / FYI:
The value for HTTP_HOST can be set by the requesting agent by adding a Host header which can lead to security issues. See this document for more information.

Not ideal, but if you know the list of domains in your multisite, add those as an array/list and then verify that HTTP_HOST is in the list before using it, defaulting to a known good domain if HTTP_HOST isn’t in the list.

that looks perfect. Thanks!

That error message is definitely occurring when it attempts to bind to the ldap server with the credentials you’ve set for bindaccount and bindpassword. Have you tried using Apache Directory Studio? That would be my next suggestion for troubleshooting.

At some point there was a valid reason why you couldn’t use an alternate port with ldaps: protocol, but to be honest I don’t remember specifically what it was. And that reason may very well no longer be valid.

I saw in another thread that you might be interested in someone helping you to maintain this plugin. I have a few plugins in the repository that I’ve created and currently maintaining. I could help out with this one if you’d like.

I could definitely use the assistance. My organization has moved away from ldap to shibboleth so my focus has been there. Send me an email and I’ll get you set up to assist.

Try this, at line 544, and line 1455 in wpDirAuth.php, change could_not_authenticate (544) and failed_login (1455) to authentication_failed and see if WordFence starts behaving properly.

Unfortunately, this is a known issue with WordFence. I’ve tried to get them to correct their hook to authenticate but they have yet to update their code.

Thanks @whonickedmyname for the quick response to @kbk01’s question!

It’s not. Still works with the latest versions. I just absolutely hate dealing with subversion. Though I’m always open to assistance in maintaining it. ??

totally understand. Let me know when you’re back and looking at this agin.

Just checking in again. Were you able to try the testing script to help troubleshoot?

I’ll need some more info on how you have wpDirAuth configured in order to help troubleshoot. Do you know if your LDAP/AD instance requires pre-binding? Allows for anonymous searches?

Can you clarify what you mean by:

one of our LDAP users has changed his password in the Windows environment

If the user is someone who can work with you on troubleshotting, I would suggesting using this basic script to debug what might be going on: https://github.com/gilzow/simple-ldap-test/blob/master/ldap.php

This script follows the same general procedures of the plugin but removes all of the WordPress overhead.

You didn’t see the link that says “To get in touch, first check our documentation…” that opens the support modal? Or did that link not work?

I did, but since I had already read through and searched https://docs.ewww.io/ before coming here, I assumed the link you mentioned simply took me back to the docs, hence why I didn’t click on it.

At any rate, there is no way to override the location of the tools folder for the free version. Using the API avoids any need for the tools folder. Without the “tools” or an API key, the plugin won’t do much of anything.

Once the plugin has that directory and the binaries inside of it, does the plugin need to do any further writing into the directory? Or is it read-only after that point?

wpDirAuth can do either or, but it can’t do both. It does have a filter wpdirauth_filterquery where you can adjust the ldap filter right before the search occurs. You could hook that and then alter the filter based on what they gave as the user name.