# Need some help with the LDAP Url **URL:** \ **Category:** System Administrator\ **Created:** [April 26, 2024, 8:55am UTC](https://discuss.tryton.org/t/need-some-help-with-the-ldap-url/7237 "2024-04-26T08:55:19Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![philipp.ludwig](https://discuss-cdn.tryton.org/letter_avatar_proxy/v4/letter/p/dc4da7/32.png) [@philipp.ludwig](https://discuss.tryton.org/u/philipp.ludwig)\ **Post date:** [April 26, 2024, 8:55am UTC](https://discuss.tryton.org/t/need-some-help-with-the-ldap-url/7237/1 "2024-04-26T08:55:19Z")
I need some help with specifying the correct LDAP URL. I have a working installation of the UCS Server, which uses slapd internally, and I can authenticate over LDAP from other applications (e.g. dokuwiki) just fine. However, with Tryton I struggle to build the correct LDAP URL. My configuration is: ```auto [session] authentications=ldap,password [ldap_authentication] uri=ldaps://ucs..de:7636/cn=users,dc=,dc=de?bindname=uid=ldapquery,cn=users,dc=,dc=de bind_pass= **************** create_user=true ``` I am using these settings in dokuwiki, where it works fine. Furthermore, these work with the `ldapsearch` terminal utility. However, in Tryton I just get a generic `ERROR trytond.security login failed` message, even with the logging level set to DEBUG. I have tried to change some parts of the LDAP URL by copying things like `?sAMAccountName?subtree??` from other posts in this forum, but this just results in the error message `ldap3.core.exceptions.LDAPBindError: unable to bind`. So I have looked for tools to build/validate this LDAP URL but could not find anything. Any help or hints would be appreciated. ---
**Author:** ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)\ **Post date:** [April 26, 2024, 9:54am UTC](https://discuss.tryton.org/t/need-some-help-with-the-ldap-url/7237/2 "2024-04-26T09:54:52Z")
I suggest you to add some debugging print statement in `_login_ldap` to see where it stops the authentication. I suspect that `con.bind()` does not succeed. _Once we know we could add more logging message to catch such case._ ---
**Author:** ![philipp.ludwig](https://discuss-cdn.tryton.org/letter_avatar_proxy/v4/letter/p/dc4da7/32.png) [@philipp.ludwig](https://discuss.tryton.org/u/philipp.ludwig)\ **Post date:** [April 26, 2024, 12:28pm UTC](https://discuss.tryton.org/t/need-some-help-with-the-ldap-url/7237/3 "2024-04-26T12:28:29Z")
I have added a `logger.info("Hello from LDAP")` snippet in the global section of the file, which is shown like this: ```auto 10 140244333154368 [2024-04-26 12:15:27,561] INFO trytond.modules.ldap_authentication.res Hello from LDAP ``` Then I added a logger statement in `_login_ldap`: ```auto def _login_ldap(cls, login, parameters): logger.info("_login_ldap") if 'password' not in parameters: ``` But this is not printed in the logs. I have added logger statements in other parts of the code, but with no success. However, I can see that this part of the code is indeed executed, because I can see the requests in the logs of slapd. Is there anything that I need to do to make the logger print this? By the way, plain `print`did not yield any output, either. ---
**Author:** ![ced](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/ced/32/1237_2.png) [@ced](https://discuss.tryton.org/u/ced)\ **Post date:** [April 26, 2024, 12:51pm UTC](https://discuss.tryton.org/t/need-some-help-with-the-ldap-url/7237/4 "2024-04-26T12:51:36Z")
If there is no output it means the code is not executed. So probably that `ldap` is not configured as authentication method. ---
**Author:** ![edbo](https://discuss-cdn.tryton.org/letter_avatar_proxy/v4/letter/e/f14d63/32.png) [@edbo](https://discuss.tryton.org/u/edbo)\ **Post date:** [April 26, 2024, 3:06pm UTC](https://discuss.tryton.org/t/need-some-help-with-the-ldap-url/7237/5 "2024-04-26T15:06:26Z")
There are a few things: 1. you are using ldaps (SSL) make sure your certificates are right and exists in the OS store. Also you can try ldap+tls:// 2. you are missing the LDAP attribute in the `[ldap_authentication]` section so Tryton doesn’t know which attribute to take for the user 3. you are running on a different port than normal. The ports are hardcoded in the code, for TLS / normal 389, for SSL 636 ([modules/ldap\_authentication/res.py · fa8f759f834b66c68081c5b3941e2068f445cab2 · Tryton / Tryton · GitLab](https://foss.heptapod.net/tryton/tryton/-/blob/fa8f759f834b66c68081c5b3941e2068f445cab2/modules/ldap_authentication/res.py#L39)) Personally I think you have to tackle point 3 first before going the others. ---
**Author:** ![philipp.ludwig](https://discuss-cdn.tryton.org/letter_avatar_proxy/v4/letter/p/dc4da7/32.png) [@philipp.ludwig](https://discuss.tryton.org/u/philipp.ludwig)\ **Post date:** [April 29, 2024, 9:08am UTC](https://discuss.tryton.org/t/need-some-help-with-the-ldap-url/7237/6 "2024-04-29T09:08:20Z")
Thank you, after lots of print statements I made it work now. The port was one problem; the other aspect was that Tryton does not parse LDAP URLs like other LDAP tools do, which caused it to interpret my LDAP bind user DN as a filter. The solution was to use two questionmarks: ```auto uri=ldaps://server/cn=users,dc=company,dc=de??subtree??bindname=uid=bindusername,cn=users,dc=company,dc=de ``` ---
**Author:** ![system](https://discuss-cdn.tryton.org/uploads/default/original/1X/c6f8ec0a40525cdcd50058c734283450a4b3d38b.png) [@system](https://discuss.tryton.org/u/system)\ **Post date:** [April 29, 2024, 9:08pm UTC](https://discuss.tryton.org/t/need-some-help-with-the-ldap-url/7237/7 "2024-04-29T21:08:27Z")
This topic was automatically closed 12 hours after the last reply. New replies are no longer allowed.