ldap_compare not working against certain system

Yah, sure.. was changed to more strict option validate.
Fixed in r10948.

OK, it is working perfectly for me.  The issue was that we had the following:

$config['auth_ldap_starttls'] = true;

but it looks like new versions of the code seem to use `require` or `optional`, updating to `require` fixed it.  Perhaps it would be beneficial to maybe fallback true value to require

I've found in Okta's logs that it is logging the following:

failure : A secure connection cannot be established. To admin: This service requires TLS.

I'm looking at what's the reason

BTW, we are a pro customer, I'm happy to provide access to the system that's not working for you to run some tests.

Hey Mike:

I've actually reverted my patch, running trunk (r10937) and now I seem to be running into this (logging in with `/debug/`):

Error binding to LDAP server: <org>.ldap.okta.com: Server is unwilling to perform

svn diff shows no output at all.

For correct results revert your local changes:

svn revert html/includes/authentication/ldap.inc.php

Ok, can you check with latest revision my workaround.
I added check errors if ldap_compare() return error.

Fixed in r10937.

Indeed, it's two seperate issues.

I'm not an expert at LDAP, but it seems like ldap_compare() is a request that is sent to the server.  When using the LDAP interface provided by Okta, the result of an ldap_compare is a failure (where the error is "Server is unwilling to perform") – perhaps it would be useful to add error handling for that using ldap_error() as it took me a while to troubleshoot it.

You can see a few other examples of folks who ran into something similiar here:

https://www.reddit.com/r/okta/comments/dp9nig/okta_django_ldap/f6gasrc/?utm_source=reddit&utm_medium=web2x&context=3

Hrm, probably problem with ldap_compare exactly related to bind issue (OBS-1976)?

Not understand how any service can "not support" ldap_compare() while this is just php function with calls to ldap read..

I fixed OBS-1976 by more correct way.

Can you check your ldap but without ldap rebind here:

-  unset($cache['ldap_bind_result']);

-  ldap_bind_dn();