LDAP Authentication Problem

[Teris]

Hi Zabbixers!

Zabbix beginner here! Getting to grips with is still but keen to keep learning and developing our monitoring. We've just implemented our first instance and the monitoring is going great but we are struggling with LDAP authentication which should be pretty straightforward. Attached are the settings and the error we're getting.

We've got LDAP and SLDAP working in loads of places in our environment without any issue and have tried copying the settings from a working setup straight into Zabbix.

From the error it implies Zabbix is connecting to the DC but can't locate the user for the Bind DN...

Here's what we've tried so far:
- Changed the LDAP host to include ldap:// OR the FQDN OR both OR IP of the domain controller. All combinations we could think of.
- Tried using LDAP and SLDAP ports and configurations
- Changed Bind DN to be domain\username OR [email protected] OR a different user without a space (builtin admin)
- Reset password on Bind user (just encase)

DNS is configured correctly on the Zabbix host and the PHP LDAP module is present.

I'm unsure where to go for logging information so I'd be grateful if anyone could point me in the right direction.

I'll be honest... I'm sure this is going to be something straightforward but I can't see where the issue is. Any advice would be fantastic

Environment: Centos7 / Zabbix 3.4.12

Thanks!!

[Linwood]

I don't use LDAP directly in zabbix, but do in apache2. Are there any errors in the AD DC's event log that might give a clue, make sure you are getting there with the right username? Do you need to prefix the username with the domain e.g. somedomain/Admin?

One way around this which we use and like is to let Apache do the LDAP integration. That way you can log into the server once, and let it authenticate for any related products. For example we have Netdisco, Rancid (i.e. CVS) and Zabbix all on the same server. You authenticate once and apache passes the user name to each of the products, works nice, and you don't have to deal with ldap integration separately in each. That's not an answer really if you just use zabbix; it should just work.