User login trouble using LDAP

[pockettanker]

I have a strange problem with authentication via LDAP(AD). One of users can not log in neither web nor via api. User authenticate with no problems last 4 years. Here is my investigation results:

- all other corporate systems using same bind dn and bind user authenticate this user with no problems;
- all other configured users in same zabbix with same groups, permissions level, and same LDAP OU authenticate with no problem;
- user does not participate Disabled group;
- user does not blocked any way;
- removing all php session files did not help;
- tcpdump shows no problem retrieving user data from LDAP by zabbix;
- there is no any additional info in log files with any DebugLevel.

Does anyone have ideas about it? Maybe I missed something?

OS: Debian 8.7
Apache 2.4.10
Zabbix: 3.0.7

[pockettanker]

I found a problem. The reason is active directory. Few weeks ago we have configure additional domain in forest. This additional domain have an account with the same sAMAccountName. So when we are searching through base dn, we have two results. But zabbix LDAP user password validation implementation discards any search with more than 1 result. And we have negative validation result in my case.

As far as I can see, there is no additional search filter in LDAP authentication config in zabbix, so solution is still unknown. Any help will be appreciated

Searching in one OU is not an option, because there is many users in zabbix from different OUs from top domain.

PS. Sorry for my English

[pockettanker]

Solved

The problem was solved by additional blocking rule for the bind user in AD subdomain.

Not so elegant, but ok.