[Bug]: TypeError exception after login (LDAP)

[3eka]

Is there an existing issue for this?

• I have searched the existing issues

Environment

- OS: CentOS 9 Stream
- PHP: 8.4.15
- LDAP Server: 389-ds 2.7.0

PLA Code

Github release download

PLA Version

2.3.8

Current Behavior

TypeError - Internal Server Error

LdapRecord\Models\OpenLDAP\User::getAuthIdentifier(): Return value must be of type string, null returned

PHP 8.4.15
Laravel 12.44.0
int9445-c9.mydomain.com:9389

Stack Trace

0 - vendor/directorytree/ldaprecord/src/Models/OpenLDAP/User.php:40
1 - vendor/laravel/framework/src/Illuminate/Auth/SessionGuard.php:549
2 - vendor/laravel/framework/src/Illuminate/Auth/SessionGuard.php:422
3 - vendor/laravel/framework/src/Illuminate/Support/Timebox.php:34
4 - vendor/laravel/framework/src/Illuminate/Auth/SessionGuard.php:411
5 - app/Http/Controllers/Auth/LoginController.php:67
6 - vendor/laravel/ui/auth-backend/AuthenticatesUsers.php:46
7 - vendor/laravel/framework/src/Illuminate/Routing/Controller.php:54
8 - vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php:43
9 - vendor/laravel/framework/src/Illuminate/Routing/Route.php:265
10 - vendor/laravel/framework/src/Illuminate/Routing/Route.php:211
11 - vendor/laravel/framework/src/Illuminate/Routing/Router.php:822
12 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:180
13 - vendor/laravel/framework/src/Illuminate/Auth/Middleware/RedirectIfAuthenticated.php:35
14 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
15 - app/Http/Middleware/CheckUpdate.php:28
16 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
17 - app/Http/Middleware/ViewVariables.php:28
18 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
19 - app/Http/Middleware/SwapinAuthUser.php:49
20 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
21 - app/Http/Middleware/AllowAnonymous.php:26
22 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
23 - app/Http/Middleware/AcceptLanguage.php:23
24 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
25 - vendor/laravel/framework/src/Illuminate/Routing/Middleware/SubstituteBindings.php:50
26 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
27 - vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php:87
28 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
29 - vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php:48
30 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
31 - vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php:120
32 - vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php:63
33 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
34 - vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php:36
35 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
36 - vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php:74
37 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
38 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:137
39 - vendor/laravel/framework/src/Illuminate/Routing/Router.php:821
40 - vendor/laravel/framework/src/Illuminate/Routing/Router.php:800
41 - vendor/laravel/framework/src/Illuminate/Routing/Router.php:764
42 - vendor/laravel/framework/src/Illuminate/Routing/Router.php:753
43 - vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php:200
44 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:180
45 - vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php:21
46 - vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ConvertEmptyStringsToNull.php:31
47 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
48 - vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php:21
49 - vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php:51
50 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
51 - vendor/laravel/framework/src/Illuminate/Http/Middleware/ValidatePostSize.php:27
52 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
53 - vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php:109
54 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
55 - vendor/laravel/framework/src/Illuminate/Http/Middleware/HandleCors.php:48
56 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
57 - vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php:58
58 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
59 - vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/InvokeDeferredCallbacks.php:22
60 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
61 - vendor/laravel/framework/src/Illuminate/Http/Middleware/ValidatePathEncoding.php:26
62 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:219
63 - vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php:137
64 - vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php:175
65 - vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php:144
66 - vendor/laravel/framework/src/Illuminate/Foundation/Application.php:1220
67 - public/index.php:17

Request

POST /login

Headers

• priority: u=0, i
• sec-fetch-user: ?1
• sec-fetch-site: same-origin
• sec-fetch-mode: navigate
• sec-fetch-dest: document
• upgrade-insecure-requests: 1
• cookie: apt.uid=AP-YFGMCGUNNIFB-2-1750157937584-66771845.0.2.6b933aba-006b-4c12-b4b5-a0ddc2adfcf4; ajs_user_id=a10ecf5c87e572ea10eee4bc1dd56b2655f66841; ajs_anonymous_id=591617e0-411b-477a-adf7-4b79bfc82d49; _ga_0C4M1PWYZ7=GS2.1.s1767091792$o48$g0$t1767091792$j60$l0$h0; _ga=GA1.1.1178618371.1726559205; _ga_T11SF3WXX2=GS2.1.s1767091792$o48$g0$t1767091792$j60$l0$h0; _ga_K2SPJK2C73=GS2.1.s1767091792$o48$g0$t1767091792$j60$l0$h0; _ga_1VMHX9T4XD=GS1.1.1737026745.1.0.1737026748.0.0.907983423; _ga_Z1385HBR0P=GS1.1.1737026745.1.0.1737026748.0.0.1966311856; eecwcmansess=5f245f845f349acd5d5bf4b42af808ff; laravel_session=eyJpdiI6InE0d0ZZTWtHcXpLSnVWZ1BpaGdaOHc9PSIsInZhbHVlIjoiTGlUL3VXWHVRZUZ0Y3c1aW5RSHdVaktaeUZUQlo2UWxFNHNIUjV1VW53K2hPM213K0xiT1dISENiYmYzSUtTUGJReVBEY2pGYVhWRWN2dXQwTHlRc2l6ajJUL29Beml2TTlIUlNCWFIyenU4T0VyQURVYTZrdU1OMzJvSXhaY1AiLCJtYWMiOiJkZWY3MWYxOGRmZWYwNzg2YmYwMjExNDhkNjU1NzZkYTE3ZDMyMmM0ZjJlMmEwMTFjMzk5Yzc0OGVlN2FkOTU3IiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6InNEQ0JVY3BvQ3dMTEM5TTlBcnJ4cFE9PSIsInZhbHVlIjoiYm1IOThjWkVhbTEvU3dCUkliWTMvdmdCbmo3SDhUZE1CbWViNU9tYTF2amErV1FsWlRhc2FJdXE2T25XSjYzYjBWRGQ1QW5mTVFPNmUwUndNNXlNcGZKc2NYdTJ2cVh5RE9LdUNmcjFvQTV0eC9NZVFWYW95RlRrdHgvckVGUUgiLCJtYWMiOiI5NzM3YjI5M2JkZjFmMGZmNWFiODgwNWQ5YzM0Y2ZmZDY1YTI1MzA0NzBkN2E1ODU4NjZjYWZiMjc4NzY1MzRlIiwidGFnIjoiIn0%3D; PYEGkcE7oMWmfnNFAWlghxGK1s9rHOYkIDsX8UGZ=eyJpdiI6InZNbkZCcHRqUC9VVUxjVy9VLzRIL0E9PSIsInZhbHVlIjoiV0tuQjhDRGlzOWU3UzdyODcrUnBDQ0dZcTV6T2d6ckh5MkIzVTduVXorSU01VlpFaVZ3Ym1QZ2xNbDJnZjhobVFkMWIyZGUrMTRqQm9CUXE2S2NhNVpQaFVwV1B3Nk5jeHdhcHhnd2pEZ2VqRE82ZzRLTy9SS2JRQjQ1YXVOL0I5eGlQQ251TU1oZExXMkRxakQ0am5HMVUvSk0yZ3lqa3JSb3FTMDVxSGNUcDlibVpTcWpZSm5rb2dibzN3cHVGYTZuT2NXNGlsWWZkUzVsZHVONWNKdkh6N1p6WDhRK3YzbXNrdVJOTTVuUnpEcTNUc01vcUhaOUJSOU9VQ25kemZVL3JhdWhsQU5pUlpQakxoa1l4dXRCNzh6WlI1UXFrb0JoMW05RGlPVDhWVGtjSEtTc2FrNkxGWXZSd1VVSkkzNzJ6aSsrK1BVa2hHS2pjb01kTjk5VjMvY0FEUHlBdHpXYnBySmFLRjJzMFl2WGMzWDk4dGVSKy96d0NUdWtETE43VU5semxiTGJXZ3RCcU1BSWE2YXd0SWNMcUxnank2d0ErRTI0ZHh5bGxkVk5namhUckFJd3JOMDY1S25kbyIsIm1hYyI6IjY1M2JkNTcxOWNhNDY0NzdmOWJiYjE0OGUxNWU2ZjdhZjhmMTAxYTM2MDBmM2M1NjYzYzI3MzQ3NTE0NTk1ZTMiLCJ0YWciOiIifQ%3D%3D
• connection: close
• dnt: 1
• origin: https://int9445-c9.mydomain.com:9389
• content-length: 93
• content-type: application/x-www-form-urlencoded
• referer: https://int9445-c9.mydomain.com:9389/login
• accept-encoding: gzip, deflate, br, zstd
• accept-language: en-US,en;q=0.7,sr;q=0.3
• accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
• user-agent: Mozilla/5.0 (X11; Linux x86_64; rv:146.0) Gecko/20100101 Firefox/146.0
• host: int9445-c9.mydomain.com:9389

Route Context

controller: App\Http\Controllers\Auth\LoginController@login
middleware: web, guest

Route Parameters

No route parameter data available.

Database Queries

No database queries detected.

Expected Behavior

After login (successful) to continue with LDAP operations.

Steps To Reproduce

Anonymous bind is disabled

Relevant log output

From laravel log:
[2026-01-06 12:43:39] production.INFO: User [Predrag Zecevic] has been successfully discovered for authentication.
[2026-01-06 12:43:39] production.INFO: User [Predrag Zecevic] is authenticating.  
[2026-01-06 12:43:39] production.INFO: ALG:Attempting login for [cn=Predrag Zecevic,ou=People,dc=mydomain,dc=com] with password [****************]    
[2026-01-06 12:43:39] production.INFO: LDAP (ldaps://int9445-c9.mydomain.com:636) - Operation: Attempting - Username: cn=Predrag Zecevic,ou=People,dc=mydomain,dc=com  
[2026-01-06 12:43:39] production.INFO: LDAP (ldaps://int9445-c9.mydomain.com:636) - Operation: Binding - Username: cn=Predrag Zecevic,ou=People,dc=mydomain,dc=com  
[2026-01-06 12:43:39] production.INFO: LDAP (ldaps://int9445-c9.mydomain.com:636) - Operation: Bound - Username: cn=Predrag Zecevic,ou=People,dc=mydomain,dc=com  
[2026-01-06 12:43:39] production.INFO: LDAP (ldaps://int9445-c9.mydomain.com:636) - Operation: Passed - Username: cn=Predrag Zecevic,ou=People,dc=mydomain,dc=com  
[2026-01-06 12:43:39] production.INFO: LDAP (ldaps://int9445-c9.mydomain.com:636) - Operation: Binding - Username:     
[2026-01-06 12:43:39] production.INFO: LDAP (ldaps://int9445-c9.mydomain.com:636) - Operation: Bound - Username:     
[2026-01-06 12:43:39] production.INFO: User [Predrag Zecevic] has successfully passed LDAP authentication.  
[2026-01-06 12:43:39] production.INFO: User [Predrag Zecevic] has successfully authenticated.  

So, I am authorized against LDAP, but stuck to /login with error

Anything else?

From Apache access log (if relevant):

[2026-01-06 12:43:23.984] [pid 201:tid 0] int9445-c9.mydomain.com.443 192.168.221.169 - - "GET / HTTP/1.1" 302 215 "https://int9445-c9.mydomain.com:9389/" "Mozilla/5.0 (X11; Linux x86_64; rv:146.0) Gecko/20100101 Firefox/146.0" (46%)
[2026-01-06 12:43:24.225] [pid 201:tid 0] int9445-c9.mydomain.com.443 192.168.221.169 - - "GET /login HTTP/1.1" 200 1756 "https://int9445-c9.mydomain.com:9389/" "Mozilla/5.0 (X11; Linux x86_64; rv:146.0) Gecko/20100101 Firefox/146.0" (37%)
[2026-01-06 12:43:39.147] [pid 201:tid 1] int9445-c9.mydomain.com.443 192.168.221.169 - - "POST /login HTTP/1.1" 500 215147 "https://int9445-c9.mydomain.com:9389/login" "Mozilla/5.0 (X11; Linux x86_64; rv:146.0) Gecko/20100101 Firefox/146.0" (11%)

And most annoying is LDAP password is visible on that error page!

Body

{
    "_token": "rdxPTVtl9l5Qo9hWocXAjjNdYOnqNx5ZciuRosPo",
    "uid": "predrag_zecevic",
    "password": "My.Password.Is.Visible here!"
}

Regards.

[3eka]

If I remove /login from URL, and can continue with work (logged in)!

[leenooks]

I'm unable to reproduce this issue. Does it consistently happen?

A debug output from openldap may help understand what is going on - but basically the error is indicating an issue fetching data from your LDAP server. Clearing the cache may help php artisan cache:clear.

I think the error thrown is also exposing a bug with the upstream dependancy - your log indicates its throwing an exception because a function is expected to return a string (but is returning NULL) - the call in the function is calling another function that may return null (when a value is not retrieved from the server). I'll report it with them.

[3eka]

So,
thanks for answers:

• It is consistently happen? -- Yes, /in versions 2.3.6 - 2.3.8 - I do not recall older ones/
• Clearing the cache may help php artisan cache:clear -- Nope, it did not help (and it is not openldap, but 289-ds -- slightly different, but almost similar)

389-ds access log

[06/Jan/2026:12:43:39.410271675 +0100] conn=36 fd=64 slot=64 SSL connection from 192.168.220.169 to 192.168.220.169
[06/Jan/2026:12:43:39.421224261 +0100] conn=36 TLS1.3 128-bit AES-GCM
[06/Jan/2026:12:43:39.421320682 +0100] conn=36 op=0 BIND dn="" method=128 version=3
[06/Jan/2026:12:43:39.421396795 +0100] conn=36 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.010885653 optime=0.000078331 etime=0.010959603 dn=""
[06/Jan/2026:12:43:39.444342231 +0100] conn=36 op=1 SRCH base="dc=mydomain,dc=com" scope=2 filter="(uid=predrag_zecevic)" attrs="entryUUID * aci"
[06/Jan/2026:12:43:39.445451904 +0100] conn=36 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000303595 optime=0.001121787 etime=0.001421189
[06/Jan/2026:12:43:39.450940072 +0100] conn=36 op=2 BIND dn="cn=Predrag Zecevic,ou=People,dc=mydomain,dc=com" method=128 version=3
[06/Jan/2026:12:43:39.663321759 +0100] conn=36 op=2 RESULT err=0 tag=97 nentries=0 wtime=0.000140718 optime=0.212393970 etime=0.212529560 dn="cn=predrag zecevic,ou=people,dc=mydomain,dc=com"
[06/Jan/2026:12:43:39.664398546 +0100] conn=36 op=3 BIND dn="" method=128 version=3
[06/Jan/2026:12:43:39.664479231 +0100] conn=36 op=3 RESULT err=0 tag=97 nentries=0 wtime=0.000176767 optime=0.000089831 etime=0.000262724 dn=""
[06/Jan/2026:12:43:40.196406258 +0100] conn=36 op=4 UNBIND
[06/Jan/2026:12:43:40.196440608 +0100] conn=36 op=4 fd=64 Disconnect - Cleanly Closed Connection - U1

389-ds security log (error log is empty):

{ "date": "[06\/Jan\/2026:12:43:09.758933037 +0100] ", "utc_time": "1767699789.758933037", "event": "BIND_SUCCESS", "dn": "cn=predrag zecevic,ou=people,dc=mydomain,dc=com", "bind_method": "SIMPLE", "root_dn": false, "client_ip": "192.168.220.169", "server_ip": "192.168.220.169", "ldap_version": 3, "conn_id": 31, "op_id": 0, "msg": "" } 
{ "date": "[06\/Jan\/2026:12:43:10.357999422 +0100] ", "utc_time": "1767699790.357999422", "event": "BIND_SUCCESS", "dn": "cn=predrag zecevic,ou=people,dc=mydomain,dc=com", "bind_method": "SIMPLE", "root_dn": false, "client_ip": "192.168.220.169", "server_ip": "192.168.220.169", "ldap_version": 3, "conn_id": 32, "op_id": 0, "msg": "" } 
{ "date": "[06\/Jan\/2026:12:43:11.447696161 +0100] ", "utc_time": "1767699791.447696161", "event": "BIND_SUCCESS", "dn": "cn=predrag zecevic,ou=people,dc=mydomain,dc=com", "bind_method": "SIMPLE", "root_dn": false, "client_ip": "192.168.220.169", "server_ip": "192.168.220.169", "ldap_version": 3, "conn_id": 33, "op_id": 0, "msg": "" } 

To me it looks like error in URL handling from index.php - maybe it does not expect port? In my .env file I have set this: APP_URL=https://int9445-c9.mydomain.com:9389/

Best regards.

[leenooks]

The reported error is not consistent with URL handling, so there may be a secondary issue here.

On your ldap entry, after logging in, does entryUUID appear with a value (on the Internal tab)?

[3eka]

Let me answer question: Internal "tab" shows (I guess nsUniqueId value is what you are looking for?):

• createTimestamp -- 2012-03-13 09:52:58
• creatorsName -- cn=directory manager
• dsEntryDN -- cn=Predrag Zecevic,ou=People,dc=mydomain,dc=com
• entrydn -- cn=predrag zecevic,ou=people,dc=mydomain,dc=com
• entryid -- 519
• modifiersName -- cn=predrag zecevic,ou=people,dc=mydomain,dc=com
• modifyTimestamp -- 2025-11-18 12:36:10
• nsUniqueId -- 316ada92-efbe11e7-b4a6cec7-4f6eb22c
• parentid -- 4

Would be also nice if you can set (top right corner cn=Predrag Zecevic) to LINK to cn=Predrag Zecevic,ou=People,dc=mydomain,dc=com entry

[leenooks]

OK, I've just tried on my 389-ds server, and I haven no issues.

https://demo.phpldapadmin.org/389ds

Do you have an ACL rule that is not returning entryUUID?

[3eka]

Yes, but you do NOT use port (just expected 443/https)...
SO, it is not same.

BTW:

• Apache config directives: DocumentRoot "/usr/local/apache-htdocs/pla/" and Listen 9389 (secured by own certificate)
• with (pla being sym-link, which enables me quick switch between versions):

:; cd /usr/local/apache-htdocs
:; ls -hl pla
lrwxrwxrwx 1 apache apache 25 Jan  6 12:41 pla -> phpLDAPadmin-2.3.8/public

• It was build under /usr/local/apache-htdocs/phpLDAPadmin-2.3.8 (where source tar was unpacked) using supplied instructions

[3eka]

There are some ACL rules in use, but nothing like preventing entryUUID (more over, such attribute does not exists in 389-ds version I use):

• From dse-ldif

:; grep entryUUID /etc/dirsrv/slapd-INST/dse.ldif
dn: cn=entryUUID,cn=default indexes,cn=config,cn=ldbm database,cn=plugins,cn=c
cn: entryUUID
dn: cn=entryUUID,cn=index,cn=userroot,cn=ldbm database,cn=plugins,cn=config
cn: entryUUID

• From db2ldif dump of userroot backend

:; grep entryUUID /var/lib/dirsrv/slapd-INST/ldif/INST-userroot-2026-01-08T15:56:59.987808.ldif
[no result]

NOTE: this 389-ds INSTance is full of nsUniqueId values. It was constantly upgraded from 389-ds version 1.x to this 2.7.0 (sometimes with export/import functionality) - maybe that can explain lack of entryUUID attribute

Regards

[3eka]

Found:

• Add missing entryuuid cli  389ds/389-ds-base#4775
• No support for RFC 4530 entryUUID attribute 389ds/389-ds-base#137

I have to see if I can alias nsUniqueId to entryUUID (which might be easier solution). Especially plugin is there:

:; ls -hal /usr/lib64/dirsrv/plugins/libentryuuid-plugin.so
-rwxr-xr-x 1 root root 1.5M Sep 18 19:51 /usr/lib64/dirsrv/plugins/libentryuuid-plugin.so
:; rpm -qf /usr/lib64/dirsrv/plugins/libentryuuid-plugin.so
389-ds-base-2.7.0-7.el9.x86_64

I need some time to test this (as we do migration from old version to new via export/import functionality)...