Exception 'array_intersect(): Argument #1 ($array) must be of type array, null given' during login

[J-Verz]

Describe the bug
I get the exception array_intersect(): Argument #1 ($array) must be of type array, null given when I try to log in with correct credentials. It is thrown in app/Ldap/Rules/LoginObjectclassRule.php on line 23. Through some debugging I discovered that the $user variable here contained the following:

array (
  'cn' =>
  array (
    0 => 'admin',
  ),
  'entryuuid' =>
  array (
    0 => '7d287bd2-cad4-103f-9d2f-5d87b2b084d3',
  ),
)

It has found the correct entry (cn=admin), but you can clearly see that this misses a value for objectclass.

When I go to '/', it shows the home page as if I am logged in, but states that I am connected anonymously.

And when I try to log in a second time, it works as expected. I get logged in and it also says so in the top-right corner. This time around, $user looks correct:

array (
  'cn' =>
  array (
    0 => 'admin',
  ),
  'objectclass' =>
  array (
    0 => 'organizationalRole',
    1 => 'top',
  ),
  'entryuuid' =>
  array (
    0 => '7d287bd2-cad4-103f-9d2f-5d87b2b084d3',
  ),
)

I have LDAP_LOGIN_OBJECTCLASS configured with organizationalRole by the way, so it passes the validation.

Version of PLA
I'm running verson 2.1.3 using your Docker image.

Expected behavior
I expect to be able to log in normally the first time.

Logs

Here is the full backtrace of the error

[2025-05-23 20:16:25] production.ERROR: array_intersect(): Argument #1 ($array) must be of type array, null given {"exception":"[object] (TypeError(code: 0): array_intersect(): Argument #1 ($array) must be of type array, null given at /app/app/Ldap/Rules/LoginObjectclassRule.php:23)
[stacktrace]
#0 /app/app/Ldap/Rules/LoginObjectclassRule.php(23): array_intersect()
#1 /app/vendor/directorytree/ldaprecord-laravel/src/Auth/Validator.php(35): App\\Ldap\\Rules\\LoginObjectclassRule->passes()
#2 /app/vendor/directorytree/ldaprecord-laravel/src/LdapUserAuthenticator.php(124): LdapRecord\\Laravel\\Auth\\Validator->passes()
#3 /app/vendor/directorytree/ldaprecord-laravel/src/LdapUserAuthenticator.php(84): LdapRecord\\Laravel\\LdapUserAuthenticator->validate()
#4 /app/vendor/directorytree/ldaprecord-laravel/src/Auth/NoDatabaseUserProvider.php(49): LdapRecord\\Laravel\\LdapUserAuthenticator->attempt()
#5 /app/vendor/laravel/framework/src/Illuminate/Auth/SessionGuard.php(457): LdapRecord\\Laravel\\Auth\\NoDatabaseUserProvider->validateCredentials()
#6 /app/vendor/laravel/framework/src/Illuminate/Support/Timebox.php(34): Illuminate\\Auth\\SessionGuard->{closure:Illuminate\\Auth\\SessionGuard::hasValidCredentials():456}()
#7 /app/vendor/laravel/framework/src/Illuminate/Auth/SessionGuard.php(456): Illuminate\\Support\\Timebox->call()
#8 /app/vendor/laravel/framework/src/Illuminate/Auth/SessionGuard.php(401): Illuminate\\Auth\\SessionGuard->hasValidCredentials()
#9 /app/vendor/laravel/ui/auth-backend/AuthenticatesUsers.php(86): Illuminate\\Auth\\SessionGuard->attempt()
#10 /app/vendor/laravel/ui/auth-backend/AuthenticatesUsers.php(46): App\\Http\\Controllers\\Auth\\LoginController->attemptLogin()
#11 /app/vendor/laravel/framework/src/Illuminate/Routing/Controller.php(54): App\\Http\\Controllers\\Auth\\LoginController->login()
#12 /app/vendor/laravel/framework/src/Illuminate/Routing/ControllerDispatcher.php(44): Illuminate\\Routing\\Controller->callAction()
#13 /app/vendor/laravel/framework/src/Illuminate/Routing/Route.php(266): Illuminate\\Routing\\ControllerDispatcher->dispatch()
#14 /app/vendor/laravel/framework/src/Illuminate/Routing/Route.php(212): Illuminate\\Routing\\Route->runController()
#15 /app/vendor/laravel/framework/src/Illuminate/Routing/Router.php(808): Illuminate\\Routing\\Route->run()
#16 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(170): Illuminate\\Routing\\Router->{closure:Illuminate\\Routing\\Router::runRouteWithinStack():807}()
#17 /app/vendor/laravel/framework/src/Illuminate/Auth/Middleware/RedirectIfAuthenticated.php(35): Illuminate\\Pipeline\\Pipeline->{closure:Illuminate\\Pipeline\\Pipeline::prepareDestination():168}()
#18 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Auth\\Middleware\\RedirectIfAuthenticated->handle()
#19 /app/app/Http/Middleware/CheckUpdate.php(28): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#20 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): App\\Http\\Middleware\\CheckUpdate->handle()
#21 /app/app/Http/Middleware/ViewVariables.php(28): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#22 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): App\\Http\\Middleware\\ViewVariables->handle()
#23 /app/app/Http/Middleware/SwapinAuthUser.php(46): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#24 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): App\\Http\\Middleware\\SwapinAuthUser->handle()
#25 /app/app/Http/Middleware/ApplicationSession.php(27): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#26 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): App\\Http\\Middleware\\ApplicationSession->handle()
#27 /app/app/Http/Middleware/AllowAnonymous.php(26): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#28 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): App\\Http\\Middleware\\AllowAnonymous->handle()
#29 /app/vendor/laravel/framework/src/Illuminate/Routing/Middleware/SubstituteBindings.php(51): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#30 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Routing\\Middleware\\SubstituteBindings->handle()
#31 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(88): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#32 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Foundation\\Http\\Middleware\\VerifyCsrfToken->handle()
#33 /app/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#34 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\View\\Middleware\\ShareErrorsFromSession->handle()
#35 /app/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(121): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#36 /app/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\\Session\\Middleware\\StartSession->handleStatefulRequest()
#37 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Session\\Middleware\\StartSession->handle()
#38 /app/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#39 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse->handle()
#40 /app/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(75): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#41 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Cookie\\Middleware\\EncryptCookies->handle()
#42 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(127): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#43 /app/vendor/laravel/framework/src/Illuminate/Routing/Router.php(807): Illuminate\\Pipeline\\Pipeline->then()
#44 /app/vendor/laravel/framework/src/Illuminate/Routing/Router.php(786): Illuminate\\Routing\\Router->runRouteWithinStack()
#45 /app/vendor/laravel/framework/src/Illuminate/Routing/Router.php(750): Illuminate\\Routing\\Router->runRoute()
#46 /app/vendor/laravel/framework/src/Illuminate/Routing/Router.php(739): Illuminate\\Routing\\Router->dispatchToRoute()
#47 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(201): Illuminate\\Routing\\Router->dispatch()
#48 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(170): Illuminate\\Foundation\\Http\\Kernel->{closure:Illuminate\\Foundation\\Http\\Kernel::dispatchToRouter():198}()
#49 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\\Pipeline\\Pipeline->{closure:Illuminate\\Pipeline\\Pipeline::prepareDestination():168}()
#50 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ConvertEmptyStringsToNull.php(31): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle()
#51 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Foundation\\Http\\Middleware\\ConvertEmptyStringsToNull->handle()
#52 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#53 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php(51): Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest->handle()
#54 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Foundation\\Http\\Middleware\\TrimStrings->handle()
#55 /app/vendor/laravel/framework/src/Illuminate/Http/Middleware/ValidatePostSize.php(27): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#56 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Http\\Middleware\\ValidatePostSize->handle()
#57 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php(110): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#58 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance->handle()
#59 /app/vendor/laravel/framework/src/Illuminate/Http/Middleware/HandleCors.php(49): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#60 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Http\\Middleware\\HandleCors->handle()
#61 /app/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php(58): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#62 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Http\\Middleware\\TrustProxies->handle()
#63 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/InvokeDeferredCallbacks.php(22): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#64 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(209): Illuminate\\Foundation\\Http\\Middleware\\InvokeDeferredCallbacks->handle()
#65 /app/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(127): Illuminate\\Pipeline\\Pipeline->{closure:{closure:Illuminate\\Pipeline\\Pipeline::carry():184}:185}()
#66 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(176): Illuminate\\Pipeline\\Pipeline->then()
#67 /app/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(145): Illuminate\\Foundation\\Http\\Kernel->sendRequestThroughRouter()
#68 /app/vendor/laravel/framework/src/Illuminate/Foundation/Application.php(1220): Illuminate\\Foundation\\Http\\Kernel->handle()
#69 /app/public/index.php(17): Illuminate\\Foundation\\Application->handleRequest()
#70 {main}
"}

LDAP Server details (please complete the following information):

• OS: Debian 12
• Server Name: OpenLDAP
• Version: 2.5.13

[J-Verz]

Small addendum: It might have something to do with the fact that I was using anonymous discovery (LDAP_USERNAME and LDAP_PASSWORD unconfigured). With authenticated discovery it does work.

[leenooks]

OK, that is useful. So with an anonymous query, does a search for cn=admin show any objectclass attribute values? If not, then I understand the problem.

[J-Verz]

I checked and it doesn't include the objectclass, although I'm unsure whether that's default behaviour or because we have configured it that way.

[leenooks]

Its probably default and normal.

The fix I committed will stop the exception from being thrown, which if you havent set LDAP_LOGIN_OBJECTCLASS would stop you from logging in (since that default is checking that the user has a posixAccount as an object class.

I may not be able to check the objectclasses after password authentication (all this work is done in directorytree/ldaprecord-laravel), so going forward, if you wanted to restrict who could login, you would need to override config/auth.php (providers.ldap.rules) and create your own rule and reference that class there.

[J-Verz]

Great, thanks! I solved it right now by providing credentials so PLA can do an authenticated discovery.