Authenticating Users with Google Cloud Identity

[leonida368]

Hi, I precisely followed the guide on https://docs.netgate.com/pfsense/en/latest/recipes/auth-google-gsuite.html and when I go to Diagnostics/System/General I read the following error: /diag_authentication.php: ERROR! Could not bind to LDAP server Gogoel Workspace. Please check the bind credentials.
But the credentials generated by the LDAP app are 100% correct.
What could I see? Thank you

[stephenw10]

Anything in the System or Authenication logs?

https://docs.netgate.com/pfsense/en/latest/troubleshooting/authentication.html#ldap-authentication-server-troubleshooting

[leonida368]

h @stephenw10i, I'll send you the logs in System Logs/ System / General

May 17 14:28:47 php-fpm 68942 /diag_authentication.php: ERROR! Could not bind to LDAP server Gogoel Workspace. Please check the bind credentials.
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: LDAP connection error flag: false
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: Group Filter:
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: Filter: (uid=pippo)
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: Extended Query:
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: Attrs: Name: uid / Group: memberOf
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: Container: ou=Users,dc=liceocaronapoli,dc=it
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: Auth Bind DN: GummyMayfl
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: Scope: subtree
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: Base DN: dc=liceocaronapoli,dc=it
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: URI: ldap://127.0.0.1:1636 (v3)
May 17 14:28:47 php-fpm 68942 /diag_authentication.php: LDAP Debug: Attempting to authenticate pippo on Gogoel Workspace
May 17 14:22:10 php-fpm 68942 /system_authservers.php: ERROR! ldap_get_user_ous() could not bind to server .

[stephenw10]

@leonida368 said in Authenticating Users with Google Cloud Identity:

LDAP Debug: URI: ldap://127.0.0.1:1636 (v3)

Are you running this in CE using Stunnel? Is that running correctly?

[leonida368]

@stephenw10 I configured Stunnel by following the step-by-step guide above.
Stunnel is listening on IP 127.0.0.1 on port 1636 and will then forward requests to ldap.google.com on port 636

[stephenw10]

Check the state table when you try to connect. Do you see states for the in and out connections from Stunnel?

If that's difficult to see I would try running a pcap on WAN filtered by port 636 to make sure there is at least a TCP connection happening.

[leonida368]

hi @stephenw10 and thanks for the reply

Since I have worked with other firewalls up to now, I don't know PFsense very well yet. Could you tell me how to check the state table regarding Stunnel and do a pcap on the WAN filtered by port 636?

I would also kindly like to know if I did the right thing with regards to uploading the certificate and related key downloaded from the LDAP app created in the Google Workspace admin console:
I opened the certificate's .crt file with notepad and copied all the text (including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----) and pasted it into the Certificate text box given leaving as Certificate Type: X.509 (PEM).
Same thing for the key file that I pasted into the Private key data text box.
I did well?

A thousand thanks

[leonida368]

maybe I found it: Stunnel is not started!
I was suspicious of the fact that in Stunnel there is a "Start service" arrow and then in Status / Services it says Stopped. How come? How can I solve it? Thank you

[stephenw10]

Ok, that would do it!

Try to start it with the button there. Then check the system logs if it fails to start.

[leonida368]

Hi, ok I'll check, in the meantime if you kindly answer me to a previous question I asked, i.e. if I did the right thing regarding the uploading of the certificate and the related key downloaded from the LDAP app created in the Google Workspace administration console:
I opened the certificate .crt file with notepad and copied all the text (including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----) and pasted into the Certificate text box initially given as Certificate Type: X.509 (PEM).
Same thing for the key file I pasted into the Private Key Data text box.
Thank you

[stephenw10]

That's the Google CA cert they are using for your domain?

pfSense needs that to trust the LDAP server cert but it shouldn't need the key. You'd only need that to create certs from the CA. So only if you need to create a client cert perhaps.

[leonida368]

I understand, but is the procedure with which I pasted the certificate file correct?

[stephenw10]

Yes, that's fine for importing a cert.

[leonida368]

Hi @stephenw10 , Where can I see the cause of Stunnel not starting?

[stephenw10]

Well as I suggested I would try to start the service then check the logs.

[leonida368]

@stephenw10 said in Authenticating Users with Google Cloud Identity:

Well as I suggested I would try to start the service then check the logs.

Reply

I find Stunnel only in System/General and it only affects the installation phase. Then I don't see it anywhere else

[stephenw10]

How do you have it configured? What happens when you try to start it?

[leonida368]

login-to-view

[leonida368]

both in Services/Stunnel and in Status/Services if I click on the arrow to start it after a while it returns again

[stephenw10]

@leonida368 said in Authenticating Users with Google Cloud Identity:

https://docs.netgate.com/pfsense/en/latest/recipes/auth-google-gsuite.html

Ok so reviewing that it is a cert and not a CA cert. So did you import it with the key as described there?