[Solved] Authenticating against QNAP LDAP server

EvilUnicorn

I've been trying endlessly to configure the Authentication Server but I can't get it to work. Used to Authenticate against a MS AD, but now trying to get it to work with the LDAP server on my QNAP NAS.

What I did: Created group 'testgroup' and added new user 'test'. On pfSense I created the (local) group with the same name and for easy testing assigned all privileges. I've included the screenshot from the LDAP Admin browsing the QNAP and pfSense setup (only for view when logged in I notice).

Now I've tried about any attribute setting I could find in this forum and what Google had to offer but nothing works. User gets Authenticated but no groups show. Kinda useless this way. Lots of howtos for MS AD and that worked fine. Is the QNAP included LDAP server useless or am I still doing something wrong?

Regards

userTest.png_thumb

groupTestgroup.png_thumb

pfsenseConfig.png_thumb

noGroup.png_thumb

chris4916

Perhaps because you didn't pay attention to the way group membership is managed in your LDAP server.
Unfortunately, your screen copy doesn't show it. :-\

Basically, you have to know whether:

user's entry contains or not group membership information (I would say "à la Microsoft" with "IsMemberOf" attribute in user's entry containing pointer to group entry
group containing member attribute made of uid (basically, although is could be technically speaking something else)
group containing member attribute made of DN

(look at difference between RFC2307 and 2307bis)

EvilUnicorn

Solved it (with some help). Turns out I needed to check RFC2307 style group membership. I included a final screenshot with the working settings.

solved.jpg_thumb

KenAllen

Trying the same setup with OS X Open Directory (El Capitan).

It authenticates users but shows no groups.

Any thoughts?

chris4916

Difficult to comment further without additional information in term of:

configuration client side
DIT and schema LDAP server side

tester2

Hi Folks,
I am currently working with the same problem on pfsense 2.3.4 connecting with openLDAP with rfc 2307 scheme.
Looks like I have used correct settings, I have attached my screenshot. But users get access any way if user present in group as memberUid or not. From pcap it is clear that LDAP returns for group parsing that found 0 matches. But user could get access to openVPN.

Screenshot_20170523_171914.png_thumb
OpenLDAP.pcapng