Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    LDAP Extended Query with multiple parameters in 2.1

    Scheduled Pinned Locked Moved General pfSense Questions
    1 Posts 1 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jalano
      last edited by

      Hey, so I just managed to get something working that had been really frustrating for a while, so I thought I'd post here just in case someone else was hitting their head against the same wall!

      We're using OpenVPN to let people into our network, and we also want to use our OpenLDAP server to authenticate users.  But we don't want to just let everyone in our LDAP directory in, only people who should have VPN priveleges, and also we want to make sure their account is still active.

      So all of the regular guides out there about how to setup an LDAP server are pretty much spot-on.  For the record, you need to set Base DN: and Authentication containers.  In my example, this would be:

      Base DN: dc=fishpuzzle,dc=com
      Authentication containers: ou=People
      User naming attribute: uid

      The problem is that this won't have a way to restrict the which users who can authenticate.  We have two extra fields in our LDAP database which we use; userStatus and userService.  We want users to have BOTH userStatus=active AND userService=vpn in order for us to want you get in our vpn.  userStatus is used to immediately deny services to someone when we don't want to completely delete them from our LDAP directory; we can just toggle userStatus=disabled and leave everything else still present.  And userService=vpn is granted only to the people who should have vpn access; we don't give it to people who are just in our directory for having a phone number and email address for example.  So here's an example of a user named snoopy who we want to have access:

      
      dn: uid=snoopy,ou=People,dc=fishpuzzle,dc=com
      uid: snoopy
      cn: Snoopy Dog
      userStatus=active
      userService=vpn
      

      In normal LDAP queries, the way to make sure that both fields are present is to use a query string like this:

      (&(uid=snoopy)(userStatus=active)(userService=vpn))
      

      The big mystery to me was, how do we get this query restriction into our pfSense config?

      Well, reading through the authentication code (/etc/inc/auth.inc) had the answer.  Partway through the code, I see where the External Query contents get put in the query:

      $ldapfilter = "(&({$ldapnameattribute}={$username})({$ldapextendedquery}))";
      

      The uid part is already there for you as part of the standard ldap and openvpn gui which fills out the $ldapnameattribute and $username.  The trick is getting the right value for $ldapextendedquery which happens to already be enclosed in parenthesis.

      Now this turns out to be very easy if you only have one query parameter you want, like userService=vpn.

      If that's the case, all you need to put in Extended Query is```
      userService=vpn

      
      But what if you need two attributes?  What you need to put inside the extended query field on the ldap page is:
      
      

      userStatus=active)(userService=vpn

      
      Yes, you're reading that right - it is *missing* the leading left parenthesis and the right parenthesis symbols!
      
      As you can guess, you can string any number of these together to make a bunch of required parameters to be present for a specific LDAP record to make sure it only authenticates to a subset of users by doing it this way.  You just have to make sure to realize that whatever the expression is, it's going to be surrounded by a single set of parenthesis!
      
      Hopefully this helps someone!
      
      - jalano
      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.