Bug #1914
closedLDAP Authentication test wont use credentials
0%
Description
Im running pfSense 2.0, with an LDAP server running on CentOS6 (iRedmail). Both are in virtual machines, on a connected virtual interface, with fill connectivity.
From my physical machine, I can use LDAPTool to connect to LDAP and browse. I am also able to telnet from the pfsense box to port 389 on the LDAP server. However, when I set up LDAP on pfSense (as shown in http://db.tt/08MVfSTu ) and click "save and test" under authentication, I get the following message:
http://db.tt/vGLqNiHZ
Once I enabled anonymous authentication LDAP, save and test works.
Additionally, to track the issue down, I added the following to /etc/inc/auth.inc (near line 723)
if ($ldapanon == true) { if (!$res = @ldap_bind($ldap))) { @ldap_close ($ldap); --> log_error("break 3"); //My additional code return false; } else........
And on clicking "Save and test", I do get that "break 3" in /var/log/system.log even though it is not set for anonymous auth.
I have tried deleting and recreating the LDAP server in pfSense, as well as rebooting in between, and the issue persists. Only with anonymous auth enabled in LDAP can pfsense connect (otherwise, it errors out with "pfmaster php: /system_usermanager_settings_test.php: ERROR! ldap_get_groups() could not bind to server iRedmail.")
Updated by Chris Buechler over 13 years ago
- Category set to User Manager / Privileges
- Target version set to 2.0.1
- Affected Version set to 2.0
Updated by c c over 13 years ago
After a little more testing, it looks like it still WILL use the credentials after the bind test. I did not give anonymous enough rights for the test to completely succeed if I actually check "Use anonymous credentials", and I do get a proper error later on if I try to bind anonymously.
That is, if I use proper credentials, and I enable anonymous access on the LDAP server, it will bind properly and display the OUs properly. If I try to bind anonymously, it will pass both the connection and bind test, but will error out after that. If I disable anonymous binds on the LDAP server, it will under no circumstances pass the "bind" test.