pfSense

The sssd-ldap(5) man page (unrelated to this bug, just informational) gives a little more insight into this:

ldap_schema (string)
           Specifies the Schema Type in use on the target LDAP server. Depending on the selected schema, the default attribute
           names retrieved from the servers may vary. The way that some attributes are handled may also differ.

           Four schema types are currently supported:

           ·   rfc2307

           ·   rfc2307bis

           ·   IPA

           ·   AD

           The main difference between these schema types is how group memberships are recorded in the server. With rfc2307, group
           members are listed by name in the memberUid attribute. With rfc2307bis and IPA, group members are listed by DN and
           stored in the member attribute. The AD schema type sets the attributes to correspond with Active Directory 2008r2
           values.

           Default: rfc2307

It appears that pfSense is expecting an Active Directory type schema, whereas The default OpenLDAP schema is following RFC2307, with a memberUid attribute.

So I guess this is a feature request to support RFC2307. When I get some time, I may look into hacking at this.

Added a checkbox for RFC2307 and an input field for the group object class (defaults to posixGroup). To activate, check the box and fill in the group object class. Works fine here with a default OpenLDAP style setup. Box defaults to unchecked for the existing behavior which still works fine with AD.

Leaving this open because the code will need to be brought into 2.3 after the bootstrap merge.

It does not work for me as I expected, but I have to admit that I am a LDAP-noop.

My setup contains of

ou=Groups,dc=siebenlinden,dc=de

ou=People,dc=siebenlinden,dc=de

As authentication containers, I give ou=People,dc=siebenlinden,dc=de .
User naming attribute is "uid", group naming attribe "cn" and group member attribute "member".

I ticked the RFC2307-Checkbox.
The respective group I test is also added as "pfsense-group". Authentication via Diagnostics->Authentication works, but the groups are not shown.

I also installed the memberOf overlay (server is slapd 2.4.31-1+nmu2ubuntu8.2, ubuntu 14.04), but as far as i understood (and what tools like ldapsearch seem to confirm) this does work for FILTERING objects, but does not really add the attribute. The tests to use this but without the RFC2307-Box ticked also failed.

Is there any way to debug this issue further for me?

pfsense is at 2.2.5-RELEASE (i386) .

Btw this is also featured in Feature #2869 iiuc.

I tried to find the code that does the ldap group lookup. If I am not mistaken, it is located at https://redmine.pfsense.org/projects/pfsense/repository/revisions/149efbeac4e6eaa9d8062f26bbc172c86020e231/entry/src/etc/inc/auth.inc#L1036 (root/src/etc/inc/auth.inc#1036).

I then fired up ldapsearch with the guessed parameters:

 ldapsearch -h MYHOST -W -b dc=siebenlinden,dc=de -D cn=ADMIN_CN -s sub '(&(objectClass=groupofnames)(member=FIRSTNAME.LASTNAME))'

If I however correctly give the full DN as member-"variable", like

 ldapsearch -h MYHOST -W -b dc=siebenlinden,dc=de -D cn=ADMIN_CN -s sub '(&(objectClass=groupofnames)(member=DN_OF_USER))'

That makes sense to me. The code (and maybe RFC2307) assumes that the member attribute is filled with the username, whereas the typical setup and apparently the scheme wants to have a DN there. Probably there are different between posixGroup/memberUid and groupOfNames/member ...?

Felix Wolfsteller wrote:

That makes sense to me. The code (and maybe RFC2307) assumes that the member attribute is filled with the username, whereas the typical setup and apparently the scheme wants to have a DN there. Probably there are different between posixGroup/memberUid and groupOfNames/member ...?

Man, I am sorry, that should not happen, the first answer to this feature request stated the differences between rfc2307 ("memberuid" with ...well uid) and rfc2307bis ("member" with dn).

Also, I could get the RFC2307-style (posixGroup with memberuid) working, by broadening the search scope to "entire subtree". Awesome. I understood some php code.

I opened a Feature Request for rfc2307bis support:
https://redmine.pfsense.org/issues/5461 .

This is not a support system. For help, please post on the forum, mailing list, or use another support method.

This bug is old, and resolved. It works perfectly, and I use it every day. If you have an issue it is different than this. Discuss the issue first on the forum, mailing list, reddit, etc. Do not open a new issue until after it has been discussed and configuration issues have been ruled out definitively by others.