Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feature: LDAP assumes memberof is available which is deprecated in OpenLDAP #332

Closed
ForceFaction opened this issue Apr 10, 2024 · 2 comments
Closed

feature: LDAP assumes memberof is available which is deprecated in OpenLDAP #332

ForceFaction opened this issue Apr 10, 2024 · 2 comments
Assignees
@greenpau
Labels
feature need triage

Comments

@ForceFaction
Copy link

A clear and concise description of what you want the system to do.

The system should not assume memberof for LDAP. Every group contains a list of memberUids which should be searched instead for the users uid.

What are the Caddyfile directives that need to be added.

The Caddyfile needs a flag that disables memberof. Then the groups a user belongs to can be found with a search_group_filter like this (&(memberUid=%s)(objectClass=posixGroup)) where %s is the uid of the user.
@greenpau
Copy link
Owner

@ForceFaction , what are the changes you propose? Please provide a sample Caddyfile snippet. What are the changes to “go-authcrunch”? https://github.com/greenpau/go-authcrunch/blob/main/pkg/ids/ldap/authenticator.go

@birlorg
Copy link

birlorg commented Oct 19, 2024

@ForceFaction

If you add posix_groups option to the ldap:// URL setting, it will do a separate search for group membership with an attribute option of search_group_filter

servers {
        ldap://ldap.example.com posix_groups
      }

Then in the attributes section:

 search_base_dn "DC=example,DC=com"
 search_filter "(&(|(uid=%s)(email=%s))(objectClass=person))"
 search_group_filter "(member=%s)"

Obviously the search strings will need to be changed to work with your openldap setting, but the %s in search_group_filter will be the full dn of the user. See the docs: https://docs.authcrunch.com/docs/authenticate/ldap/ldap

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@greenpau greenpau

Labels
feature need triage
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@greenpau @ForceFaction @birlorg