LDAP broken since upgrade to 1.6

[rogalskij]

Upgraded to version 1.6, couldn’t login to LDAP. Updated the plugin, but everytime i try to add in a new LDAP server I get an error that says “Failed to add LDAP Server”

We use on prem LDAP, it has both port 389 and 636 but I truthfully don’t care which it uses. Any ideas I should check? This is our normal method here on campus for logging into FOG

[Tom Elliott]

@rogalskij Can you please take a look at if there’s an update for the ldap plugin on your machine?

I’m suspecting you just need to do the upgrade:

Plugin Management Page -> LDAP -> Update button.

[rogalskij]

@Tom-Elliott I was able to update the plugin and create a brand new LDAP that saves correctly, but having some trouble with associating the group itself. Where do I add the actual search DN for AD for the group to match to?

Under LDAP Groups, it just asks for a common name. Am I supposed to do this in "LDAP Group User Group Associations? Or is that for something else?

[Tom Elliott]

@rogalskij Good, the save works now.

The group search DN is on the LDAP server, not on the LDAP Group. Open LDAP Management, pick your server, and set Group Search DN to the OU that holds your groups, for example OU=Groups,DC=campus,DC=edu. On the same page, Group Name Attribute is the attribute FOG matches the group name against. For AD, use cn.

An LDAP Group is only the group’s name, as that attribute holds it. For example, FOG Admins, not the full DN.

Then give the group access. Open the LDAP Group:

• Role Association tab: pick the role its members get.
• User Group Association tab: pick the FOG user group its members join.

A member of that AD group can then sign in with their AD username, and gets the access you associated.

[rogalskij]

@Tom-Elliott

2 seconds after I posted the below, I was able to login. I am going to test imaging now.

Getting closer, but something is still off. I felt like I had to add an AD group somewhere specifically, for example if the 3 IT staff are part of the “ITStaff” group, shouldn’t I reference that somewhere within FOG itself? Instead of it pointing directly to an OU that could contain many groups? How does it know to look in ITStaff only for the users?

How does it know where to choose from? Also, do i still use just the samAccountName to login with?

Sorry I know you are swamped with requests today most likely.

[Tom Elliott]

@rogalskij LDAP Groups are their own thing.

https://docs.fogproject.org/en/1.6/management/web/ldap/

In the past groups are just strings on a field.

Now with Role based access controls you can actually associate multiple groups to different roles so this was separated and done a bit differently.

[Tom Elliott]

@rogalskij To answer your two questions directly:

How does FOG know to use only ITStaff? The LDAP Group is that reference. Create an LDAP Group named ITStaff on your server, and give it a role on its Role Association tab. The Group Search DN only tells FOG where to look for groups. When a user signs in, FOG checks which of your LDAP Groups the user belongs to. A user in none of them gets no access.

That check runs only when Group Matching is ticked on the LDAP server. Please confirm it is ticked. When it is off, every account that can bind to your AD can sign in, and gets the fallback role (Technician by default).

Username: yes. Set User Name Attribute on the server to sAMAccountName, and users sign in with their plain AD username.