• Recent
    • Unsolved
    • Tags
    • Popular
    • Users
    • Groups
    • Search
    • Register
    • Login

    Extend LDAP plugin to support AD authentication

    Scheduled Pinned Locked Moved Solved
    Feature Request
    8
    64
    28.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JJ FullmerJ
      JJ Fullmer Testers @george1421
      last edited by

      @george1421 Updated to latest rc11 and reinstalled the ldap plugin, great success.
      I was able to add a server no problem.

      Just a recommendation though, or maybe it’s a question. I figure the bindDN is the user you use to sign in to the domain and the same with the password. Perhaps it’s possible to utilize the same method or maybe even link to the existing one that fog uses for joining to the domain?
      Just cause it’s gonna be prone to error and confusion if to set up a binding user you have to put in that full ldap style query with the cn’s and the ou’s, and the dc’s and what have you. Or maybe I’m misunderstanding that field.

      Have you tried the FogApi powershell module? It's pretty cool IMHO
      https://github.com/darksidemilk/FogApi
      https://fogapi.readthedocs.io/en/latest/
      https://www.powershellgallery.com/packages/FogApi
      https://forums.fogproject.org/topic/12026/powershell-api-module

      george1421G 1 Reply Last reply Reply Quote 0
      • JJ FullmerJ
        JJ Fullmer Testers @george1421
        last edited by

        @george1421 Also, maybe I’m just looking in the wrong place for the documentation, so feel free to direct me to where this may already be written. But what do I do after I set up a server? Are users going to just populate automatically or is there another step? I feel like I’m missing something.

        Have you tried the FogApi powershell module? It's pretty cool IMHO
        https://github.com/darksidemilk/FogApi
        https://fogapi.readthedocs.io/en/latest/
        https://www.powershellgallery.com/packages/FogApi
        https://forums.fogproject.org/topic/12026/powershell-api-module

        george1421G 1 Reply Last reply Reply Quote 0
        • george1421G
          george1421 Moderator @JJ Fullmer
          last edited by

          @JJ-Fullmer I’m not sure I fully understand your question.

          In rc11 it may or may not show the bind dn just yet. That code is in a state of flux a bit.

          But in general we will switch over to using a bind DN (which needs to be in full ldap format) to initially connect to the ldap server to look up the user’s cn (in full ldap format). We were using just the short form of the user’s credentials (user@domain.com) to bind to ldap, but that only appears to work reliably with AD.

          Tom and (or at least I) will have another coding session tonight to see if we can get this wrapped up. All of the parts work independently now we just need to get them to work together.

          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!

          1 Reply Last reply Reply Quote 1
          • george1421G
            george1421 Moderator @JJ Fullmer
            last edited by

            @JJ-Fullmer The documentation hasn’t been written just yet because our approach changed overnight. Let me refresh my server and I’ll post something here to get you started. I can’t guarantee it works until I update my server and test it.

            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!

            1 Reply Last reply Reply Quote 1
            • george1421G
              george1421 Moderator
              last edited by

              Here is a screen shot of what is expected.

              0_1474644364724_ldap_plugin_settings.png

              Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!

              Wayne WorkmanW 1 Reply Last reply Reply Quote 1
              • Wayne WorkmanW
                Wayne Workman @george1421
                last edited by

                @george1421 I’d go further by limiting the bind DN account to only the OUs where the fog users and fog groups will be.

                Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                Daily Clean Installation Results:
                https://fogtesting.fogproject.us/
                FOG Reporting:
                https://fog-external-reporting-results.fogproject.us/

                Tom ElliottT 1 Reply Last reply Reply Quote 1
                • Tom ElliottT
                  Tom Elliott
                  last edited by

                  I don’t know how well it will work, but my testing of the most current ldap stuff appears to be working pretty well.

                  At least when done against the ldap server from forumsys.

                  Here’s my “configuration” that seems to work.

                  I don’t know all the other potentials but at least others can see the “POC” in action.

                  0_1474746815583_upload-2e4dc264-091f-4b62-9e5e-d3c44ad383cc

                  With any luck, others can see the “potential” and perform some more testing within their own environments.

                  It follows, more or less, in line with what @george1421 has done, but with a few caveat’s to what was required to get it working for the ldap I was testing against.

                  Hopefully it will work for AD environments just as easily as it will for what I’ve tested already.

                  Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                  Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                  Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                  1 Reply Last reply Reply Quote 0
                  • Tom ElliottT
                    Tom Elliott @Wayne Workman
                    last edited by

                    @Wayne-Workman BindDN can be anything really. This is totally up to the administrator, and it typically requires a password. This is simply so the server can find data and ensure all is fine.

                    Once the bind is validated and finds the user, the bind is handed over to the user who’s actually trying to login. From there we find the associated elements for that user and validate the area (or not) they are to be a part of.

                    Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                    Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                    Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                    Wayne WorkmanW 1 Reply Last reply Reply Quote 0
                    • Wayne WorkmanW
                      Wayne Workman @Tom Elliott
                      last edited by

                      @Tom-Elliott Right. I was talking about restricting the specified user’s privileges - less loose ends. This is not a fog thing, this is something an admin would do in Active Directory.

                      Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                      Daily Clean Installation Results:
                      https://fogtesting.fogproject.us/
                      FOG Reporting:
                      https://fog-external-reporting-results.fogproject.us/

                      1 Reply Last reply Reply Quote 0
                      • F
                        Fernando Gietz Developer
                        last edited by

                        Hello!! A little feedback about this wonderful plugin 🙂
                        I installed it this morning (this morning here in Spain) and I like the different options to setup it but, for me, is a little confused fill the correct boxes to run it.

                        Actually we use openLDAP server (we have AD too but we don use it to validate the user under FOG), then I dont know which boxes need to fill to run the plugin well. The old version (RC-10) was easy (although I need to change some things in the code to run it well).

                        Questions:
                        Admin groups and Mobile groups, what these parameters are for? ¿purpose?
                        If I have a LDAP server, Bind DN and Bind password, is necessary fill these parameters?

                        Bugs:
                        In line 370 from ldap.class.php file:

                        $userDN = sprintf(
                                         '%s=%s,%s',
                                         $userNamAttr,
                                         $user,
                                         $userSearchDN
                        );
                        

                        The $userNamAttr and $userSearchDN are empty, I dont know the reason, I have changed it to:

                        $userDN = sprintf(
                                         '%s=%s,%s',
                                         strtolower($this->get('userNamAttr')),
                                         $user,
                                         strtolower($this->get('searchDN'))
                        );
                        

                        When the code tries to do the bind, always return me false.

                        george1421G 1 Reply Last reply Reply Quote 0
                        • george1421G
                          george1421 Moderator @Fernando Gietz
                          last edited by george1421

                          @Fernando-Gietz I haven’t tested it as of now since it was pushed to RC11. I was working on a pre release of RC11 and it worked with AD.

                          I know the wiki page hasn’t been written as of now so there is no information on the new features of the plugin and we have not tested it with all situations.

                          I’ll have to look at the lines you mentioned to see what is going on.

                          To answer your question about the logic of the Admin and mobile groups. The reason is security. Just because you are a valid ldap user doesn’t mean you should have access to FOG. So in addition to being a valid ldap user, your account must be found in either an Admin group (as defined by that field) or a Mobile group (as defined by that field). This is consistent with the two user classes in FOG. If your account appears in both groups then the Admin account wins and you have admin access to FOG. There is a graphic below in this thread that I posted with text telling what each field does too.

                          I’ll refresh my server with RC11 and see if I can track down the bug.

                          I do have to say if you had the ldap plugin installed before RC11 you must uninstall and reinstall it for the database to be updated correctly. The structure has changed from the older style ldap plugin

                          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!

                          george1421G 1 Reply Last reply Reply Quote 1
                          • george1421G
                            george1421 Moderator @george1421
                            last edited by george1421

                            @george1421 I can report (at least for AD LDAP) the plugin works as intended. I’m going to dig a bit deeper to make sure its not just a mistake on my part.

                            I can say I based it working off a false assumption. I still had the AD user cached based on some of the intermediate code. That is why the login worked every time. There is something wrong in the code. Tom and I worked on it for several hours last night. I see what its doing, but need to focus on why its doing what its doing.

                            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!

                            george1421G 1 Reply Last reply Reply Quote 0
                            • george1421G
                              george1421 Moderator @george1421
                              last edited by

                              @george1421 This thread and the ldap plugin is not dead. I have the code working with AD just fine, I need to perform some GUI updates to the web form to get it to work the way I want it to. But I think we are really close with the working solution.

                              Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!

                              george1421G 1 Reply Last reply Reply Quote 1
                              • george1421G
                                george1421 Moderator @george1421
                                last edited by

                                @george1421 I’ve been working on other projects and haven’t had time to get back to this one. I have this plugin working in my production environment and it is working well. I’m to the point where I would like to test it in a few more AD environment as well as OpenLDAP. If you are willing to help test, please let me know and I’ll send the instructions. I have not yet submitted the code to the Developers for their review to be included in the official 1.3.0RC stream as of now. I wanted to ensure it functioned as we expected it before adding additional workload one the developers.

                                Here is a current screen clip of the fields and the expected values. We’ve added the ability to only do a name match with users at the search base dn. With this option the user must only appear in a defined OU or below. If a user is in that OU and the uid and password match then the user is considered a FOG admin. I don’t like using this option but there were several use cases (like all my fog admins are already in a defined OU) where I can understand the requirement (but still not like it 😄 ). The more secure way is to use group matching. In this case you will need to create an AD/LDAP group and put the admin/mobile users in these groups. This now changes the login requirements to 1) You must be a users in the specified OU, 2) Your uid and password must authenticate 3) Your uid must be in the authorized group for FOG.

                                0_1476654206972_Screenshot_ldap_example.png

                                Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!

                                1 Reply Last reply Reply Quote 2
                                • F
                                  Fernando Gietz Developer
                                  last edited by

                                  Hi George,

                                  I can see that you added the option to use AD groups to define admin/mobile profiles or not. Can I test it anyway? I have update the server version to RC13, and in this version until is not operative these changes.

                                  1 Reply Last reply Reply Quote 0
                                  • Tom ElliottT
                                    Tom Elliott
                                    last edited by

                                    I’ve updated the working RC 15 branch to contain the changes as @george1421 made and tested some more things. Appears to still work with open LDAP though I need more confirmation to know if it is working for ad.

                                    Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                                    Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                                    Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                                    x23piracyX 1 Reply Last reply Reply Quote 0
                                    • x23piracyX
                                      x23piracy @Tom Elliott
                                      last edited by Wayne Workman

                                      @Tom-Elliott Hi, i would like to test it but what’s the url to checkout working branch with git?
                                      What if RC15 is released can i just change to trunk /bin/installfog.sh again?

                                      Regards X23

                                      ║▌║█║▌│║▌║▌█

                                      Wayne WorkmanW 1 Reply Last reply Reply Quote 0
                                      • Wayne WorkmanW
                                        Wayne Workman @x23piracy
                                        last edited by

                                        I helped @x23piracy - also - We don’t want folks knowing how, it will cause more issues than help.

                                        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                                        Daily Clean Installation Results:
                                        https://fogtesting.fogproject.us/
                                        FOG Reporting:
                                        https://fog-external-reporting-results.fogproject.us/

                                        x23piracyX 1 Reply Last reply Reply Quote 0
                                        • x23piracyX
                                          x23piracy @Wayne Workman
                                          last edited by

                                          @Wayne-Workman i sell that information for 10 bucks :D… joking

                                          ║▌║█║▌│║▌║▌█

                                          1 Reply Last reply Reply Quote 0
                                          • george1421G
                                            george1421 Moderator
                                            last edited by george1421

                                            1.3.0RC15 has been released with the updated ldap plugin support. You must upgrade to RC15, uninstall and then reinstall the LDAP plugin to ensure the ldap configuration database is created correctly. Please understand when the ldap plugin is uninstalled it also erases any settings for the plugin. If you need these settings archive the settings before removing the plugin.

                                            We still have an issue with non-base ascii characters in the ldap search dn, or user path. If you have these international characters the ldap plugin will fail to authenticate. We are working on this issue, but we appear unsuccessful at this time. For a US English characters the ldap plugin does work as far as we tested with AD and OpenLDAP

                                            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!

                                            1 Reply Last reply Reply Quote 1
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 2 / 4
                                            • First post
                                              Last post

                                            196

                                            Online

                                            12.0k

                                            Users

                                            17.3k

                                            Topics

                                            155.2k

                                            Posts
                                            Copyright © 2012-2024 FOG Project