Unable to configure LDAP authorizations.

[BegBlev]

Hello,

I am unable to configure my Netbox container to get basic authorizations (is_active, is_staff and is_superuser) from LDAP (FreeIPA) groups .

I already configured a Netbox VM (v2.10.10) to do this and it works perfectly. But unfortunately, it does not work with my v2.11.12 container.
The container is an unmodified "netboxcommunity/netbox:v2.11.12-ldap" container from Docker Hub. The configuration is done through environment variables.

If I don't configure group search then authentication works. The configuration is then:

REMOTE_AUTH_ENABLED="true"
REMOTE_AUTH_BACKEND="netbox.authentication.LDAPBackend"
AUTH_LDAP_SERVER_URI="ldap://freeipa.domain.test"
REMOTE_AUTH_CREATE_USER="true"
AUTH_LDAP_BIND_AS_AUTHENTICATING_USER="true"
AUTH_LDAP_USER_DN_TEMPLATE="uid=%(user)s,cn=users,cn=accounts,dc=domain,dc=test"
LDAP_IGNORE_CERT_ERRORS="true"

If I configure group search then authentication doesn't work (not able to login). The configuration is then:

REMOTE_AUTH_ENABLED="true"
REMOTE_AUTH_BACKEND="netbox.authentication.LDAPBackend"
AUTH_LDAP_SERVER_URI="ldap://freeipa.domain.test"
REMOTE_AUTH_CREATE_USER="true"
AUTH_LDAP_BIND_AS_AUTHENTICATING_USER="true"
AUTH_LDAP_USER_DN_TEMPLATE="uid=%(user)s,cn=users,cn=accounts,dc=domain,dc=test"
AUTH_LDAP_REQUIRE_GROUP_DN="cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=test"
AUTH_LDAP_GROUP_SEARCH_BASEDN="cn=groups,cn=accounts,dc=domain,dc=test"
AUTH_LDAP_GROUP_SEARCH_CLASS="groupofnames"
AUTH_LDAP_FIND_GROUP_PERMS="true"
AUTH_LDAP_MIRROR_GROUPS="false"
AUTH_LDAP_IS_SUPERUSER_DN="cn=netbox-admins,cn=groups,cn=accounts,dc=domain,dc=test"
AUTH_LDAP_IS_ADMIN_DN="cn=netbox-admins,cn=groups,cn=accounts,dc=domain,dc=test"
LDAP_IGNORE_CERT_ERRORS="true"

I took some traces on LDAP (FreeIPA) server.
In the case it works (with the Netbox VM) I have these:

[root@idm ~]# tail -f /var/log/dirsrv/slapd-DOMAIN-TEST/access
[19/Jan/2022:11:37:19.892424161 -0500] conn=3044415 op=0 BIND dn="uid=bob,cn=users,cn=accounts,dc=domain,dc=test" method=128 version=3
[19/Jan/2022:11:37:19.917490798 -0500] conn=3044415 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.000744266 optime=0.025087478 etime=0.025830115 dn="uid=bob,cn=users,cn=accounts,dc=domain,dc=test"
[19/Jan/2022:11:37:19.925543168 -0500] conn=3044415 op=1 SRCH base="uid=bob,cn=users,cn=accounts,dc=domain,dc=test" scope=0 filter="(objectClass=*)" attrs=ALL
[19/Jan/2022:11:37:19.927211939 -0500] conn=3044415 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000108758 optime=0.001682283 etime=0.001789117
[19/Jan/2022:11:37:19.928151971 -0500] conn=3044415 op=2 CMP dn="cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=test" attr="member"
[19/Jan/2022:11:37:19.928509058 -0500] conn=3044415 op=2 RESULT err=6 tag=111 nentries=0 wtime=-9873692.799579442 optime=9873691.200866419 etime=0.000443996
[19/Jan/2022:11:37:19.929187533 -0500] conn=3044415 op=3 CMP dn="cn=netbox-admins,cn=groups,cn=accounts,dc=domain,dc=test" attr="member"
[19/Jan/2022:11:37:19.929444256 -0500] conn=3044415 op=3 RESULT err=6 tag=111 nentries=0 wtime=-9873692.798524298 optime=9873691.201801777 etime=0.000324313
[19/Jan/2022:11:37:19.929745639 -0500] conn=3044415 op=4 CMP dn="cn=netbox-admins,cn=groups,cn=accounts,dc=domain,dc=test" attr="member"
[19/Jan/2022:11:37:19.929950808 -0500] conn=3044415 op=4 RESULT err=6 tag=111 nentries=0 wtime=-9873692.797962939 optime=9873691.202308409 etime=0.000269750

Binding is done with login user (which is the expected behaviour) and then searches are done before unbinding.

In the case it does not work (with the Netbox container) I have these:

[root@freeipa cloud]# tail -f /var/log/dirsrv/slapd-DOMAIN-TEST/access
[19/Jan/2022:19:37:17.162526931 +0000] conn=834 fd=102 slot=102 connection from 172.16.0.98 to 192.168.201.29
[19/Jan/2022:19:37:17.162852163 +0000] conn=834 op=0 BIND dn="uid=bob,cn=users,cn=accounts,dc=domain,dc=test" method=128 version=3
[19/Jan/2022:19:37:17.236052843 +0000] conn=834 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0073470336 dn="uid=bob,cn=users,cn=accounts,dc=domain,dc=test"
[19/Jan/2022:19:37:17.236942543 +0000] conn=834 op=1 BIND dn="" method=128 version=3
[19/Jan/2022:19:37:17.237098208 +0000] conn=834 op=1 RESULT err=0 tag=97 nentries=0 etime=0.0000222190 dn=""
[19/Jan/2022:19:37:17.240362484 +0000] conn=834 op=2 CMP dn="cn=ipausers,cn=groups,cn=accounts,dc=domain,dc=test" attr="member"
[19/Jan/2022:19:37:17.240538800 +0000] conn=834 op=2 RESULT err=50 tag=111 nentries=0 etime=0.0000233711
[19/Jan/2022:19:37:17.253773471 +0000] conn=834 op=3 UNBIND
[19/Jan/2022:19:37:17.253792563 +0000] conn=834 op=3 fd=102 closed - U1

Binding is done with login user for authentication (expected behaviour) but then there is a new bind with dn="" for group search.

Any help appreciated.
Thank you
Vince

[ryanmerolle]

You need to troubleshoot with some logging.

A few helpful resources:

• netbox-docker WIKI LDAP
• logging.py - uncomment out the logging script to see more info.

[stopkadr]

Hi @BegBlev,
Below is the configuration that works in my FreeIPA setup:

REMOTE_AUTH_ENABLED: True
REMOTE_AUTH_BACKEND: "netbox.authentication.LDAPBackend"
AUTH_LDAP_SERVER_URI: 'ldaps://freeipa1.idm.domain.test ldaps://freeipa2.idm.domain.test'
AUTH_LDAP_BIND_DN: "uid=netbox-service,cn=sysaccounts,cn=etc,dc=idm,dc=domain,dc=test"
AUTH_LDAP_BIND_PASSWORD: "XXXXXXXXXXXX"
AUTH_LDAP_BIND_AS_AUTHENTICATING_USER: True
AUTH_LDAP_USER_DN_TEMPLATE: "uid=%(user)s,cn=users,cn=accounts,dc=idm,dc=domain,dc=test"
AUTH_LDAP_GROUP_SEARCH_CLASS: "groupOfNames"
AUTH_LDAP_USER_SEARCH_BASEDN: "cn=users,cn=accounts,dc=idm,dc=domain,dc=test"
AUTH_LDAP_USER_SEARCH_ATTR: "uid"
AUTH_LDAP_GROUP_SEARCH_BASEDN: "cn=groups,cn=accounts,dc=idm,dc=domain,dc=test"
AUTH_LDAP_GROUP_TYPE: 'GroupOfNamesType'
AUTH_LDAP_REQUIRE_GROUP: "cn=netbox_users,cn=groups,cn=accounts,dc=idm,dc=domain,dc=test"
AUTH_LDAP_MIRROR_GROUPS: True
AUTH_LDAP_REQUIRE_GROUP_DN: "cn=netbox_active,cn=groups,cn=accounts,dc=idm,dc=domain,dc=test"
AUTH_LDAP_IS_ADMIN_DN: "cn=netbox_staff,cn=groups,cn=accounts,dc=idm,dc=domain,dc=test"
AUTH_LDAP_IS_SUPERUSER_DN: "cn=netbox_superuser,cn=groups,cn=accounts,dc=idm,dc=domain,dc=test"
AUTH_LDAP_FIND_GROUP_PERMS: True
LDAP_IGNORE_CERT_ERRORS: True