openvpn auth with openldap

milovikasse

Hi All,

I configured openvpn server with authenticated from openldap. Installed openvpn and openvpn-auth-ldap both, but openvpn user can authenticated from opeldap but when I changes grouprequired = true in openvpn-auth-ldap.conf ii stops authentication.

openvpn-auth-ldap.conf
<LDAP>
# LDAP server URL
URL ldap://ldapaserverIP

# Bind DN (If your LDAP server doesn't support anonymous binds)
# BindDN uid=Manager,ou=People,dc=example,dc=com

# Bind Password
# Password SecretPassword

# Network timeout (in seconds)
Timeout 15

# Enable Start TLS
TLSEnable no

# Follow LDAP Referrals (anonymously)
FollowReferrals yes

# TLS CA Certificate File
TLSCACertFile /usr/local/etc/ssl/ca.pem

# TLS CA Certificate Directory
TLSCACertDir /etc/ssl/certs

# Client Certificate and key
# If TLS client authentication is required
TLSCertFile /usr/local/etc/ssl/client-cert.pem
TLSKeyFile /usr/local/etc/ssl/client-key.pem

# Cipher Suite
# The defaults are usually fine here
# TLSCipherSuite ALL:!ADH:@STRENGTH
</LDAP>

<Authorization>
# Base DN
BaseDN "ou=users,dc=server,dc=com"

# User Search Filter
#SearchFilter "(&(uid=%u)(accountStatus=active))"
SearchFilter "(&(uid=%u))"

# Require Group Membership
RequireGroup true <----------------When I changes it into false it starts working but not with true.>

# Add non-group members to a PF table (disabled)
#PFTable ips_vpn_users

<Group>
BaseDN "ou=groups,dc=server,dc=com"
SearchFilter "(|(cn=openvpn))"
MemberAttribute memberUid
# Add group members to a PF table (disabled)
#PFTable ips_vpn_eng
</Group>
</Authorization>

Please help.

brendan

make sure your ldap instance is logging the bits you need to be looking at. i use the below, which i think you would use too. make a note of the original setting so you can revert back to it when you are done. get on the ldap box and start an ldap modify session:

ldapmodify -QY EXTERNAL -H ldapi:///

set your logging:

dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: stats stats2

run your attempt to login, with the RequireGroup set to true. when you fail, review the ldap logs to make sure your dn's, cn's, uid's, oid's and everything else match up. read the logs carefully. you are likely trying to match a user attribute to one that does not exist in the DIT.

milovikasse

Thanks for reply.
I have samba and squid server are working with ldap server auth with there respective group but not openvpn, I checked in openldap log and found some error with openvpn user auth
_____ here opevpn is group
May 8 11:23:02 ldapauth slapd[25925]: conn=1810 fd=34 ACCEPT from IP=ovpnserver:57574 (IP=0.0.0.0:389)
May 8 11:23:02 ldapauth slapd[25925]: conn=1810 op=0 SRCH base="ou=users,dc=server,dc=com" scope=2 deref=0 filter="(&(uid=userID))"
May 8 11:23:02 ldapauth slapd[25925]: conn=1810 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text=
May 8 11:23:02 ldapauth slapd[25925]: conn=1811 fd=35 ACCEPT from IP=ovpnserver:57575 (IP=0.0.0.0:389)
May 8 11:23:02 ldapauth slapd[25925]: conn=1811 op=0 BIND dn="uid=userID,ou=users,dc=server,dc=com" method=128
May 8 11:23:02 ldapauth slapd[25925]: conn=1811 op=0 BIND dn="uid=userID,ou=users,dc=server,dc=com" mech=SIMPLE ssf=0
May 8 11:23:02 ldapauth slapd[25925]: conn=1811 op=0 RESULT tag=97 err=0 text=
May 8 11:23:02 ldapauth slapd[25925]: conn=1811 op=1 UNBIND
May 8 11:23:02 ldapauth slapd[25925]: conn=1811 fd=35 closed
May 8 11:23:02 ldapauth slapd[25925]: conn=1810 op=1 SRCH base="ou=groups,dc=server,dc=com" scope=2 deref=0 filter="(|(cn=openvpn))"
May 8 11:23:02 ldapauth slapd[25925]: conn=1810 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
May 8 11:23:02 ldapauth slapd[25925]: conn=1810 op=2 CMP dn="cn=ovpn,ou=groups,dc=server,dc=com" attr="memberUid"
May 8 11:23:02 ldapauth slapd[25925]: conn=1810 op=2 RESULT tag=111 err=5 text=
May 8 11:23:02 ldapauth slapd[25925]: conn=1810 op=3 UNBIND
May 8 11:23:02 ldapauth slapd[25925]: conn=1810 fd=34 closed
_____

I can't under stand here what is err=5.

milovikasse

I can see search result from ldapserver

ldapsearch -h ldapserver -x -b "ou=groups,dc=server,dc=com" "(|(cn=openvpn))" "memberUid"

# extended LDIF
#
# LDAPv3
# base <ou=groups,dc=server,dc=com> with scope subtree
# filter: (|(cn=openvpn))
# requesting: memberUid
#

# openvpn, groups, pkrgroup.com
dn: cn=openvpn,ou=groups,dc=server,dc=com
memberUid: userID1
memberUid: userID2

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

milovikasse

sorry by mistake I printed ovpn instead of openvpn.

May 8 11:23:02 ldapauth slapd[25925]: conn=1810 op=2 CMP dn="cn=ovpn,ou=groups,dc=server,dc=com" attr="memberUid"

instead of

May 8 11:23:02 ldapauth slapd[25925]: conn=1810 op=2 CMP dn="cn=openvpn,ou=groups,dc=server,dc=com" attr="memberUid"

brendan

http://www.openldap.org/doc/admin24/appendix-ldap-result-codes.html

H.1. Non-Error Result Codes

These result codes (called "non-error" result codes) do not indicate an error condition:

        success (0),
        compareFalse (5),
        compareTrue (6),
        referral (10), and
        saslBindInProgress (14).

The success, compareTrue, and compareFalse result codes indicate successful completion (and, hence, are referred to as "successful" result codes).

The referral and saslBindInProgress result codes indicate the client needs to take additional action to complete the operation.

your comparison is returning as false.

milovikasse

I don't understand why comparison is being false, even I checkd it with ldapsearch and it result success and samba and squid servers are working fine with same ldap server but not openvpn.

ldapsearch -h ldapserver -x -b "ou=groups,dc=server,dc=com" "(|(cn=openvpn))" "memberUid"
here is listed all userID in openvpn group.

Please suggest me some me, solution.

milovikasse

please help, still waiting for reply.

milovikasse

I checked every settings uid and memberUid in ldap all is currect. But I can't find out what is wrong with openvpn-auth-ldap.so, why it returns false for group even auth works with uid but not with group.

brendan

try changing

SearchFilter "(|(cn=openvpn))"

SearchFilter "(cn=openvpn)"

the | (pipe) is a logical OR, which could be why you compare is coming back negative. since there is only one group you are checking for, an OR of one option may be the reason for the issue.

milovikasse

I made changes as you advice. But no luck, got same error message in ldap err=5.

cat openvpn-ldap.conf

<LDAP>
URL ldap://ldapserver
Timeout 15
TLSEnable no
FollowReferrals yes
TLSCACertFile /usr/local/etc/ssl/ca.pem
TLSCACertDir /etc/ssl/certs
TLSCertFile /usr/local/etc/ssl/client-cert.pem
TLSKeyFile /usr/local/etc/ssl/client-key.pem
</LDAP>
<Authorization>
BaseDN "ou=users,dc=server,dc=com"
SearchFilter "(&(uid=%u))"
RequireGroup true
<Group>
BaseDN "ou=groups,dc=server,dc=com"
SearchFilter "(cn=openvpn)"
MemberAttribute memberUid
</Group>
</Authorization>

Following log found on ldap server.

May 13 14:14:45 ldapauth slapd[26443]: conn=56600 fd=56 ACCEPT from IP=openvpnserver:55938 (IP=0.0.0.0:389)
May 13 14:14:45 ldapauth slapd[26443]: conn=56600 op=0 SRCH base="ou=users,dc=server,dc=com" scope=2 deref=0 filter="(&(uid=userid))"
May 13 14:14:45 ldapauth slapd[26443]: conn=56600 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text=
May 13 14:14:45 ldapauth slapd[26443]: conn=56601 fd=57 ACCEPT from IP=openvpnserver:55939 (IP=0.0.0.0:389)
May 13 14:14:45 ldapauth slapd[26443]: conn=56601 op=0 BIND dn="uid=userid,ou=users,dc=server,dc=com" method=128
May 13 14:14:45 ldapauth slapd[26443]: conn=56601 op=0 BIND dn="uid=userid,ou=users,dc=server,dc=com" mech=SIMPLE ssf=0
May 13 14:14:45 ldapauth slapd[26443]: conn=56601 op=0 RESULT tag=97 err=0 text=
May 13 14:14:45 ldapauth slapd[26443]: conn=56601 op=1 UNBIND
May 13 14:14:45 ldapauth slapd[26443]: conn=56601 fd=57 closed
May 13 14:14:45 ldapauth slapd[26443]: conn=56600 op=1 SRCH base="ou=groups,dc=server,dc=com" scope=2 deref=0 filter="(cn=openvpn)"
May 13 14:14:45 ldapauth slapd[26443]: conn=56600 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
May 13 14:14:45 ldapauth slapd[26443]: conn=56600 op=2 CMP dn="cn=openvpn,ou=groups,dc=server,dc=com" attr="memberUid"
May 13 14:14:45 ldapauth slapd[26443]: conn=56600 op=2 RESULT tag=111 err=5 text=
May 13 14:14:45 ldapauth slapd[26443]: conn=56600 op=3 UNBIND
May 13 14:14:45 ldapauth slapd[26443]: conn=56600 fd=56 closed

milovikasse

Waiting for reply. Please.

milovikasse

Still waiting for reply.

milovikasse

I am frustrated with openvpn ldap plugin. Need help.