Hi all, struggling to make openvpn-auth-ldap auth work with my AD I installed openvpn-auth-ldap from ubuntu repositories (Version: 2.0.3-1.1) then created an auth-ldap.cfg under /etc/openvpn then referred to it in server.conf as: "plugin /usr/lib/openvpn/openvpn-auth-ldap.so "auth-ldap.cfg" i am using known working bind parameters, config and search mask (tested with ldapsearch on the same machine) but always get this from openvpn server logs: [code]LDAP search failed: Operations error (00000000: LdapErr: DSID-0C0905FF, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece) [/code] and then I always get (perhaps obviously) [code]LDAP user "username" was not found.[/code] (username being any real or fake user) to keep things simple I stripped anything "fancy" from the cfg with a really basic config [code] URL ldap://ldap_ip_address Timeout 15 BindDN "CN=ldapuser,OU=users,DC=exampledomain,DC=com" Password ldapuserpwd FollowReferrals no BaseDN "DC=exampledomain,DC=com" SearchFilter "sAMAccountName=%u" RequireGroup false [/code] (obviously I've changed here real account & server info) how can I debug what wrong binding is this plugin using? or any other wrong parameter in the cfg? any idea? Marco

openvpn-auth-ldap always failing binding

m.ardito

Hi all,

struggling to make openvpn-auth-ldap auth work with my AD
I installed openvpn-auth-ldap from ubuntu repositories (Version: 2.0.3-1.1)
then created an auth-ldap.cfg under /etc/openvpn
then referred to it in server.conf as: "plugin /usr/lib/openvpn/openvpn-auth-ldap.so "auth-ldap.cfg"

i am using known working bind parameters, config and search mask (tested with ldapsearch on the same machine) but always get this from openvpn server logs:

LDAP search failed: Operations error (00000000: LdapErr: DSID-0C0905FF, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece)

and then I always get (perhaps obviously)

LDAP user "username" was not found.

(username being any real or fake user)

to keep things simple I stripped anything "fancy" from the cfg with a really basic config

<LDAP>
 URL ldap://ldap_ip_address
 Timeout 15
 BindDN "CN=ldapuser,OU=users,DC=exampledomain,DC=com"
 Password ldapuserpwd
 FollowReferrals no
</LDAP>

<Authorization>
 BaseDN "DC=exampledomain,DC=com"
 SearchFilter "sAMAccountName=%u"
 RequireGroup false
</Authorization>

(obviously I've changed here real account & server info)

how can I debug what wrong binding is this plugin using? or any other wrong parameter in the cfg?

any idea?

Marco