group access cannot be configured after update to 2.0.6

5keptic

Hello , I am experiencing an issue where any user I add to a custom group cannot access the resources assigned to that group. in particular the networks via NAT. this is only the case for users i have created after i updated to 2.0.6. These users can still authenticate (via LDAP) but they cannot access anything beyond what is given to the default group. I have restarted the server and service and upgraded to 2.0.7. I believe the update is the only change I have made to the server since I noticed this problem. It seems as though the firewall settings are not being modified for the groups. However, all users I added before the update still have access to the resources I assigned.

This is a CentOS 6.5 server with windows Clients. I am sure the problem is server side as i tried manually adding routes on the client and still cannot access those resources behind he server.

Any suggestions?

5keptic

some additional information that may (or may not) be applicable.

I am seeing this in the ovpnas.log over and over again

2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] Exception in Nevow/guard/locateChild:'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] Traceback (most recent call last):'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] File "/usr/local/openvpn_as/lib/python2.7/site-packages/Nevow-0.10.0-py2.7.egg/nevow/guard.py", line 329$
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] return self._delegate(ctx, segments)'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] File "build/bdist.linux-x86_64/egg/pyovpn/auth/authbasenv.py", line 34, in _delegate'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] File "/usr/local/openvpn_as/lib/python2.7/site-packages/Nevow-0.10.0-py2.7.egg/nevow/guard.py", line 353$
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] rd = self.createSession(ctx, segments)'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] File "/usr/local/openvpn_as/lib/python2.7/site-packages/Nevow-0.10.0-py2.7.egg/nevow/guard.py", line 387$
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] ret = urlToChild(ctx, SESSION_START, ())'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] File "/usr/local/openvpn_as/lib/python2.7/site-packages/Nevow-0.10.0-py2.7.egg/nevow/guard.py", line 212$
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] raise ValueError("Host field is undefined in HTTP request");'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] ValueError: Host field is undefined in HTTP request'

5keptic

one extra bit of info - I ran all updates at the same time as the openvpn version update and i see that python was updated as well.

Apr 09 09:30:14 Updated: python-2.6.6-52.el6.x86_64
Apr 09 09:30:19 Updated: python-libs-2.6.6-52.el6.x86_64

Any known issues with this version?

5keptic wrotesome additional information that may (or may not) be applicable.

I am seeing this in the ovpnas.log over and over again

2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] Exception in Nevow/guard/locateChild:'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] Traceback (most recent call last):'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] File "/usr/local/openvpn_as/lib/python2.7/site-packages/Nevow-0.10.0-py2.7.egg/nevow/guard.py", line 329$
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] return self._delegate(ctx, segments)'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] File "build/bdist.linux-x86_64/egg/pyovpn/auth/authbasenv.py", line 34, in _delegate'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] File "/usr/local/openvpn_as/lib/python2.7/site-packages/Nevow-0.10.0-py2.7.egg/nevow/guard.py", line 353$
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] rd = self.createSession(ctx, segments)'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] File "/usr/local/openvpn_as/lib/python2.7/site-packages/Nevow-0.10.0-py2.7.egg/nevow/guard.py", line 387$
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] ret = urlToChild(ctx, SESSION_START, ())'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] File "/usr/local/openvpn_as/lib/python2.7/site-packages/Nevow-0.10.0-py2.7.egg/nevow/guard.py", line 212$
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] raise ValueError("Host field is undefined in HTTP request");'
2014-05-12 10:31:36-0400 [-] WEB OUT: '2014-05-12 10:31:36-0400 [HTTPChannel,9791,127.0.0.1] ValueError: Host field is undefined in HTTP request'

5keptic

Sorry to clog the thread here but wanted to keep it up to date in hopes that i can get this fixed before my deadline tomorrow 🙁

I am pretty sure the previous error in the log is unrelated as i looked in the way-back logs when the server group config was working and it was there too.

Some new info though. I have multiple groups each with a /24 subnet assigned to them - (10.8.10.0/24, 10.8.20.0/24, 10.8.30.0/24, etc) . however I noticed that there are no clients with an ip in their groups range. All client IPs are in 172.27.240.0/20 range which is what is set on the VPN Settings page as the "Group Default IP Address Network".

SO - i tried to define an subnet for a test user group within the 172.27.240.0/20 subnet. when i tried to save it though, the validation would say i was overlapping another group - even though that group has a different subnet listed on the configuration. When i checked the current users - the listed overlap did match adresses users in that group are listed as having though.
With the test user group defined (no overlap and saved) I tried to assign a user in this group a static IP inside of the subnet, but connecting still results in the client receiving an IP in the default Group instead of my test group. If i try to assign a test user to one of the other groups with an IP listed in the overlap - i get an error that the IP specified is not inside of the groups subnet showing the 10.8.x.x subnet.

Am I using the default IP and group subnets incorrectly?
Can any one point me to the path/file where the actual group configuration is stored ?

Thanks all.

5keptic

I started a support ticket and reread the documentation - but i finally resolved this issue when i noticed that the AD name was configured with a capital letter in the name, while in the group configuration I had entered an all lowercase name. it turns out the name specified in the group is case sensitive. What threw me was that the user could authenticate against my domain controller regardless as the LDAP auth is NOT case sensitive. Is this a bug? At the very least it would be useful to document somewhere that group membership is case sensitive when using LDAP authentication and matching.