Good day all,
Been scratching my head on this one. Current working with OpenVPN Access Server Virtual Appliance version 2.1.3
I'm attempting to assign users to groups based on their Active Directory group membership. I've loaded the following post-auth script into the config DB:
import re
import ldap
from pyovpn.plugin import *
re_group = re.compile(r"^CN=([^,]+)")
re_major_ver = re.compile(r"^(\d+)\.")
first_login_ip_addr=""
SYNCHRONOUS=False
def ldap_groups_parse(res):
ret = set()
for g in res[0][1]['memberOf']:
m = re.match(re_group, g)
if m:
ret.add(m.groups()[0])
return ret
def post_auth(authcred, attributes, authret, info):
print "********** POST_AUTH", authcred, attributes, authret, info
group = "default"
proplist = authret.setdefault('proplist', {})
proplist_save = {}
error = ""
if info.get('auth_method') == 'ldap':
user_dn = info['user_dn']
with info['ldap_context'] as l:
ldap_groups = ldap_groups_parse(l.search_ext_s(user_dn, ldap.SCOPE_SUBTREE, attrlist=["memberOf"]))
print "********** LDAP_GROUPS", ldap_groups
if 'RG - Prod_OpenVPN_admin' in ldap_groups:
group = "admin"
elif 'RG - Prod_OpenVPN_user' in ldap_groups:
group = "users"
if error:
authret['status'] = FAIL
authret['reason'] = error # this error string is written to the server log file
authret['client_reason'] = error # this error string is reported to the client user
proplist['conn_group'] = group
return authret, proplist_save
So, if you are a member of "RG - Prod_OpenVPN_admin" I would expect you to be assigned to the "admin" group defined locally on the appliance...ditto with "users." I do indeed see my conn_group set to users when I run the authcli script:
root@vpn-01-34-a08:/usr/local/openvpn_as/scripts# ./authcli -u echiodo
API METHOD: authenticate
Password:
AUTH_RETURN
status : SUCCEED
session_id : DgykNVlAbEXe9O3sqXHe7A==
reason : LDAP auth succeeded on ldap://10.0.0.200/
expire : 1485999603
user : echiodo
proplist : {'prop_deny': 'false', 'conn_group': 'users', 'prop_autogenerate': 'true'}
When attempting to log in however, my authentication is rejected. I see what I interpret as conflicting information in the logs:
2017-02-01 16:11:43-0800 [-] OVPN 0 OUT: 'Thu Feb 2 00:11:43 2017 TCP connection established with [AF_INET]XX.XX.XX.XX:63007'
2017-02-01 16:11:43-0800 [-] OVPN 0 OUT: 'Thu Feb 2 00:11:43 2017 XX.XX.XX.XX:63007 SIGTERM[soft,port-share-redirect] received, client-instance exiting'
2017-02-01 16:11:44-0800 [-] ********** POST_AUTH {'username': 'echiodo', 'client_ip_addr': 'XX.XX.XX.XX'} {} {'status': 0, 'reason': u'LDAP auth succeeded on ldap://YY.YY.YY.YY/', 'user': 'echiodo', 'proplist': {u'prop_deny': u'false', u'prop_autogenerate': u'true'}} {'user_dn': u'CN=Ed Chiodo,OU=Users,DC=Generic,DC=net', 'ldap_context': <pyovpn.auth.authldap.LDAPContext object at 0x7f3e02779550>, 'auth_method': 'ldap'}
2017-02-01 16:11:44-0800 [-] ********** LDAP_GROUPS set(['RG - Prod_OpenVPN_user'])
2017-02-01 16:11:44-0800 [-] OVPN 0 OUT: 'Thu Feb 2 00:11:44 2017 TCP connection established with [AF_INET]XX.XX.XX.XX:63008'
2017-02-01 16:11:44-0800 [-] OVPN 0 OUT: 'Thu Feb 2 00:11:44 2017 XX.XX.XX.XX:63008 SIGTERM[soft,port-share-redirect] received, client-instance exiting'
2017-02-01 16:11:48-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:48 2017 XX.XX.XX.XX:64018 TLS: Initial packet from [AF_INET]XX.XX.XX.XX:64018, sid=270b5ca2 bd25a840'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 VERIFY OK: depth=1, /CN=OpenVPN CA'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 VERIFY OK: nsCertType=CLIENT'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 VERIFY OK: depth=0, /CN=echiodo'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_GUI_VER=ovpnmi_1.0.0'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_VER=3.0.12'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_PLAT=win'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_NCP=2'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_TCPNL=1'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_PROTO=2'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_LZO=1'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_LZO_SWAP=1'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_LZ4=1'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_LZ4v2=1'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_COMP_STUB=1'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: IV_COMP_STUBv2=1'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: UV_ASCLI_VER=UV_ASCLI_VER'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 peer info: UV_PLAT_REL=UV_PLAT_REL'
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 Control Channel: TLSv1, cipher TLSv1/SSLv3 ECDHE-RSA-DES-CBC3-SHA, 2048 bit RSA'
2017-02-01 16:11:49-0800 [-] ********** POST_AUTH {'username': u'echiodo', 'client_ip_addr': u'XX.XX.XX.XX'} {'auth_parms': {u'IV_NCP': u'2', u'IV_COMP_STUB': u'1', u'daemon_start_time': u'1485994176', u'IV_LZ4': u'1', u'UV_ASCLI_VER': u'UV_ASCLI_VER', u'IV_LZ4v2': u'1', u'ifconfig_netmask': u'255.255.252.0', u'X509_0_CN': u'echiodo', u'untrusted_ip': u'XX.XX.XX.XX', u'username': u'echiodo', u'ifconfig_local': u'172.27.232.1', u'IV_LZO_SWAP': u'1', u'IV_GUI_VER': u'ovpnmi_1.0.0', u'IV_COMP_STUBv2': u'1', u'IV_PLAT': u'win', u'daemon_pid': u'1083', u'IV_PROTO': u'2', u'tls_serial_1': '1477077852', u'tls_serial_0': '5', u'IV_VER': u'3.0.12', u'IV_LZO': u'1', u'dev': u'as0t2', u'IV_TCPNL': u'1', u'UV_PLAT_REL': u'UV_PLAT_REL'}, 'client_info': {u'UV_ASCLI_VER': u'UV_ASCLI_VER', u'IV_LZO_SWAP': u'1', u'IV_NCP': u'2', u'IV_LZ4v2': u'1', u'IV_COMP_STUB': u'1', u'IV_VER': u'3.0.12', u'IV_LZO': u'1', u'IV_PROTO': u'2', u'IV_LZ4': u'1', u'IV_GUI_VER': u'ovpnmi_1.0.0', u'IV_COMP_STUBv2': u'1', u'IV_PLAT': u'win', u'IV_TCPNL': u'1', u'UV_PLAT_REL': u'UV_PLAT_REL'}, 'radius': {'NAS-Identifier': 'OpenVPN.vpn-01-34-a08', 'Framed-Protocol': 'PPP', 'Service-Type': 'Outbound-User', 'NAS-Port-Type': 'Virtual', 'NAS-Port': 0}, 'vpn_auth': True, 'reauth': False} {'status': 0, 'reason': 'SESSION_ID auth succeeded', 'user': 'echiodo', 'session_id': u'Ykv12LdkDkPXubSWxZ0r4A==', 'proplist': {u'prop_deny': u'false', 'conn_group': 'users', u'prop_autogenerate': u'true'}} {'auth_method': 'session'}
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 XX.XX.XX.XX:64018 [echiodo] Peer Connection Initiated with [AF_INET]XX.XX.XX.XX:64018'
2017-02-01 16:11:49-0800 [-] VPN Auth Failed: "group assignment failed: referenced group 'default' either does not exist or does not define group_subnets: omi/auth:546,internet/defer:746,sagent/usersvc:1295,sagent/usersvc:602,sagent/usersvc:145,sagent/usersvc:272,sagent/usersvc:258,sagent/usersvc:225 (pyovpn.sagent.usersvc.GroupError)" [None]
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 MANAGEMENT: CMD \'client-deny 0 0 "AS auth failed"\''
2017-02-01 16:11:49-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:49 2017 MULTI: connection rejected: AS auth failed, CLI:[NULL]'
2017-02-01 16:11:50-0800 [-] OVPN 2 OUT: 'Thu Feb 2 00:11:50 2017 XX.XX.XX.XX:64018 Delayed exit in 5 seconds'
2017-02-01 16:11:50-0800 [-] OVPN 2 OUT: "Thu Feb 2 00:11:50 2017 XX.XX.XX.XX:64018 SENT CONTROL [echiodo]: 'AUTH_FAILED' (status=1)"
So, I see the conn_group is set to "users", but the group assignment failed because it's referencing "default" (which doesnt exist). I'm sure this is something obvious, but I am apparently too dumb to spot it. Any input would be much appreciated!
Edit: Used oconf BB tag correctly this time.
