Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Okay, here goes. Solving this will solve several problems for me (as I can reapply this knowledge to several extant, similar problems), but luckily I have a very specific, concise problem to describe.

Enough preamble. Our hosting partner is setting up VPN access for us and is connecting it to our LDAP server.

They are using Cisco VPN, the docs on setting this up are here:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808c3c45.shtml#maintask1

Specifically, note the screenshot in (5), under "ASDM"

Now, I do NOT want to provide access to all of our users. I only want to provide access to our IT group. But I do not see a configuration option for LDAP groups on that web reference for the Cisco VPN.

We are using:

OpenLDAP 2.4 Static groups (i.e. "Group has the following members...") Single user OU, "ou=users,dc=mycompany,dc=com"

Is it possible to provide an alias of some kind in OpenLDAP that creates another OU, "itusers", say, and lets me alias the members of that OU somehow? Something like:

"cn=Jeff Silverman,ou=itusers,dc=mycompany,dc=com"

is an alias for

"cn=Jeff Silverman,ou=users,dc=mycompany,dc=com"

And is NOT a separate, unique user account.

Alternatively, should I just create a separate OU and manage it separately? It is a pain, but only 12-15 users will have to be managed that way, with two separate user accounts. But I hate this option - messy, unmanageable, unscalable. You know what I mean.

I am open to any options. I've searched and read all over but I can't quite find an directly analagous example. I can't possibly be the only one who's had this problem!

Thanks!

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

I think you should be able to use the Rewrite/Remap Overlay for OpenLDAP 2.4 to accomplish this goal but I haven't use this overlay so I can't be sure, nor can I provide a working example. Pretty slouchy of me!

share|improve this answer
add comment

I would create a new proxy user for the VPN to connect to. Add your IT users to an appropriate group if they are not already in one. Create a filter to limit access of the VPN's id to members of the group.

share|improve this answer
    
Please elaborate on "new proxy user for the VPN to connect to". This is being set up so that any user in the configured OU can connect to the VPN. also, is there a document describing an access filter like this? Thanks –  JDS Feb 2 '11 at 17:38
    
In the document you linked to there is a Login DN in the Edit AAA Server panel. For authorization this is usually a proxy account which can read the necessary fields, but normally can't update anything other than audit fields. Do you really want your VPN to be able to create and modify users? Create and id like 'cn=vpnProxy,...' and grant it permissions with a filter. –  BillThor Feb 2 '11 at 20:26
    
Ah, I see. I actually did create a proxy account, as a matter of fact, but I bet I need to tighten its permissions. How do I do that last bit -- "grant it permissions with a filter"? thanks –  JDS Feb 3 '11 at 2:46
    
Ok, I looked at ACL docs for OpenLDAP. I'm not sure I see a way to implement an access to the members of only the "vpnusers" group since the group only has "memberUid:" values and not actual users. Does that statement make sense? For example, the documentation of ACL -- "access to <what> [ by <who> [<accesslevel>] [<control>] ]+" seems to imply the <what> can be anything, but would restricting the access of the VPN proxy user to the "cn=vpnusers,ou=groups...dc=com" group really restrict access to members of that group? I don't see how that would work. Thanks. –  JDS Feb 3 '11 at 3:09
    
Ok, I see I can add an LDAP filter for the ACL -- e.g. (objectClass=*). But how do I write a filter that says "list all users who have a memberUid value in the group vpnusers" ? –  JDS Feb 3 '11 at 3:18
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.