0

I can search for a user without issue:

ldapsearch -h ldap.my.server.name -b "cn=vpnusers,ou=groups,dc=example,dc=com" -x "memberUid=myusername"

Results:

# extended LDIF
#
# LDAPv3
# base <cn=vpnusers,ou=groups,dc=example,dc=com> with scope subtree
# filter: memberUid=myusername
# requesting: ALL
#

# vpnusers, groups, example.com
dn: cn=vpnusers,ou=groups,dc=example,dc=com
gidNumber: 10000
description: Group account
cn: vpnusers
objectClass: posixGroup
memberUid: myusername
memberUid: someuser

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

So I know that the entry is there and it's searchable. However now I'm trying to search that group with openvpn using the auth-ldap plugin

Here is my auth-ldap.conf that works perfectly fine (when RequireGroup = false:

<LDAP>
        URL             ldap://ldap.my.server.name
        Timeout         10
        TLSEnable       yes
        FollowReferrals yes
</LDAP>

<Authorization>
        BaseDN          "ou=users,dc=example,dc=com"
        SearchFilter    "(uid=%u)"
        RequireGroup    false
                <Group>
                        BaseDN  "ou=groups,dc=example,dc=com"
                        SearchFilter "cn=vpnusers"
                        MemberAttribute memberUid
                </Group>
</Authorization>

If I update it to require group search, it fails:

<LDAP>
        URL             ldap://ldap.my.server.name
        Timeout         10
        TLSEnable       yes
        FollowReferrals yes
</LDAP>

<Authorization>
        BaseDN          "ou=users,dc=example,dc=com"
        SearchFilter    "(uid=%u)"
        RequireGroup    true
                <Group>
                        BaseDN  "ou=groups,dc=example,dc=com"
                        SearchFilter "cn=vpnusers"
                        MemberAttribute memberUid
                </Group>
</Authorization>

The error that the openvpn server spits out is:

Dec  6 18:54:37 openvpn01 openvpn: Thu Dec  6 18:54:37 2018 47.153.170.228:1194 PLUGIN_CALL: POST /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Dec  6 18:54:37 openvpn01 openvpn: Thu Dec  6 18:54:37 2018 47.153.170.228:1194 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so
Dec  6 18:54:37 openvpn01 openvpn: Thu Dec  6 18:54:37 2018 47.153.170.228:1194 TLS Auth Error: Auth Username/Password verification failed for peer

Works fine if I'm not using the RequireGroup option so I assume my MemberAttribute or SearchFilter is wrong. Any ideas? Anyone hit this issue before?

0

I recently ran into the same problem trying to use JumpCloud's LDAP service. What worked for me was wrapping the search filter in parenthesis:

searchFilter "(cn=vpnusers)"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.