search

DefGuard / defguard

Enterprise, fast, secure VPN & SSO platform with hardware keys, 2FA/MFA
https://defguard.net
Other
744 stars 22 forks source link

Active directory: cannot sync groups #583

Closed Leopol123 closed 3 months ago

Leopol123 commented 3 months ago

Describe the bug Ldap sync on an active directory, not sync groups

To Reproduce Steps to reproduce the behavior:

  1. Go to 'setting' => 'LDAP'
  2. Configure LDAP Settings: Member Attribute: "memberOf" Groupname Attribute: "cn" Group ObjectClass: "group" Group Member Attribute: "member"
  3. Log with a account user => Logging working with all user informations but no "user groups"

Expected behavior Have groups sync on Defguard

Version information

Additional context I am testing DefGuard, it seems pretty nice. I need groups to map a gorup to a VPN location. Thanks for your help.

0rbiter commented 3 months ago

I'm looking at this as well. My assumptions: a) you are not able to create groups in the admin interface - correct? b) you therefore need an external LDAP source to sync groups from c) and that doesn't work - correct?

Looking forward to your answers.

kind regards Lars

teon commented 3 months ago

@0rbiter @Leopol123 we have implemented group management in 0.10.0 which is still in the release process (few last bugs etc), but we have omitted intentionally synchronizing groups with LDAP - as it's a larger problem to synchronize users and thier groups (bast to be be both ways: DG <=> LDAP). So we leave that problem for next releases...

Leopol123 commented 3 months ago

@0rbiter You are all right, since LDAP sync, no able to create group.

@teon Thanks for your answer, I was affraid that I missconfigure something.I will wait next release for AD groups.

I try to configure LDAPS instead of LDAP on yesterday, no luck for the moment, I will continue this day.

Leopol123 commented 3 months ago

Hello, I am testing version v0.10.0. I can create groups now and assign users to this group. I will continue my test, your product looks really great. I will wait group sync for later.

I don't succeed to configure ldap sync using ldaps. A metric page/process to speak with prometheus/openmetrics could be great.

Thanks, I close, excited to see next releases !