Improve LDAP configuration and authentication consistency

[gsanchietti]

Enhance LDAP configuration to address inconsistencies between Samba AD and MS AD, clarify field usage, and improve migration processes.

Purpose of the feature

• Streamline LDAP configuration across different directory services (Samba AD, MS AD, OpenLDAP)
• Clarify the purpose and usage of configuration fields
• Improve consistency in migration processes
• Enhance LDAP response parsing for more reliable authentication

Current problems

• Configuration differs significantly between Samba AD and MS AD
• Unclear purpose of "User attribute field" and "User CN field"
• Misleading use of "Custom user bind DN" for OpenLDAP
• Inconsistent migration process for Samba AD and MS AD

Proposed solution Frontend changes:

1. Rename "User CN field" to "User display name attribute"
2. Add tooltip for "User display name attribute": "Display name attribute for the user. The display name typically represents the user's full name like 'John Doe'. Example: 'displayName' for Active Directory or 'cn' for NethServer OpenLDAP"
3. Add tooltip for "User attribute field": "LDAP attribute that corresponds to the user's identity. This attribute is used to uniquely identify users within the LDAP directory. Example: 'uid' for OpenLDAP or 'sAMAccountname' for Active Directory"

Backend changes:

1. Implement a new library for parsing LDAP responses to ensure more consistent decoding
2. Update migration processes to handle Samba AD and MS AD consistently

Other changes:

1. Update documentation to reflect new field names and provide clear guidance on configuration for different LDAP systems
2. Conduct thorough QA testing to ensure compatibility and consistency across various LDAP setups

See also

• https://github.com/NethServer/nethsecurity/issues/602

[gsanchietti]

Migration testing package for NS7: nethserver-firewall-migration-0.0.19-1.2.gfd6fcf6.ns7.noarch.rpm

[github-actions[bot]]

Testing image version: 23.05.3-ns.1.0.1-70-g9ef0f6b

[gsanchietti]

Test case 1

• Configure a new remote database connected OpenLDAP server running on NS7, do not specify the Custom user bind DN field
• Connect the OpenVPN road warrior server to the remote database
• Configure the OpenVPN road warrior with user and password authentication
• Verify the clients can connect and authenticate to the OpenVPN server

Test case 2

• Complete test case 1
• Change the Custom user bind to uid=%u,ou=People,dc=directory,dc=nh
• Verify the clients can connect and authenticate to the OpenVPN server

Test case 3

• Configure a new remote database connected Active Directory server running on NS7
• Specify the Custom user bind DN field as %u@domain
• Set User attribute field to sAMAccountName
• Set User display name field to displayName
• Connect the OpenVPN road warrior server to the remote database
• Configure the OpenVPN road warrior with user and password authentication
• Verify the clients can connect and authenticate to the OpenVPN server

Test case 4

• Repeat test case 3 with Microsoft Active Directory

Test case 5 (migration)

• Configure a NS7 machine and connect it to a remote NethServer Active Directory
• Make sure to have installed the latest migration package from testing repository
• Configure the OpenVPN road warrior with user and password authentication
• Migrate the machine
• Verify the user page display all Active Directory users
• Verify clients can connect and authenticate to the OpenVPN server using %u@domain
• Verify User attribute field is set to samAccountName
• Verify User display name field is set to displayName

Test case 6 (migration)

• Repeat test case 7 with a remote Microsoft Active Directory

Test case 7

• Install an old image (1.0.1 should be good)
• Configure remote OpenLDAP user database
• Configure an OpenVPN server attached to it with a user
• Switch the repositories to the dev channel
• Upgrade the machine
• Verify the clients can still connect and authenticate to the OpenVPN server

Test case 8

• Repeat test case 7 with Microsft Active Directory

Test case 9

• Repeat test case 7 with Samba Active Directory

[github-actions[bot]]

Testing image version: 8-23.05.3-ns.1.0.1-71-g7211cc2

[gsanchietti]

Test cases 1,2,3,4,5,6 verified by Luca D and @cotosso

[gsanchietti]

Verified