search

TremoloSecurity / MyVirtualDirectory

Open Source LDAP Virtual Directory
Apache License 2.0
45 stars 18 forks source link

Authentication issue with one LDAP + 2 ADs #145

Open dagmoller opened 2 years ago

dagmoller commented 2 years ago

Hi,

I have the following config:

##
## Basic Config
##
server.listener.port=389

##
## Global Chain
##
server.globalChain=

server.globalChain.dump1.className=net.sourceforge.myvd.inserts.DumpTransaction
server.globalChain.dump1.config.logLevel=info
server.globalChain.dump1.config.label=Global

##
## Base
## 
server.nameSpaces=root,openldap,ad1,ad2

server.root.chain=RootDSE
server.root.nameSpace=
server.root.weight=0
server.root.RootDSE.className=net.sourceforge.myvd.inserts.RootDSE
server.root.RootDSE.config.supportedControls=2.16.840.1.113730.3.4.18,2.16.840.1.113730.3.4.2,1.3.6.1.4.1.4203.1.10.1,1.2.840.113556.1.4.319,1.2.826.0.1.334810.2.3,1.2.826.0.1.3344810.2.3,1.3.6.1.1.13.2,1.3.6.1.1.13.1,1.3.6.1.1.12
server.root.RootDSE.config.namingContexts=dc=mycompany,dc=com

##
## OpenLDAP
##
server.openldap.chain=ldap
server.openldap.nameSpace=dc=mycompany,dc=com
server.openldap.weight=10

server.openldap.ldap.className=net.sourceforge.myvd.inserts.ldap.LDAPInterceptor
server.openldap.ldap.config.host=ldap-service
server.openldap.ldap.config.port=389
server.openldap.ldap.config.remoteBase=dc=ldap,dc=local
server.openldap.ldap.config.proxyDN=cn=readonly,dc=ldap,dc=local
server.openldap.ldap.config.proxyPass=readonly
server.openldap.ldap.config.passBindOnly=true
server.openldap.ldap.config.ignoreRefs=true

##
## AD 1
##
server.ad1.chain=clean,memberof,dnmap,objmap,attmap,ldap
server.ad1.nameSpace=dc=clarobr,dc=mycompany,dc=com
server.ad1.weight=20

server.ad1.clean.className=net.sourceforge.myvd.inserts.mapping.AttributeCleaner
server.ad1.clean.config.clearAttributes=true

server.ad1.memberof.className=net.sourceforge.myvd.inserts.mapping.VirtualMemberOf
server.ad1.memberof.config.searchBase=ou=groups,dc=mycompany,dc=com
server.ad1.memberof.config.applyToObjectClass=inetOrgPerson
server.ad1.memberof.config.attributeName=memberOf
server.ad1.memberof.config.searchObjectClass=groupOfNames
server.ad1.memberof.config.searchAttribute=member
server.ad1.memberof.config.replace=false

server.ad1.dnmap.className=net.sourceforge.myvd.inserts.mapping.DNAttributeMapper
server.ad1.dnmap.config.dnAttribs=uniqueMember,member,memberOf,distinguishedName
server.ad1.dnmap.config.remoteBase=dc=ad1,dc=corp
server.ad1.dnmap.config.localBase=dc=ad1,dc=mycompany,dc=com

server.ad1.objmap.className=net.sourceforge.myvd.inserts.mapping.AttributeValueMapper
server.ad1.objmap.config.mapping=objectClass.inetOrgPerson=user,objectClass.groupOfUniqueNames=group,objectClass.groupOfNames=group

server.ad1.attmap.className=net.sourceforge.myvd.inserts.mapping.AttributeMapper
server.ad1.attmap.config.mapping=uniqueMember=member,uid=samAccountName

server.ad1.ldap.className=net.sourceforge.myvd.inserts.ldap.LDAPInterceptor
server.ad1.ldap.config.host=10.54.24.197
server.ad1.ldap.config.port=389
server.ad1.ldap.config.remoteBase=dc=ad1,dc=corp
server.ad1.ldap.config.proxyDN=cn=admin,dc=ad1,dc=corp
server.ad1.ldap.config.proxyPass=secret
server.ad1.ldap.config.passBindOnly=true
server.ad1.ldap.config.ignoreRefs=true

##
## AD 2
##
server.ad2.chain=clean,memberof,dnmap,objmap,attmap,ldap
server.ad2.nameSpace=dc=embratel,dc=mycompany,dc=com
server.ad2.weight=30

server.ad2.clean.className=net.sourceforge.myvd.inserts.mapping.AttributeCleaner
server.ad2.clean.config.clearAttributes=true

server.ad2.memberof.className=net.sourceforge.myvd.inserts.mapping.VirtualMemberOf
server.ad2.memberof.config.searchBase=ou=groups,dc=mycompany,dc=com
server.ad2.memberof.config.applyToObjectClass=inetOrgPerson
server.ad2.memberof.config.attributeName=memberOf
server.ad2.memberof.config.searchObjectClass=groupOfNames
server.ad2.memberof.config.searchAttribute=member
server.ad2.memberof.config.replace=false

server.ad2.dnmap.className=net.sourceforge.myvd.inserts.mapping.DNAttributeMapper
server.ad2.dnmap.config.dnAttribs=uniqueMember,member,memberOf,distinguishedName
server.ad2.dnmap.config.remoteBase=dc=ad2,dc=corp
server.ad2.dnmap.config.localBase=dc=ad2,dc=mycompany,dc=com

server.ad2.objmap.className=net.sourceforge.myvd.inserts.mapping.AttributeValueMapper
server.ad2.objmap.config.mapping=objectClass.inetOrgPerson=user,objectClass.groupOfUniqueNames=group,objectClass.groupOfNames=group

server.ad2.attmap.className=net.sourceforge.myvd.inserts.mapping.AttributeMapper
server.ad2.attmap.config.mapping=uniqueMember=member,uid=samAccountName

server.ad2.ldap.className=net.sourceforge.myvd.inserts.ldap.LDAPInterceptor
server.ad2.ldap.config.host=10.53.22.129
server.ad2.ldap.config.port=389
server.ad2.ldap.config.remoteBase=dc=ad2,dc=corp
server.ad2.ldap.config.proxyDN=cn=admin,dc=ad2,dc=corp
server.ad2.ldap.config.proxyPass=secret
server.ad2.ldap.config.passBindOnly=true
server.ad2.ldap.config.ignoreRefs=true

I have the issue with user authnetication. If I remove the ad2 from server.nameSpaces, authentication works well on ad1, but with ad2 authnetication not work. There is a way to map where to authenticate the user?

I think my problem is related to have the same user on ad1 and ad2, but not all users has duplications. In case of user duplication, there any way to map or exclude this duplication?

(sorry my english)