Hi Fabrice, Thanks for the tip. We did a few packet captures and discovered that the specific memberOf attribute was not being included in the request response. The problem was that when you make a 'global catalogue search' to a domain forest (Port 3268 as opposed to 389) the user must be a member of a 'Universal group'. The use was in fact set up as a member of a 'Global' group.
All is now working as it should. Thanks Andrew -----Original Message----- From: Durand fabrice [mailto:[email protected]] Sent: 05 November 2016 00:39 To: [email protected] Subject: Re: [PacketFence-users] Problem with role assignment based and LDAP group membership Hello Torry, Really cool to have all the details, btw it should work, did you try to take a capture to see the answer of the AD ? Regards Fabrice Le 2016-10-31 à 12:21, Torry, Andrew a écrit : > Running with packetFence 6.3.1. > > We need to create a separate role on our public WiFi for visiting school aged > children. > > I have not had any problems with assigning roles based on AD group membership > before but > this one has me stumped as it flatly refuses to work. > > Can you guys cast your eyes over this and let me know what the heck is wrong, > ldapsearch is > not failing but the LDAPSource.pm code is failing to match the memberOf > attribute. Usernames > and passwords have been sanitized to protect the innocent. > > ====================Authentication.conf========================== > [STUDENT_LDAP] > description=Authenticate against student.fal.ac.uk > password=XXXXXXX > scope=sub > binddn=CN=XXXXXX,OU=Service Accounts,DC=fal,DC=ac,DC=uk > basedn=dc=student,dc=fal,dc=ac,dc=uk > email_attribute=mail > usernameattribute=sAMAccountName > connection_timeout=10 > stripped_user_name=yes > encryption=none > dynamic_routing_module=AuthModule > port=3268 > type=AD > host=10.11.150.1 > > [STUDENT_LDAP rule CreateRestrictedUser] > description= > class=authentication > match=all > action0=set_role=RestrictedUser > action1=set_access_duration=1W > condition0=memberOf,equals,CN=Under18,OU=External Student Groups,OU=Domain > Groups,DC=student,DC=fal,DC=ac,DC=uk > > [STUDENT_LDAP rule CreateGuestStudentUser] > description= > class=authentication > match=all > action0=set_role=Student > action1=set_access_duration=1W > condition0=SSID,equals,Guest > > [STUDENT_LDAP rule CatchAll] > description= > class=authentication > match=all > action0=set_role=Student > action1=set_unreg_date=2017-07-07 > ================================================================================= > > =======================Results of running > PFTEST===================================== > Testing authentication for "gac999999" > > Authenticating against STUDENT_LDAP > Authentication SUCCEEDED against STUDENT_LDAP (Authentication successful.) > Matched against STUDENT_LDAP for 'authentication' rules > set_role : Student > set_unreg_date : 2017-07-07 > Did not match against STUDENT_LDAP > ================================================================================= > > ===========================contents of > httpd.portal.log================================ > Oct 31 12:53:01 httpd.portal(13061) DEBUG: [mac:e0:5f:45:7e:41:8f] > [STUDENT_LDAP CreateRestrictedUser] Searching for > (&(sAMAccountName=gac999999)(memberOf=CN=Under18, OU=External Student Groups, > OU=Domain Groups, DC=student, DC=fal, DC=ac, DC=uk)), from > dc=student,dc=fal,dc=ac,dc=uk, with scope sub > (pf::Authentication::Source::LDAPSource::match_in_subclass) > Oct 31 12:53:01 httpd.portal(13061) DEBUG: [mac:e0:5f:45:7e:41:8f] > [STUDENT_LDAP CreateRestrictedUser] Found 0 results > (pf::Authentication::Source::LDAPSource::match_in_subclass) > ================================================================================= > > =========Results of running LDAPSEARCH using same filter string as above on > the same user=================================== > ldapsearch -v -x -w XXXXXXXX > '(&(sAMAccountName=gac999999)(memberOf=CN=Under18,OU=External Student > Groups,OU=Domain Groups,DC=student, > DC=fal,DC=ac,DC=uk))' > ldap_initialize( <DEFAULT> ) > filter: (&(sAMAccountName=gac999999)(memberOf=CN=Under18,OU=External Student > Groups,OU=Domain Groups,DC=student,DC=fal,DC=ac,DC=uk)) > requesting: All userApplication attributes > # extended LDIF > # > # LDAPv3 > # base <dc=fal,dc=ac,dc=uk> (default) with scope subtree > # filter: (&(sAMAccountName=gac999999)(memberOf=CN=Under18,OU=External > Student Groups,OU=Domain Groups,DC=student,DC=fal,DC=ac,DC=uk)) > # requesting: ALL > # > > # gac999999, Penryn College Students, Guest Accounts, All Users, > student.fal.ac > .uk > dn: CN=gac999999,OU=Penryn College Students,OU=Guest Accounts,OU=All Users,DC= > student,DC=fal,DC=ac,DC=uk > objectClass: top > objectClass: person > objectClass: organizationalPerson > objectClass: user > cn: gac999999 > givenName: gac999999 > distinguishedName: CN=gac999999,OU=Penryn College Students,OU=Guest Accounts,O > U=All Users,DC=student,DC=fal,DC=ac,DC=uk > instanceType: 4 > whenCreated: 20161027150125.0Z > whenChanged: 20161031123633.0Z > displayName: gac999999 > uSNCreated: 140589423 > memberOf: CN=Under18,OU=External Student Groups,OU=Domain Groups,DC=student,DC > =fal,DC=ac,DC=uk > memberOf: CN=Fal Students,OU=Fal Student Groups,OU=Domain Groups,DC=student,DC > =fal,DC=ac,DC=uk > uSNChanged: 140936620 > name: gac999999 > objectGUID:: JVJ3AUM560+AMbFtxz6xtg== > userAccountControl: 66048 > pwdLastSet: 131220540854781805 > primaryGroupID: 513 > objectSid:: AQUAAAAAAAUVAAAANNnH5jhfRi/MEokkveYBAA== > sAMAccountName: gac999999 > sAMAccountType: 805306368 > userPrincipalName: [email protected] > objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=fal,DC=ac,DC=uk > dSCorePropagationData: 16010101000000.0Z > lastLogonTimestamp: 131221161347433241 > > # search result > search: 2 > result: 0 Success > > # numResponses: 2 > # numEntries: 1 > > > ----------------------------- > Falmouth University > ----------------------------- > > ------------------------------------------------------------------------------ > Developer Access Program for Intel Xeon Phi Processors > Access to Intel Xeon Phi processor-based developer platforms. > With one year of Intel Parallel Studio XE. > Training and support from Colfax. > Order your platform today. http://sdm.link/xeonphi > _______________________________________________ > PacketFence-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/packetfence-users ------------------------------------------------------------------------------ Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon Phi processor-based developer platforms. With one year of Intel Parallel Studio XE. Training and support from Colfax. Order your platform today. http://sdm.link/xeonphi _______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users ------------------------------------------------------------------------------ Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon Phi processor-based developer platforms. With one year of Intel Parallel Studio XE. Training and support from Colfax. Order your platform today. http://sdm.link/xeonphi _______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
