Condition OR for LDAP in group

Community Support
1

Hello.
I need some help with LDAP, namely with OR condition for group.
I have two groups on my LDAP-server. First group for opennebula admins, second for opennebula developers:

oned-admin
oned-dev

And i want mapping users from oned-admin LDAP-group to oneadmin group in Opennebula and oned-dev LDAP-group to users group in Opennebula.

For that i add OR condition for group in a LDAP auth configuration file - ldap_auth.conf:

:group: '(|(cn=oned-admin,cn=groups,cn=accounts,dc=example,dc=net)(cn=oned-dev,cn=groups,cn=accounts,dc=example,dc=net))'

But I get an error:

User test is not in group (|(cn=oned-admin,cn=groups,cn=accounts,dc=example,dc=net)(cn=oned-dev,cn=groups,cn=accounts,dc=example,dc=net))

When i do a filter for group without OR condition authentication is success.

:group: 'cn=oned-admin,cn=groups,cn=accounts,dc=example,dc=net'

Does Opennebula support OR condition in group filter?

2

Hi @perrfect,

You can do that by using Group Mapping

Update both groups with the attribute GROUP_DN set to cn=oned-admin,cn=groups,cn=accounts,dc=example,dc=net for oneadmin and set to cn=oned-dev,cn=groups,cn=accounts,dc=example,dc=net for users.

Cheers.

3

Thank you so much for the reply.

When i will set GROUP_DN in this case, which
:group: in a config file should i use?

4

@perrfect I’m using a similar config. How did you fixed the problem?

5

Hello.
It was a long time ago.
But these configs solved my problem:
/etc/one/auth/ldap_auth.conf

server 1:
    :auth_method: :simple
    :host: ldap.example.com
    :port: 636
    :user: 'uid=id,cn=users,cn=accounts,dc=example,dc=com'
    :password: 'some_password_here'
    :encryption: :simple_tls
    :base: 'cn=users,cn=accounts,dc=example,dc=com'
    :group_base: 'cn=groups,cn=accounts,dc=example,dc=com'
    :user_field: 'uid'
    :group_field: 'member'
    :mapping_generate: true
    :mapping_timeout: 300
    :mapping_filename: server1.yaml
    :mapping_key: GROUP_DN
    :mapping_default: false
    :rfc2307bis: false
 
:order:
    - server 1

/var/lib/one/server1.yaml

cn=oned-dev,cn=groups,cn=accounts,dc=example,dc=com: '101'
cn=oned-adm,cn=groups,cn=accounts,dc=example,dc=com: '0'
1 Like