You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by fsil <fg...@silicom.fr.INVALID> on 2020/05/26 09:40:10 UTC
LDAP subtree parsing problem
Hello to the whole community,
We are currently experiencing a problem with LDAP authentication. Indeed, we
would like to allow people in several OUs to connect. The problem is that if
we indicate a parent OU for the search, guacamole will not search
recursively in the subtree. Do you have an idea?
For example:
domain.com
|_ParentOU
|_childOU1
|_Admin1
|_childOU2
|_Admin2
|_ServiceAccountsOU
|_GuacamoleService
# LDAP properties
ldap-hostname: domain.com
ldap-port: 389
ldap-user-base-dn: OU=ParentOU,DC=domain,DC=com
ldap-search-bind-dn:
CN=GuacamoleService,OU=ServiceAccountsOU,DC=domain,DC=com
ldap-search-bind-password: password
ldap-username-attribute: sAMAccountName
Idap-user-search-filter: (objectClass=user)
In this case, Guacamole will not search for users in the child OU1 and child
OU2.
Do you have any ideas?
Thank you in advance,
Sincerely,
fsil
--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: LDAP subtree parsing problem
Posted by Nick Couchman <vn...@apache.org>.
On Tue, May 26, 2020 at 5:40 AM fsil <fg...@silicom.fr.invalid> wrote:
> Hello to the whole community,
> We are currently experiencing a problem with LDAP authentication. Indeed,
> we
> would like to allow people in several OUs to connect. The problem is that
> if
> we indicate a parent OU for the search, guacamole will not search
> recursively in the subtree. Do you have an idea?
> For example:
> domain.com
> |_ParentOU
> |_childOU1
> |_Admin1
> |_childOU2
> |_Admin2
> |_ServiceAccountsOU
> |_GuacamoleService
>
> # LDAP properties
> ldap-hostname: domain.com
> ldap-port: 389
> ldap-user-base-dn: OU=ParentOU,DC=domain,DC=com
> ldap-search-bind-dn:
> CN=GuacamoleService,OU=ServiceAccountsOU,DC=domain,DC=com
> ldap-search-bind-password: password
> ldap-username-attribute: sAMAccountName
> Idap-user-search-filter: (objectClass=user)
>
> In this case, Guacamole will not search for users in the child OU1 and
> child
> OU2.
>
>
Guacamole definitely does search sub-trees - in my environment I have the
ldap-user-base-dn property pointed at the root of my LDAP (AD) tree, and
the user accounts that access it come from multiple places within the
tree. You're saying it works correctly if you just change the config such
that ldap-user-base-dn is pointed at one of the Child OUs directly, with no
other changes to the configuration? Anything in the Tomcat logs?
-Nick