[icinga-users] LDAP AD auth problem

[Brent P. Gardner]

Hello list.

I'm using icinga-web v1.7.2 on CentOS 6.

For over a year I've been running with this LDAP config in 
app/modules/AppKit/config/auth.xml:


<ae:parameter name="msad-ldap1">

    <ae:parameter name="auth_module">AppKit</ae:parameter>
    <ae:parameter name="auth_provider">Auth.Provider.LDAP</ae:parameter>
    <ae:parameter name="auth_enable">true</ae:parameter>
    <ae:parameter name="auth_authoritative">true</ae:parameter>
    <ae:parameter name="auth_create">true</ae:parameter>
    <ae:parameter name="auth_update">true</ae:parameter>

    <ae:parameter name="auth_map">
        <ae:parameter name="user_firstname">givenName</ae:parameter>
        <ae:parameter name="user_lastname">sn</ae:parameter>
        <ae:parameter name="user_email">mail</ae:parameter>
    </ae:parameter>

    <ae:parameter name="ldap_allow_anonymous">false</ae:parameter>
    <ae:parameter name="ldap_dsn">ldap://adserver.example.local</ae:parameter>
    <ae:parameter name="ldap_start_tls">false</ae:parameter>
    <ae:parameter 
name="ldap_basedn">OU=IT,OU=LocalUsers,DC=example,DC=local</ae:parameter>
    <ae:parameter name="ldap_binddn">LDAPAcct@example.local</ae:parameter>
    <ae:parameter name="ldap_bindpw"><![CDATA[Password]]></ae:parameter>
    <ae:parameter name="ldap_userattr">sAMAccountName</ae:parameter>
    <ae:parameter 
name="ldap_filter_user"><![CDATA[(&(sAMAccountName=__USERNAME__)(memberOf=CN=Icinga-Admins,OU=IT,OU=ResourceGroups,OU=Groups,DC=example,DC=local))]]></ae:parameter>

</ae:parameter>


Now, I need to allow some additional users outside the IT OU to log in, 
specifically, users in the OU: 

    OU=AdminAccts,DC=example,dc=local


So I changed the ldap_basedn:

    <ae:parameter name="ldap_basedn">DC=example,DC=local</ae:parameter>


Then I cleared the cache with bin/clearcache.sh

Users that could previously log in can still log in, but users in the 
AdminAccts OU cannot.

Since making this change I've also restarted icinga-web and httpd.

If I try to log in with a user called MyUser, I see entries like this in the 
debug log:

[Thu Sep 25 05:07:34 2014] [debug] Auth.Provider.LDAP Prepare LDAPsearch 
(base=CN=MyUser,OU=IT,OU=LocalUsers,DC=example,DC=local, filter=(objectClass=*))


This makes it seem that the system is still using the old ldap_basedn to create 
the search.

Is there something else I need to change?  Where else can I look?


Regards, 


Brent Gardner
Ipro Tech LLC





_______________________________________________
icinga-users mailing list
icinga-users@lists.icinga.org
https://lists.icinga.org/mailman/listinfo/icinga-users