This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

LDAP groups with FreeIPA

Hi,
I've been able to connect my UTM 9.3 to FreeIPA 3.3.x for basic user/password authentication to the web portal and ssl client vpn. However, I've been unable to get the UTM to use the user groups on FreeIPA to determine a user's access to an object. I suspect the problem has to do with FreeIPA using nested groups. I'm wondering if anyone has solved this, perhaps even using a version of Active Directory or other backend? Thanks for any tips!

This thread was automatically locked due to age.

Parents

0 Scott_Klassen over 9 years ago

Create User Groups on the UTM, then add your backend authentication user accounts to those.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 digitalmtl over 9 years ago in reply to Scott_Klassen

You can create groups attached to the FreeIPA the trick is to get the right attributes:

It should go like this:

Group type: Backend Membership

check an LDAP Attribute

Attribute: memberOf
Value: cn=usergroup,cn=groups,cn=accounts,dc=domain,dc=local
Cancel
Vote Up 0 Vote Down

Cancel
0 Di Ka over 6 years ago in reply to digitalmtl

Hi,

first of all shouldn't this be documented by Sophos? How can one predict the ldap Attribute and Value?

Anyway,

I did what you suggested but still not getting it done.

Where Values, I suppose I leave it like that, not replacing with my credentials, right?

Is there something I can check on my freeipa server? Syslog not showing anything when I click on "test" on Sophos.

I think is time for Sophos to make a Document about how to connect Freeipa to Sophos hence there is already for AD and openldap is rubbish.

Thank you.
Cancel
Vote Up 0 Vote Down

Cancel
0 DouglasFoster over 6 years ago in reply to Di Ka

Never heard of your product. Does it have market share among potential paying customers for UTM?

Read my LDAP post in the WiKi. To make LDAP work, you have to know your available attributes, your directory structure, and LDAP syntax. The first comes from your LDAP vendor, the second from you, the third from the standards bidies or the web. You need to use your problem as your learning opoortunity.
Cancel
Vote Up 0 Vote Down

Cancel
0 Di Ka over 6 years ago in reply to DouglasFoster

Not helpful.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Di Ka over 6 years ago in reply to DouglasFoster

Not helpful.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 DouglasFoster over 6 years ago in reply to Di Ka

Do you mean that you read everything in this post, and yet found nothing that provided insight to your LDAP implementation?
Cancel
Vote Up 0 Vote Down

Cancel
0 Di Ka over 6 years ago in reply to DouglasFoster

I mean that you didn't provide any post, you just asked me if "my product" has "market share among potential paying customers for UTM".
Cancel
Vote Up 0 Vote Down

Cancel
0 DouglasFoster over 6 years ago in reply to Di Ka

There ARE critical holes in the documentation, which I and others have tried to address as we have learned the product. Everyone needs to read most everything in the wiki, to deploy the product securely, because of what is not in the manual. Additional resources are pinned to the top of most forum sections. So keep reading

But at the dane time, show gratitude that home users have access to such a powerful priduct for free.
Cancel
Vote Up 0 Vote Down

Cancel