Incorrect interaction with Active Directory

Open
#4,029 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
erlang
Domain
authentication, backend

Research direction

Start with the ejabberd.yml authentication and mod_shared_roster_ldap configurations, comparing the sAMAccountName and userPrincipalName settings against the reported behavior. Reproduce the configuration on ejabberd 23.04 with Active Directory, then verify that SSO authorization, user loading, and shared roster LDAP all work together.

Written by the indexing model from the issue text.

Description

There was a need to configure ejabberd for domain sso authentication. Miranda 96.04 is used Ejabberd server 23.04.
I ran into a problem when using sAMAccount name in AD authentication, users are uploaded to ejabberd + - shared roster ldap works, but SSO authorization does not work.
If you specify userPrincipalName. SSO is working. But users are not unloaded and Shared_roster_ldap does not work. Specifying in shared roster ldap ldap_uids does not help.

Am I missing something or is this a bug

Environment

  • ejabberd version: 23.04
  • OS: Ubuntu (20.04)
  • Installed from: Official Repositiry

Configuration ejabberd.yml

hosts:

  • localhost
  • example.com
    host_config:
    localhost:
    auth_method:
    • internal
      example.com:
      auth_method:
    • ldap
    • anonymous
      allow_multiple_connections: true
      anonymous_protocol: both
      ldap_servers:
  • "dc1.example.com"
    ldap_port: 389
    ldap_rootdn: "cn=ejabberd,cn=Users,dc=example,dc=com"
    ldap_password: "password"
    ldap_base: "dc=example,dc=com"
    #ldap_uids: [sAMAccountName]
    ldap_uids: [userPrincipalName]

Config share_roster_ldap

mod_roster:
versioning: true
mod_s2s_dialback: {}
mod_shared_roster: {}
mod_shared_roster_ldap:
ldap_base: "ou=Users,dc=example,dc=com"
ldap_rfilter: "(objectClass=user)"
ldap_groupattr: "department"
ldap_groupdesc: "department"
ldap_memberattr: "sAMAccountName"
ldap_userdesc: "displayName"
ldap_uids: [sAMAccountName]

Dominant language
Erlang
Stars
6.7k
Forks
1.6k
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from processone/ejabberd

All issues in processone/ejabberd

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.