1

I am using Dex as our Identity provider and connecting it to LDAP. Below is my ldap config in Dex:

connectors:
- type: ldap
 id: ldap
 name: LDAP
 config:
   host: myhost.staging.com:636
   insecureNoSSL: false
   insecureSkipVerify: false
   bindDN: cn=prometheus-proxy,ou=serviceaccounts,dc=staging,dc=comp,dc=com
   bindPW: 'prometheus'
   rootCA: /etc/dex/ldap/ca-bundle.pem
   userSearch:
     baseDN: ou=people,dc=staging,dc=comp,dc=com
     filter: "(objectClass=person)"
     username: uid
     idAttr: uid
     emailAttr: mail
     nameAttr: uid
   groupSearch:
     baseDN: ou=appgroups,dc=staging,dc=comp,dc=com
     filter: "(objectClass=groupOfMembers)"
     userAttr: DN
     groupAttr: member
     nameAttr: cn

And below is a sample userSearch & groupSearch Result:

dn: uid=swedas01,ou=people,dc=staging,dc=comp,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
cn: Sweta Das
gecos: Sweta Das
gidNumber: 50000
givenName: Sweta
mail: Sweta.Das@comp.com
sn: Das
uid: swedas01
memberOf: cn=jenkins,ou=appgroups,dc=staging,dc=comp,dc=com
homeDirectory: /home/swedas01

dn: cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com
objectClass: top
objectClass: groupOfMembers
cn: prometheus
member: uid=testl01,ou=people,dc=staging,dc=comp,dc=com

When I login to my Prometheus instance which uses the above config, even though my userID is not part of the Group that is being used ie Prometheus, I am still able to login.

Dex logs shows there is no groups associated with my id. 

time="2019-10-07T19:05:48Z" level=info msg="performing ldap search ou=people,dc=staging,dc=comp,dc=com sub (&(objectClass=person)(uid=swedas01))"
time="2019-10-07T19:05:48Z" level=info msg="username \"swedas01\" mapped to entry uid=swedas01,ou=people,dc=staging,dc=comp,dc=com"
time="2019-10-07T19:05:48Z" level=info msg="performing ldap search cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com sub (&(objectClass=groupOfMembers)(member=uid=swedas01,ou=people,dc=staging,dc=comp,dc=com))"
time="2019-10-07T19:05:48Z" level=error msg="ldap: groups search with filter \"(&(objectClass=groupOfMembers)(member=uid=swedas01,ou=people,dc=staging,dc=comp,dc=com))\" returned no groups"
time="2019-10-07T19:05:48Z" level=info msg="login successful: connector \"ldap\", username=\"swedas01\", email=\"Sweta.Das@comp.com\", groups=[]"

But why is it still allowing me to login? Is there any way I can mandate this setting if group serach returns empty, login should fail?

EricLavault
  • 12,130
  • 3
  • 23
  • 45
swetad90
  • 784
  • 1
  • 13
  • 34
  • 1
    It seems `groupSearch` is just about grabbing group data but not for authorization, as you also concluded. Though before switching tool you may want to try something (I'm not sure so I leave it there as a comment) : since your directory supports `memberOf` attribute, you can try adding a membership condition in the userSearch filter. Now look : `username: uid` and `filter: "(objectClass=person)"` results in the final filter `"(&(objectClass=person)(uid=))"`, so it might be possible to add the membership condition *without operator* in the filter setting – EricLavault Oct 14 '19 at 09:47
  • ... like `filter: "(objectClass=person)(memberOf=cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com)"` so that the final filter results in `(&(objectClass=person)(memberOf=cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com)(uid=))` – EricLavault Oct 14 '19 at 09:47
  • @EricLavault your answer is correct. I've just tested it with dex. thanks. Please also write it in answer section. BTW note that there is no need for `&` operator, dex adds the `&` itself, and adding it causes an error. So `filter: "(objectClass=person)(memberOf=cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com)"` do the trick. – Mohammad Yosefpor Dec 15 '20 at 20:25
  • @MohammadYusefpur Hi, I just added it as an answer. Thank you for the feedback ! – EricLavault Dec 19 '20 at 11:17

2 Answers2

2

Since your directory supports memberOf attribute, you can try adding a membership condition in the userSearch filter.

Now look :

username: uid
filter: "(objectClass=person)"

yields the following ldap filter :

"(&(objectClass=person)(uid=<uid>))"

So it might be possible to add the membership condition without operator in the filter setting, as dex is actually adding the operator itself (tested and confirmed by @MohammadYusefpur).

Like :

filter: "(objectClass=person)(memberOf=cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com)"

so that the actual ldap filter results in

(&(objectClass=person)(memberOf=cn=prometheus,ou=appgroups,dc=staging,dc=comp,dc=com)(uid=<uid>))
EricLavault
  • 12,130
  • 3
  • 23
  • 45
0

I am still not sure if this is the right answer. But as far as I could understood, Dex's group search is just for ldap search. It returns the groups a user is memberof. Once you get the groups back, you can put RBAC policies on those group to control what kind of access you want to give to the user.

However, for tools which do not have any auth methods of its ownn(eg Prometheus), I am still not sure how to implement ldap group auth!

swetad90
  • 784
  • 1
  • 13
  • 34