Hi

I'm trying to authenticate users based on group membership in our Google LDAP directory.
I can authenticate just fine without the 'ldap_access_filter' but when I enable it they still authenticate even when the user is not a group member.
Additionally I don't see any check of the group membership in the logs, so I must be doing something wrong. Please help me.

My sssd.conf

[sssd]
services = nss, pam
domains = domain.dk

[domain/domain.dk]
# Base settings
debug_level = 8
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_access_order = filter
ldap_id_use_start_tls = true

ldap_uri = ldaps://ldap.google.com
ldap_search_base = dc=domain,dc=com
ldap_user_search_base = ou=Users,dc=domain,dc=com
ldap_group_search_base = ou=Groups,dc=domain,dc=com

ldap_tls_cert = /etc/sssd/google-ldap-client.crt
ldap_tls_key = /etc/sssd/google-ldap-client.key

# Disable TLS 1.3 of google LDAP don't work
ldap_tls_cipher_suite = NORMAL:!VERS-TLS1.3

# Access control
ldap_access_filter = (memberOf=CN=vpn,ou=Groups,dc=domain,dc=com)


# Google recommended settings
ldap_schema = rfc2307bis
ldap_user_uuid = entryUUID


I have been looking for any lines in the logs referencing my vpn group but there is none. I have even tried switching to 'auth_provider = simple' but there is no reference of the group check

Regards
Supergoof

----
CEGO A/S will as part of your communication and interaction with us collect and process personal data about you. You can read more about our collection and processing of your personal data and your rights as a data subject at https://cego.dk/gdpr/