Hi
I'm trying to authenticate users based on group membership in our Google LDAP directory.
I can authenticate just fine without the 'ldap_access_filter' but when I enable it they still authenticate even when the user is not a group member.
Additionally I don't see any check of the group membership in the logs, so I must be doing something wrong. Please help me.
My sssd.conf
[sssd]
services = nss, pam
domains = domain.dk
[domain/domain.dk]
# Base settings
debug_level = 8
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_access_order = filter
ldap_id_use_start_tls = true
ldap_uri = ldaps://ldap.google.com
ldap_search_base = dc=domain,dc=com
ldap_user_search_base = ou=Users,dc=domain,dc=com
ldap_group_search_base = ou=Groups,dc=domain,dc=com
ldap_tls_cert = /etc/sssd/google-ldap-client.crt
ldap_tls_key = /etc/sssd/google-ldap-client.key
# Disable TLS 1.3 of google LDAP don't work
ldap_tls_cipher_suite = NORMAL:!VERS-TLS1.3
# Access control
ldap_access_filter = (memberOf=CN=vpn,ou=Groups,dc=domain,dc=com)
# Google recommended settings
ldap_schema = rfc2307bis
ldap_user_uuid = entryUUID
I have been looking for any lines in the logs referencing my vpn group but there is none. I have even tried switching to 'auth_provider = simple' but there is no reference of the group check
Regards
Supergoof