LDAP group search issue

[ab1g17]

Hello everyone,

My current LDAP config (obfuscated):
INVENTREE_LDAP_ENABLED=True
INVENTREE_LDAP_SERVER_URI=ldap://myldapserver
INVENTREE_LDAP_SEARCH_FILTER_STR=(sAMAccountName=%(user)s)
INVENTREE_LDAP_BIND_DN='CN=serviceaccount,OU=Users,DC=eu,DC=corp,DC=com'
INVENTREE_LDAP_BIND_PASSWORD='pass'
INVENTREE_LDAP_START_TLS=False
INVENTREE_LDAP_DEBUG=True
INVENTREE_LDAP_USER_DN_TEMPLATE=
INVENTREE_LDAP_BASE_DN='DC=corp,DC=com'
INVENTREE_LDAP_USER_ATTR_MAP={"first_name": "givenName", "last_name": "Surname", "email": "EmailAddress"}
INVENTREE_LDAP_GROUP_SEARCH=OU=Users,OU=Site,dc=eu,dc=corp,dc=com
INVENTREE_LDAP_REQUIRE_GROUP=Site Catalog Tool Users

For any username I try to login as (even ones that dont exist in AD at all) the error I see in the logs is:

Binding as CN=serviceaccount,OU=Users,DC=eu,DC=plexus,DC=com
Binding as CN=serviceaccount,OU=Users,DC=eu,DC=plexus,DC=com
is not a member of site catalog tool users
is not a member of site catalog tool users
Authentication failed for john.smith: user does not satisfy AUTH_LDAP_REQUIRE_GROUP
Authentication failed for john.smith: user does not satisfy AUTH_LDAP_REQUIRE_GROUP

Is there something wrong with the group search config?

Things I have tried:
checked spelling of group names,
making sure user is indeed part of the group,
using DN of group instead of just a string of the name
made sure the serviceaccount has rights to perform search of groups

[ab1g17]

@wolflu05 maybe you could shed some light here?

[wolflu05]

Hi, sorry that I can't really help here, as I'm not using ldap in a setup anymore. But I can give you some links to documentations:

Basically

• LDAP group support was added by LDAP group membership support #6003
• basically that's just forwarding env/config variables to an external module named Django-auth-ldap, see

  InvenTree/src/backend/InvenTree/InvenTree/settings.py

  Lines 361 to 458 in 6953640

  	LDAP_AUTH = get_boolean_setting('INVENTREE_LDAP_ENABLED', 'ldap.enabled', False)
  	if LDAP_AUTH:
  	import ldap
  	from django_auth_ldap.config import GroupOfUniqueNamesType, LDAPSearch
  	AUTHENTICATION_BACKENDS.append('django_auth_ldap.backend.LDAPBackend')
  	# debug mode to troubleshoot configuration
  	LDAP_DEBUG = get_boolean_setting('INVENTREE_LDAP_DEBUG', 'ldap.debug', False)
  	if LDAP_DEBUG:
  	if 'loggers' not in LOGGING:
  	LOGGING['loggers'] = {}
  	LOGGING['loggers']['django_auth_ldap'] = {
  	'level': 'DEBUG',
  	'handlers': ['console'],
  	}
  	# get global options from dict and use ldap.OPT_* as keys and values
  	global_options_dict = get_setting(
  	'INVENTREE_LDAP_GLOBAL_OPTIONS',
  	'ldap.global_options',
  	default_value=None,
  	typecast=dict,
  	)
  	global_options = {}
  	for k, v in global_options_dict.items():
  	# keys are always ldap.OPT_* constants
  	k_attr = getattr(ldap, k, None)
  	if not k.startswith('OPT_') or k_attr is None:
  	print(f"[LDAP] ldap.global_options, key '{k}' not found, skipping...")
  	continue
  	# values can also be other strings, e.g. paths
  	v_attr = v
  	if v.startswith('OPT_'):
  	v_attr = getattr(ldap, v, None)
  	if v_attr is None:
  	print(f"[LDAP] ldap.global_options, value key '{v}' not found, skipping...")
  	continue
  	global_options[k_attr] = v_attr
  	AUTH_LDAP_GLOBAL_OPTIONS = global_options
  	if LDAP_DEBUG:
  	print('[LDAP] ldap.global_options =', global_options)
  	AUTH_LDAP_SERVER_URI = get_setting('INVENTREE_LDAP_SERVER_URI', 'ldap.server_uri')
  	AUTH_LDAP_START_TLS = get_boolean_setting(
  	'INVENTREE_LDAP_START_TLS', 'ldap.start_tls', False
  	)
  	AUTH_LDAP_BIND_DN = get_setting('INVENTREE_LDAP_BIND_DN', 'ldap.bind_dn')
  	AUTH_LDAP_BIND_PASSWORD = get_setting(
  	'INVENTREE_LDAP_BIND_PASSWORD', 'ldap.bind_password'
  	)
  	AUTH_LDAP_USER_SEARCH = LDAPSearch(
  	get_setting('INVENTREE_LDAP_SEARCH_BASE_DN', 'ldap.search_base_dn'),
  	ldap.SCOPE_SUBTREE,
  	str(
  	get_setting(
  	'INVENTREE_LDAP_SEARCH_FILTER_STR',
  	'ldap.search_filter_str',
  	'(uid= %(user)s)',
  	)
  	),
  	)
  	AUTH_LDAP_USER_DN_TEMPLATE = get_setting(
  	'INVENTREE_LDAP_USER_DN_TEMPLATE', 'ldap.user_dn_template'
  	)
  	AUTH_LDAP_USER_ATTR_MAP = get_setting(
  	'INVENTREE_LDAP_USER_ATTR_MAP',
  	'ldap.user_attr_map',
  	{'first_name': 'givenName', 'last_name': 'sn', 'email': 'mail'},
  	dict,
  	)
  	AUTH_LDAP_ALWAYS_UPDATE_USER = get_boolean_setting(
  	'INVENTREE_LDAP_ALWAYS_UPDATE_USER', 'ldap.always_update_user', True
  	)
  	AUTH_LDAP_CACHE_TIMEOUT = get_setting(
  	'INVENTREE_LDAP_CACHE_TIMEOUT', 'ldap.cache_timeout', 3600, int
  	)
  	AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
  	get_setting('INVENTREE_LDAP_GROUP_SEARCH', 'ldap.group_search'),
  	ldap.SCOPE_SUBTREE,
  	'(objectClass=groupOfUniqueNames)',
  	)
  	AUTH_LDAP_GROUP_TYPE = GroupOfUniqueNamesType(name_attr='cn')
  	AUTH_LDAP_REQUIRE_GROUP = get_setting(
  	'INVENTREE_LDAP_REQUIRE_GROUP', 'ldap.require_group'
  	)
  	AUTH_LDAP_DENY_GROUP = get_setting('INVENTREE_LDAP_DENY_GROUP', 'ldap.deny_group')
  	AUTH_LDAP_USER_FLAGS_BY_GROUP = get_setting(
  	'INVENTREE_LDAP_USER_FLAGS_BY_GROUP',
  	'ldap.user_flags_by_group',
  	default_value=None,
  	typecast=dict,
  	)
  	AUTH_LDAP_FIND_GROUP_PERMS = True

• Documentation for that module is available at https://django-auth-ldap.readthedocs.io/en/latest/groups.html

Maybe that's for some help of you.

[ab1g17]

apparently the code is looking for "uniqueMember" attribute when searching the groups, and my AD environment uses the "member" attribute to store the users as members of groups. Any idea if there is a way to fix this without changing the code?

[wolflu05]

Are you referring to

InvenTree/src/backend/InvenTree/InvenTree/settings.py

Line 445 in 6953640

'(objectClass=groupOfUniqueNames)',

And you want to have '(objectClass=groupOfNames)' ? Then the best way would be to add a setting for this as well. The best would be if you could submit a PR for this then.

[wolflu05]

#8475 may be related??

[jacobfelknor]

Yes, if #8475 is merged, this should address this issue. For example, in my environment, I specified the following new options

INVENTREE_LDAP_GROUP_OBJECT_CLASS: group
INVENTREE_LDAP_GROUP_TYPE_CLASS: NestedMemberDNGroupType
INVENTREE_LDAP_GROUP_TYPE_CLASS_ARGS: member
INVENTREE_LDAP_GROUP_TYPE_CLASS_KWARGS: '{"name_attr": "cn"}'