Hi all,
I have my Grafana connected to a FreeIPA Server.
FreeIPA uses the RFC2307bis schema, so I have modified the group membership filter to much it.
And from here my problems start.
- Group membership is not working.
My LDAP configuration is:/etc/grafana/ldap.toml
ansible managed
#Documentation: Configure LDAP authentication | Grafana documentation
verbose_logging = true[[servers]]
group_search_base_dns = [“ou=groups,cn=accounts,dc=example,dc=com”]
ssl_skip_verify = true
search_filter = “(uid=%s)”
root_ca_cert = “/etc/ipa/ca.crt”
start_tls = true
bind_dn = “uid=nonipaapps,cn=sysaccounts,cn=etc,dc=example,dc=com”
group_search_filter = “(&(objectClass=posixGroup)(member=uid=%s,cn=users,cn=accounts,dc=example,dc=com))”
search_base_dns = [“cn=users,cn=accounts,dc=example,dc=com”]
host = “idmldap.example.com”
bind_password = “password”
use_ssl = false
port = 389[servers.attributes]
username = “uid”
member_of = “dn”
surname = “sn”
email = “mail”
name = “givenName”#Main Org.
[[servers.group_mappings]]
org_id = 1
org_role = “Admin”
grafana_admin = true
group_dn = “cn=grafana-adms,cn=groups,cn=accounts,dc=example,dc=com”[[servers.group_mappings]]
org_id = 1
org_role = “Editor”
group_dn = “cn=grafana-users,cn=groups,cn=accounts,dc=example,dc=com”[[servers.group_mappings]]
org_id = 1
org_role = “Viewer”
group_dn = “*”
Using ldapsearch, I get back results:
ldapsearch -x -W -D "uid=nonipaapps,cn=sysaccounts,cn=etc,dc=example,dc=com" \
-b "cn=groups,cn=accounts,dc=example,dc=com" \
-h localhost -p 389 -s sub "(&(objectClass=posixGroup) \
member=uid=ptselios,cn=users,cn=accounts,dc=example,dc=com))"
# extended LDIF
#
# LDAPv3
# base <cn=groups,cn=accounts,dc=example,dc=com> with scope subtree
# filter: (&(objectClass=posixGroup)(member=uid=ptselios,cn=users,cn=accounts,dc=example,dc=com))
# requesting: ALL
#
# grafana-adms, groups, accounts, example.com
dn: cn=grafana-adms,cn=groups,cn=accounts,dc=example,dc=com
member: uid=ptselios,cn=users,cn=accounts,dc=example,dc=com
member: uid=user2,cn=users,cn=accounts,dc=example,dc=com
member: uid=user3,cn=users,cn=accounts,dc=example,dc=com
member: uid=user4,cn=users,cn=accounts,dc=example,dc=com
ipaNTSecurityIdentifier: S-1-5-21-120251393-583861438-3385547448-1050
objectClass: top
objectClass: groupofnames
objectClass: nestedgroup
objectClass: ipausergroup
objectClass: ipaobject
objectClass: posixgroup
objectClass: ipantgroupattrs
cn: grafana-adms
description:: blabla
ipaUniqueID: ccc54368-ce1d-11e8-b523-06db1b82a33a
gidNumber: 690200050
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
However, all users are logged in as Viewers!
Also, my account (ptselios) is manually configured to be an Editor. But it’s not reset to Admin! So, obviously the group mapping is not working.
Checking the log file was not helpful either. Here is what is written (with verbose logging as you can see)
t=2018-11-27T14:20:34+0000 lvl=dbug msg="Scheduling update" logger=alerting.scheduler ruleCount=0
t=2018-11-27T14:20:36+0000 lvl=info msg="Searching for user's groups" logger=ldap filter="(&(objectClass=groupOfNames)(member=uid=user01,cn=users,cn=accounts,dc=example,dc=com))"
t=2018-11-27T14:20:36+0000 lvl=dbug msg="**Ldap User found**" logger=ldap info="(*login.LdapUserInfo)(0xc0002fee00)({\n DN: (string) (len=63) \"uid=ashrestha,cn=users,cn=accounts,dc=example,dc=com\",\n FirstName: (string) (len=5) \"User\",\n LastName: (string) (len=8) \"01\",\n Username: (string) (len=9) \"user01\",\n Email: (string) (len=29) \"user01@example.com\",\n MemberOf: ([]string) <nil>\n})\n"
So, why is the group membeship failing? LDAP returns entries and the