0

I'm trying to configure Red Hat Ansible Tower to authenticate via LDAPS. It has a web GUI to configure LDAPS settings but the only way to test it is via the ldapsearch CLI utility. I've never used LDAPS before getting this project dumped on my lap.

I think ldapsearch -x -H ldaps://myldapserver:ldapport -D "CN=ansible,OU=blah,DC=blah" -b "OU=ansiblegroup,DC=blah" -w passwd returns the following:

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntires: 2

Truthfully I have no clue what these results mean, but I assume it's working because it says Success. I tried putting the -H as Tower's "LDAP Server URI", the -D as "LDAP Bind DN" and the -b as "LDAP Group Type Parameters" but no luck.

There is an additional OU called accessgroup within ansiblegroup that contains the actual users (let's say user1 and user2), but if I change it to -b "OU=accessgroup,OU=ansiblegroup,DC=blah I get this instead:

search: 2
result: 32 No such object
matchedDN: OU=ansiblegroup,DC=blah"

So where do I go from here? Is there anything short of a 1,000 page LDAP manual that might be of use?

2
  • Maybe show the LDIF of the object you are searching.
    – U. Windl
    Apr 5, 2022 at 9:35
  • Try the -v option first.
    – gerhard d.
    Apr 5, 2022 at 17:35

1 Answer 1

0

Lets assume there is the following configuration

TOWER_URL="tower.example.com";
curl --silent --user "${ACCOUNT}:${PASSWORD}" --location "https://${TOWER_URL}/api/v2/settings/ldap" | jq '.'

resulting into an output of

{
  "AUTH_LDAP_SERVER_URI": "ldaps://ad.example.com:636",
  "AUTH_LDAP_BIND_DN": "CN=tower_ldap,OU=service_accounts,OU=accounts,DC=example,DC=com",
  "AUTH_LDAP_BIND_PASSWORD": "$encrypted$",
  "AUTH_LDAP_START_TLS": false,
  "AUTH_LDAP_CONNECTION_OPTIONS": {
    "OPT_REFERRALS": 0,
    "OPT_NETWORK_TIMEOUT": 30
  },
  "AUTH_LDAP_USER_SEARCH": [
    "DC=example,DC=com",
    "SCOPE_SUBTREE",
    "(sAMAccountName=%(user)s)"
  ],
  "AUTH_LDAP_USER_DN_TEMPLATE": null,
  "AUTH_LDAP_USER_ATTR_MAP": {
    "first_name": "givenName",
    "last_name": "sn",
    "email": "userPrincipalName"
  },
  "AUTH_LDAP_GROUP_SEARCH": [
    "OU=groups,DC=example,DC=com",
    "SCOPE_SUBTREE",
    "(objectClass=group)"
  ],
  "AUTH_LDAP_GROUP_TYPE": "NestedActiveDirectoryGroupType",
  "AUTH_LDAP_GROUP_TYPE_PARAMS": {},
  "AUTH_LDAP_REQUIRE_GROUP": "CN=tower_user,OU=resource_groups,OU=groups,DC=example,DC=com",
  "AUTH_LDAP_DENY_GROUP": null,
  "AUTH_LDAP_USER_FLAGS_BY_GROUP": {},
  "AUTH_LDAP_ORGANIZATION_MAP": {},
  "AUTH_LDAP_TEAM_MAP": {},
  "AUTH_LDAP_1_SERVER_URI": "",
  "AUTH_LDAP_1_BIND_DN": "",
  "AUTH_LDAP_1_BIND_PASSWORD": "",
  "AUTH_LDAP_1_START_TLS": true,
  "AUTH_LDAP_1_CONNECTION_OPTIONS": {
    "OPT_REFERRALS": 0,
    "OPT_NETWORK_TIMEOUT": 30
  },
  ...

You could query the directory for name as follow

ldapsearch -h ad.example.com -p 389 \
           -D "tower_ldap" -x -w "${LDAP_PASSWORD}" \
           -b "DC=example,DC=com" \
           -s sub "(& (memberOf:1.2.840.113556.1.4.1941:=CN=tower_user,OU=resource_groups,OU=groups,DC=example,DC=com) )" name \
           | grep "name:" | cut -d " " -f 2-

to get just the usernames of users which are allowed to login or search further for cn instead with

... cn | grep "cn:" | cut -d " " -f 2-
... cn | grep "cn:" | cut -d " " -f 2- | wc -l

Please take note that

"AUTH_LDAP_REQUIRE_GROUP": "CN=tower_user,OU=resource_groups,OU=groups,DC=example,DC=com"

contains a role group as member only

CN=tower_user_role,OU=role_groups,OU=groups,DC=example,DC=com

therefore the query for NestedActiveDirectoryGroupType.

Further Q&A

Further Documenation

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .