topic Mac OSX Server Open Directory in General Topics

Mac OSX Server Open Directory

ethiSEC — Mon, 21 Mar 2011 11:52:16 GMT

We use Open Directory as our primary LDAP service whcih normally works pretty well.

I'm trying to get LDAP authentication profiles up and running and am only having limited success. By limited I mean I can authenticate a user against a simple config where I am looking for the "uid" login attribute in the users group using cn=users,dc=server,dc=mydomain,dc=com.

If I try to authenticate a user in a group called sslvpn (cn=sslvpn,cn=groups,dc=server,dc=mydomain,dc=com) using "memberUid" as the login attribute the session login fails with an invalid username/password error.

Just wondering if there is a limitation in PANOS when it comes to Open Directory attributes or if I'm doing something simple wrong?

Jason

Re: Mac OSX Server Open Directory

gsamuels — Wed, 23 Mar 2011 01:46:29 GMT

The login attribute " uid" in the working authentication profile we assume would be used in the sslvpn authprofile instead of 'memberUid'

On initial review that could be causing auth attempts to fail.

Re: Mac OSX Server Open Directory

garretta — Mon, 20 Jun 2011 19:00:50 GMT

hello --

Apple OpenDirectory has a custom (ie. proprietary) schema objectclass to define group membership (ie. apple-group).

Apple's OpenDirectory does NOT use objectclass=groupofuniquenames which includes the uniquemember attribute to define group membership.

Thus, the OpenLDAP support (a superset of OpenDirectory) provided by LDAP auth of Palo Alto Networks will not likely include any support for apple's group membership.

-GA

Re: Mac OSX Server Open Directory

ethiSEC — Tue, 21 Jun 2011 01:21:25 GMT

This sounds about right to me from other research, bit of a nusiance though.

Would be nice if PAN would do some development to provide support for OpenDirectory.

Jason

Re: Mac OSX Server Open Directory

garretta — Tue, 21 Jun 2011 13:54:47 GMT

hello -- I can't post screenshots to this forum, but I have screenshot of OpenDirectory group object and similar OpenLDAP-based group object.

the membership attribute for "apple-group" is 'memberuid' and contains UID value.

the membership attribute for "groupofuniquenames" is "uniquemember" and contains user DN value (full user object address).

the value of "uniquemember" can be readily used as part of ldap_simple_bind auth validation, but the 'memberuid" value requires one extra step (ie. lookup user object to get the DN value for LDAP_simple_bind).

-GA