启用openvpn-auth-ldap.so的RequireGroup后认证失败排查

我使用openvpn-auth-ldap.so作为OpenVPN的认证插件，目标是仅允许cn=corevpn,ou=tech,ou=group,dc=openldap,dc=example,dc=com组内成员登录OpenVPN。

配置文件（ldap-auth.conf） #

<LDAP>
    URL ldap://127.0.0.1:389
    BindDN cn=admin,dc=openldap,dc=example,dc=com
    Password "secret"
    Timeout 60
    FollowReferrals yes
    TLSEnable no
</LDAP>

<Authorization>
    BaseDN "ou=people,dc=openldap,dc=example,dc=com"
    SearchFilter "(uid=%u)"
    RequireGroup true

    <Group>
        BaseDN "ou=Group,dc=openldap,dc=example,dc=com"
        SearchFilter "(&amp;(objectClass=posixGroup)(cn=corevpn)(memberUid=%u))"
        MemberAttribute memberUid
    </Group>
</Authorization>

LDAP用户组验证结果 #

通过ldapsearch确认用户kevin属于corevpn组：

root@master:/container/service/slapd/assets/config/bootstrap/ldif/custom# ldapsearch -x -LLL -H ldapi:/// -D "cn=admin,dc=openldap,dc=example,dc=com" -W -b "ou=group,dc=openldap,dc=example,dc=com" "(memberUid=kevin)"
Enter LDAP Password: 
dn: cn=corevpn,ou=tech,ou=Group,dc=openldap,dc=example,dc=com
cn: corevpn
gidNumber: 504
objectClass: posixGroup
objectClass: top
memberUid: kevin

错误现象 #

启用RequireGroup后认证失败，具体表现如下：

OpenLDAP日志（组搜索时%u未替换） #

665732a0 conn=1120 fd=14 ACCEPT from IP=172.30.0.11:38546 (IP=0.0.0.0:389)
665732a0 conn=1120 op=0 BIND dn="cn=admin,dc=openldap,dc=example,dc=com" method=128
665732a0 conn=1120 op=0 BIND dn="cn=admin,dc=openldap,dc=example,dc=com" mech=SIMPLE ssf=0
665732a0 conn=1120 op=0 RESULT tag=97 err=0 text=
665732a0 conn=1120 op=1 SRCH base="ou=people,dc=openldap,dc=example,dc=com" scope=2 deref=0 filter="(uid=kevin)"
665732a0 conn=1120 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
665732a0 conn=1121 fd=15 ACCEPT from IP=172.30.0.11:38558 (IP=0.0.0.0:389)
665732a0 conn=1121 op=0 BIND dn="cn=admin,dc=openldap,dc=example,dc=com" method=128
665732a0 conn=1121 op=0 BIND dn="cn=admin,dc=openldap,dc=example,dc=com" mech=SIMPLE ssf=0
665732a0 conn=1121 op=0 RESULT tag=97 err=0 text=
665732a0 conn=1121 op=1 BIND anonymous mech=implicit ssf=0
665732a0 conn=1121 op=1 BIND dn="cn=kevin,ou=People,dc=openldap,dc=example,dc=com" method=128
665732a0 conn=1121 op=1 BIND dn="cn=kevin,ou=People,dc=openldap,dc=example,dc=com" mech=SIMPLE ssf=0
665732a0 conn=1121 op=1 RESULT tag=97 err=0 text=
665732a0 conn=1121 op=2 UNBIND
665732a0 conn=1120 op=2 SRCH base="ou=Group,dc=openldap,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(cn=corevpn)(memberUid=%u))"
665732a0 <= mdb_equality_candidates: (cn) not indexed
665732a0 conn=1121 fd=15 closed
665732a0 <= mdb_equality_candidates: (memberUid) not indexed
665732a0 conn=1120 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text=
665732a0 conn=1120 op=3 UNBIND
665732a0 conn=1120 fd=14 closed

OpenVPN服务端日志 #

2024-05-29 20:35:04 us=599688 122.241.13.157:59447 PLUGIN_CALL: POST /usr/lib/openvpn/plugins/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
2024-05-29 20:35:04 us=599712 122.241.13.157:59447 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/plugins/openvpn-auth-ldap.so
2024-05-29 20:35:04 us=600090 122.241.13.157:59447 TLS Auth Error: Auth Username/Password verification failed for peer

客户端提示 #

Wrong creditials try again

需求 #

1. 实现仅指定组成员可成功登录OpenVPN的功能
2. 排查OpenLDAP收到memberUid=%u而非memberUid=kevin的原因

内容的提问来源于stack exchange，提问作者cier dev.