From f96868318af26f9d5bb1e15050d7fde7d64a948f Mon Sep 17 00:00:00 2001 From: Torstein Eide <1884894+Torstein-Eide@users.noreply.github.com> Date: Sat, 27 Apr 2024 14:42:48 +0200 Subject: [PATCH] example_configs: pfsense.md, add warning about error about `OU` --- example_configs/pfsense.md | 43 ++++++++++++++++++++++++++++---------- 1 file changed, 32 insertions(+), 11 deletions(-) diff --git a/example_configs/pfsense.md b/example_configs/pfsense.md index 198b6de..a88cc68 100644 --- a/example_configs/pfsense.md +++ b/example_configs/pfsense.md @@ -1,5 +1,8 @@ # Configuration for pfSense +> [!NOTE] +> Replace `dc=example,dc=com` with the same LDAP Base DN that you set via the *LLDAP_LDAP_BASE_DN* environment variable or in `lldap_config.toml`. + ## Create a LDAP Server - Login to pfSense @@ -16,7 +19,9 @@ - Protocol version: `3` - Server Timeout: `25` -(Make sure the host running LLDAP is accessible to pfSense and that you mapped the LLDAP port to the LLDAP host) +> [!NOTE] +> Make sure the host running LLDAP is accessible to pfSense and that you mapped the LLDAP port to the LLDAP host + ### Search Scope ``` Entire Subtree @@ -27,18 +32,25 @@ Entire Subtree dc=example,dc=com ``` -This is the same LDAP Base DN that you set via the *LLDAP_LDAP_BASE_DN* environment variable or in `lldap_config.toml`. ### Authentication containers ``` ou=people ``` -Note: The `Select a container` box may not work for selecting containers. You can just enter the `Authentication containers` directly into the text field. +> [!Note] +> The `Select a container` seach fuction will not work for selecting containers. You enter the `Authentication containers` directly into the text field. +> This is due to Pfsense running the following filter `"(|(ou=*)(cn=Users))"`, and `Organizational Units` is currently not supported.Could not connect to the LDAP server. Please check the LDAP configuration. + +> [!WARNING] +> if search button is pressed a warning will show on the bottom of the page: `Could not connect to the LDAP server. Please check the LDAP configuration.` + ### Extended Query -Enable extended query: `Checked` +Enable extended query: + +- [X] `Checked` ### Query: @@ -49,7 +61,8 @@ Enable extended query: `Checked` This example gives you two groups in LLDAP, one for pfSense admin access (`pfsense_admin`) and one for guest access (`pfsense_guest`). You **must** create these exact same groups in both LLDAP and pfSense, then give them the correct permissions in pfSense. ### Bind Anonymous -`Unchecked` + +- [ ] `Unchecked` ### Bind credentials @@ -80,13 +93,18 @@ cn memberof ``` ### RFC 2307 Groups -`Unchecked` + +- [ ] `Unchecked` ### Group Object Class -`groupOfUniqueNames` +``` +groupOfUniqueNames +``` ### Shell Authentication Group DN -`cn=pfsense_admin,ou=groups,dc=example,dc=com` +``` +cn=pfsense_admin,ou=groups,dc=example,dc=com +``` (This is only if you want to give a group shell access through LDAP. Leave blank and only the pfSense admin user will have shell access. @@ -94,9 +112,9 @@ memberof Enable the following options on the pfSense configuration page for your LLDAP server (the same page where you entered the prior configuration): -- UTF8 Encodes: `Checked` -- Username Alterations: `Unchecked` -- Allow unauthenticated bind: `Unchecked` +- [X] UTF8 Encodes: `Checked` +- [ ] Username Alterations: `Unchecked` +- [ ] Allow unauthenticated bind: `Unchecked` ### Create pfSense Groups @@ -112,6 +130,9 @@ Go to `System > User Manager > Settings` page. Add your LLDAP server configurati pfSense includes a built-in feature for testing user authentication at `Diagnostics > Authentication`. Select your LLDAP server configuration in the `Authentication Server` to test logins for your LLDAP users. The groups (only the ones you added to pfSense) should show up when tested. +> [!WARNING] +> When running `Save and test`, the `Attempting to fetch Organizational Units from` will fail. This is due to Pfsense running the following filter `"(|(ou=*)(cn=Users))"`, and `Organizational Units` is currently not supported. + ## More Information Please read the [pfSense docs](https://docs.netgate.com/pfsense/en/latest/usermanager/ldap.html) for more information on LDAP configuration and managing access to pfSense.