Can't connect to OpenLDAP server - silently fails

[KeithR]

Hi all,

I've got an OpenLDAP server running (which currently controls our VPN so I know it's working). I've entered the configuration and it seems to happily go off and do...something after I hit submit. But no users/groups ever show in the GUI or when trying freenas-debug options. No errors reported, etc. I found the well-hidden Settings->Advanced->Rebuild LDAP cache too, and that also seems to go off and happily do...something - but still no users. I used the same parameters to connect with jxplorer and it works fine.

Can anyone provide guidance? I'm on FreeNAS-9.2.1.7-RELEASE-x64 (fdbe9a0) w 16G RAM

Conf attached (obfuscated). I tried changing HOST to URI but that looks like a red-herring and made no difference.

 

[KeithR]

Update: I can connect from freenas shell using ldapsearch and query our DB using the parameters created by FreeNAS. For example:

ldapsearch -x -W -D 'cn=manager,dc=obfuscated,dc=com' "(objectclass=*)" '*' | more
[enters password]

works fine (if you pretend that our domain is obfuscated.com...) and dumps our entire user structure.

 

[cyberjock]

Oh boy! I'm gonna pwn obfuscated.com! Thanks for the userlist! :D LOL

Have you tried searching bugs.freenas.org for a ticket that sounds like this? This seems familiar to me for some reason...

 

[KeithR]

I pretend to work at obfuscated.com so people won't see what idiots my employer hires :)

I scanned through the bugs - the only thing I saw somewhat close was maybe some issues if using CIFS without the Samba extensions. But didn't really click symptom-wise.

 

[dlavigne]

Please create a report that includes that ldap.conf and post the issue number here.

 

[KeithR]

Thx

https://bugs.freenas.org/issues/5922

and I'm willing to test a fix or additional diagnostics - this is not yet in production.

 

[willnx]

Just as a sanity check, did you enable the service?
Doing this was a bit obscure to me, and I beat my head against the wall troubleshooting my LDAP server.

FreeNAS GUI
Step 1
System > Settings > Directory service - set to LDAP
Step 2
Services > Control Services > Directory Services - set to On

Note:
Once you turn on a directory service, you can only auth against that provider - really hopping FreeNAS releases the multiple auth providers feature soon :D

 

[KeithR]

Yes, but thanks for playing! :)

what I've heard from another source is that your openldap must also have the samba extensions added (which we haven't done)