Hide Forgot
Description of problem: The groupsync feature doesn't work with AD LDS, authentication does though. Version-Release number of selected component (if applicable): ldap_fluff-0.4.3 How reproducible: 100% Steps to Reproduce: 1. add AD LDS server with Satellite 2. setup groupsync 3. login and the user will have no permissions, because they arent part of a group. Actual results: no permssions Expected results: user to have relevant permissions Additional info:
Fixed in https://github.com/theforeman/ldap_fluff/pull/54
Satellite 6.3.0 snap 30 Steps: 1. Created a AD LDS instance 2. Added the auth source in satellite 3. Tried to associated the external group with user group I get the error: Unable to save Could not refresh external usergroups: LdapFluff::Generic::UnauthenticatedException - Could not bind to ActiveDirectory user foobar - The authentication source of your external user groups could not connect to LDAP with the provided credentials. Please verify the credentials are still valid. Tried with admin account same issue
At a customer we managed to backport this fix to 6.2.x and it worked, though we had no management of their AD server, we were just told it was AD LDS. Sorry I can't provide any more info right now, I'm no longer on-site with that customer.
Satellite 6.3.0 snap 32 Mhulan, Sean Thank you for looking into this, I put some time today and recreated the AD LDS setup, I am now able to add associate External Group with usergroup and also the user from external user group are able to inhert the permissions from the user group.
Created attachment 1383261 [details] AD LDS user and group
out of curiosity, how did you create bindable user in LDS? what needed to be changed? thanks!
The missing thing was the userProxy.ldf user.ldf files which are to be imported when we deploy a LDS instance. Only then we can create userProxy type objects which are basically objects redirected or binded with any AD user which have the msDS-bindableObject attribute.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. > > > > For information on the advisory, and where to find the updated files, follow the link below. > > > > If the solution does not work for you, open a new bug report. > > > > https://access.redhat.com/errata/RHSA-2018:0336