All, I recently discovered that newer versions of AD have a magic attribute on user objects, visible via a BASE scope search on the user object, called tokenGroups. This attribute is a list of all the SIDs of all groups the user is a member of, including nested groups, and taking account of disabled groups: $ ldapsearch -h $DC -b 'CN=usern,OU=...' -s base tokenGroups|head -20 dn: CN=usern,OU=... tokenGroups:: AQIAAAAAAAUgAAAAIQIAAA== $ ldapsearch -h $DC -b $B -s sub objectSid=<ldap escaped tokenGroup val> dn: CN=Users,CN=Builtin,DC=ic,DC=ac,DC=uk cn: Users It strikes me that reading this (and translating SIDs to CN) might be a useful feature to have in the LDAP module - the SIDs are basically static so can be cached internally, so in the long run it's quick, and handles the nesting which is nice. It's plain LDAP, so no weird #defines needed. If people want I'll knock together a patch (as I have working local code from another application that I wrote that reads it). The idea would be an ldap config item like this: ldap { # extract LDAP-Group values from AD magic tokenGroups # attribute once a user has been found - handles nested # and disabled groups ad_tokengroups = [no|yes] # which attribute of the group is the group "name" ad_tokengroup_name = "cn" }
"Garber, Neal" <Neal.Garber@iberdrolausa.com> wrote:
This attribute is a list of all the SIDs of all groups the user is a member of, including nested groups, and taking account of disabled groups:
Nice. Do you know if this includes the primaryGroup value which is missing from the memberOf attribute? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Yes it does -- Sent from my phone with, please excuse brevity and typos
On 11 Oct 2013, at 20:09, Phil Mayers <p.mayers@IMPERIAL.AC.UK> wrote:
"Garber, Neal" <Neal.Garber@iberdrolausa.com> wrote:
This attribute is a list of all the SIDs of all groups the user is a member of, including nested groups, and taking account of disabled groups:
Nice. Do you know if this includes the primaryGroup value which is missing from the memberOf attribute? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
Yes it does
Phil are you actively working on this? If you haven't got started I can probably hack it in, in a couple of hours? My head is still in that code following the rewrite for 3.0.0 -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
Go for it - I'm currently in Barcelona and mostly offline for the next few days - certainly no coding as mobile devices only! -- Sent from my phone with, please excuse brevity and typos
On 11 Oct 2013, at 18:14, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
All,
I recently discovered that newer versions of AD have a magic attribute on user objects, visible via a BASE scope search on the user object, called tokenGroups.
This attribute is a list of all the SIDs of all groups the user is a member of, including nested groups, and taking account of disabled groups:
$ ldapsearch -h $DC -b 'CN=usern,OU=...' -s base tokenGroups|head -20 dn: CN=usern,OU=... tokenGroups:: AQIAAAAAAAUgAAAAIQIAAA==
$ ldapsearch -h $DC -b $B -s sub objectSid=<ldap escaped tokenGroup val> dn: CN=Users,CN=Builtin,DC=ic,DC=ac,DC=uk cn: Users
It strikes me that reading this (and translating SIDs to CN) might be a useful feature to have in the LDAP module - the SIDs are basically static so can be cached internally, so in the long run it's quick, and handles the nesting which is nice.
It's plain LDAP, so no weird #defines needed.
If people want I'll knock together a patch (as I have working local code from another application that I wrote that reads it). The idea would be an ldap config item like this:
This sounds useful. I think you probably only need group.use_ad_tokengroup to enable/disable it. As this is another way of resolving a user to their group memberships (the objects are the same), you can re-use group.name_attribute. For consistency, maybe organise it the same way as the current lookups with dynamic and cacheable functions? Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
participants (3)
-
Arran Cudbard-Bell -
Garber, Neal -
Phil Mayers