Access Servers - Groups Scope Remote

[Douglas Fischer]

I have a LDAP(Active directory) and Radius(NPS) configured on my OPNsense 17.1.10-amd64.

On System -> Access -> Tester i receive an "authenticated sucessfully".
But I don't receive any groups on any test, Radius and LDAP.

- I have a group on AD and I'm on it
- I have a group configured on OPNSense configured with the exactly same name of ActiveDirectory Group.
- On Radius(NPS) I added the "Class" attribute to be delivered on the police matching with my group, and the string is exactly the same of the group name on OPNSense.
- I Tried tests using "administrator" of my domain on DN of LDAP server configuration...

Looks like OPN System is ignoring the groups that Radius and LDAP are telling him.
The behavior is the same 

For the records:
I'm doing some efforts to migrate from PFSense to OPNSense on several sites.
So I have two VMs to do the comparison "PF vs OPN", and any thing that is needed is equivalent to both servers.

And the Groups are working as expected on PFsense.

Any Suggestions?

[Douglas Fischer]

TestAuthentication_OPNSense-noGroup
https://imagebin.ca/v/3UAhOMFK9pJP


TestAuthentication_PFSense-WithGroup
https://imagebin.ca/v/3UAhsKZHAdPD

[AdSchellevis]

Hi Douglas,

We don't query the ldap for groups during our authentication process, to avoid cluttering of the authentication/authorisation code.
At the moment you need to assign the groups manually in OPNsense (or use extended queries if you just want to provide access to a certain ldap group).

To implement ldap groups, there should be a periodic synchronisation to link the groups, so the auth system can use it's own administration again. It's not planned at the moment, maybe later.

Best regards,

Ad

[Douglas Fischer]

I completely understand the concern about cluttering!
My environment has more than 20K users and 7K groups...

I don't know the right place to do a suggestion, but here goes:

If the Auth-Feature would do queries of groups on any request of resources of OPNSense, it could create a cluttering no AD servers.
But if it does a second query for each specific resource, only if applicable(depending on resource), It wouldn't overload the resources.