OPNsense
  • Home
  • Help
  • Search
  • Login
  • Register

  • OPNsense Forum »
  • Archive »
  • 15.7 Legacy Series »
  • [SOLVED] Proxy LDAP auth issue
« previous next »
  • Print
Pages: [1] 2

Author Topic: [SOLVED] Proxy LDAP auth issue  (Read 11021 times)

cdburgess75

  • Newbie
  • *
  • Posts: 46
  • Karma: 8
    • View Profile
[SOLVED] Proxy LDAP auth issue
« on: November 30, 2015, 06:26:44 am »
I am having an issue getting squid to accept the credentials for AD users.  All my diagnostics are good with built in tools for opnsense.  LDAP connection is working fine.  But when I try to login I get an: squid: user 'dave' could not authenticate in the logs.  I see this in auth.inc and was wondering if maybe it is still work in progress:
---
function authenticate_user($username, $password, $authcfg = NULL) {

   if (empty($authcfg)) {
      $authName = 'Local Database';
   } else {
      $authName = $authcfg['name'];
      if ($authcfg['type'] == 'local') {
         // avoid gettext type issues on Local Database, authenticator should always be named "Local Database"
         $authName = 'Local Database';
      } elseif ($authcfg['type'] == 'ldap') {
         // temporary fix, ldap handler doesn't do this init yet.
         ldap_setup_caenv($authcfg);
      }
« Last Edit: December 25, 2015, 02:55:07 pm by franco »
Logged

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13957
  • Karma: 1210
    • View Profile
Re: Proxy LDAP auth issue
« Reply #1 on: November 30, 2015, 07:35:24 am »
The code is not a work in progress. When did you start working with squid/AD auth? 15.7.18 switched the authentication backend, but maybe there is a regression in conjunction with squid. Will report back soon. :)
Logged

cdburgess75

  • Newbie
  • *
  • Posts: 46
  • Karma: 8
    • View Profile
Re: Proxy LDAP auth issue
« Reply #2 on: November 30, 2015, 10:13:24 pm »
Awesome job by the way.  I love the firewall.  To answer you, I started trying to get this working (LDAP proxy auth) a few days ago.  I was able to import all the users and see all the container.  Ding checks out fine.  This appliance was upgraded from 15.7.1 to 15.7.20 prior to the attempt.  So we have the latest version now.  If there is anything I can do to help ket me know.   
Logged

AdSchellevis

  • Administrator
  • Hero Member
  • *****
  • Posts: 855
  • Karma: 166
    • View Profile
Re: Proxy LDAP auth issue
« Reply #3 on: November 30, 2015, 10:30:38 pm »
The proxy auth plugin only functions for the primary authentication option at the moment and tries to locate a local user role "user-proxy-auth" before doing the actual authentication (in src/etc/inc/squid.auth-user.php).

I think we should revise this a bit, it's probably better to make the authentication option selectable in the user interface and only use the local role for users in the local database.

We're using a similar option for the new captive portal already, let me try to squeeze this feature in here as well (somewhere this week).

Logged

AdSchellevis

  • Administrator
  • Hero Member
  • *****
  • Posts: 855
  • Karma: 166
    • View Profile
Re: Proxy LDAP auth issue
« Reply #4 on: December 01, 2015, 08:18:00 pm »
I just added our new pluggable authentication system to the squid auth plugin and changed the user interface to support the selection.
When installed, you can add one or multiple authentication servers to be used with the proxy.

This commit contains the new feature: https://github.com/opnsense/core/commit/58ab1e61e3a50c8e3ed7033c69d1d20d9754aa96


The new feature is backwards compatible, so I think we will add it to the next release.
Logged

cdburgess75

  • Newbie
  • *
  • Posts: 46
  • Karma: 8
    • View Profile
Re: Proxy LDAP auth issue
« Reply #5 on: December 03, 2015, 02:09:48 pm »
I will test this out tonight and reply. Thank you very much.
Logged

cdburgess75

  • Newbie
  • *
  • Posts: 46
  • Karma: 8
    • View Profile
Re: Proxy LDAP auth issue
« Reply #6 on: December 04, 2015, 02:43:14 am »
I edit the 3 files and restarted squid,  but did not have good results.  The problem I am having now is complete opposite.  Before I could not authenticate,  now the authentication pop up in the browser is not launching (as if maybe set to none or no authentication).  But I have both local database and the LDAP connection selected in the new gui interface.  Processes are running fine, my http request are logged fine as well.  However,  the syslog shows no attempt at authentication like before.  Hmmm :)
Logged

AdSchellevis

  • Administrator
  • Hero Member
  • *****
  • Posts: 855
  • Karma: 166
    • View Profile
Re: Proxy LDAP auth issue
« Reply #7 on: December 04, 2015, 09:01:45 am »
sorry about that, forgot to change the template to accept the different setting...
This commit should fix the issue: https://github.com/opnsense/core/commit/e34dd6a60b291627e8cabc090924d5f2ce37b6b7


It worked when nothing was changed (only local), but as soon as you started using the feature it didn't match any more ;)
Logged

franco

  • Administrator
  • Hero Member
  • *****
  • Posts: 13957
  • Karma: 1210
    • View Profile
Re: Proxy LDAP auth issue
« Reply #8 on: December 04, 2015, 05:52:38 pm »
Both changes are on opnsense-devel 15.7.99_1623 (15.7.21 development) so they can be easily tested.

https://forum.opnsense.org/index.php?topic=917.0
Logged

cdburgess75

  • Newbie
  • *
  • Posts: 46
  • Karma: 8
    • View Profile
Re: Proxy LDAP auth issue
« Reply #9 on: December 07, 2015, 04:06:03 pm »
thank you so much.  I will check this out in 2 days and report back.
Logged

cdburgess75

  • Newbie
  • *
  • Posts: 46
  • Karma: 8
    • View Profile
Re: Proxy LDAP auth issue
« Reply #10 on: December 15, 2015, 01:02:18 am »
I went ahead and started with a fresh copy of OPNsense 15.7.22-amd64.  I configured LDAP successfully and diag tested out fine.  All the same steps as before.  Enabling squid, etc.  However,  I cannot get a popup asking for me to authenticate.  All traffic is passing through squid according to the logs.  Also,  It allows normal traffic without the proxy.  Not sure whats going on,  is there anything I can help with?
Logged

AdSchellevis

  • Administrator
  • Hero Member
  • *****
  • Posts: 855
  • Karma: 166
    • View Profile
Re: Proxy LDAP auth issue
« Reply #11 on: December 15, 2015, 08:34:24 am »
Can you check if the auth application is inserted into your config?

in /usr/local/etc/squid/squid.conf

there should be a blob of data like this:
Code: [Select]
auth_param basic program /usr/local/etc/inc/squid.auth-user.php
auth_param basic realm OPNsense proxy authentication
auth_param basic credentialsttl 2 hours
auth_param basic children 5
# ACL - Local Authorized Users - local_auth
acl local_auth proxy_auth REQUIRED

If it is, do you have any access control lists defined.
Logged

cdburgess75

  • Newbie
  • *
  • Posts: 46
  • Karma: 8
    • View Profile
Re: Proxy LDAP auth issue
« Reply #12 on: December 16, 2015, 10:35:04 pm »
Yes,  I checked: the auth app is inserted like that word for word.  Also,  I have not defined any ACL's yet.
Logged

AdSchellevis

  • Administrator
  • Hero Member
  • *****
  • Posts: 855
  • Karma: 166
    • View Profile
Re: Proxy LDAP auth issue
« Reply #13 on: December 17, 2015, 08:36:57 am »
Oops, missed a line in my previous commit:
https://github.com/opnsense/core/commit/e96aa187c869b5d756d5a659f63734fee4dc7799

When authentication other then local is selected, it didn't link the acl. sorry about that.
Logged

cdburgess75

  • Newbie
  • *
  • Posts: 46
  • Karma: 8
    • View Profile
Re: Proxy LDAP auth issue
« Reply #14 on: December 18, 2015, 11:08:41 pm »
ok,  I tried it again.  We are still not able to auth to the confirmed ldap connection.  We see in the logs that it is trying:
Dec 18 23:04:21   squid: user 'dave' could not authenticate.
Dec 18 23:04:21   squid: user 'dave' could not authenticate.
Dec 18 23:04:11   squid: user 'test' could not authenticate.
Dec 18 23:04:11   squid: user 'test' could not authenticate.

It seems to only work on the local db.  The AD LDAP connection is working and allows us to add users.  I also gave the permission "proxy login" to a group and added them to that in the users section.
Logged

  • Print
Pages: [1] 2
« previous next »
  • OPNsense Forum »
  • Archive »
  • 15.7 Legacy Series »
  • [SOLVED] Proxy LDAP auth issue
 

OPNsense is an OSS project © Deciso B.V. 2015 - 2023 All rights reserved
  • SMF 2.0.19 | SMF © 2021, Simple Machines
    Privacy Policy
    | XHTML | RSS | WAP2