Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1die9R-0007aA-F6 for pgsql-admin@arkaria.postgresql.org; Fri, 18 Aug 2017 10:05:13 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1die9Q-0003D7-Bt for pgsql-admin@arkaria.postgresql.org; Fri, 18 Aug 2017 10:05:12 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1die9N-00038q-OB for pgsql-admin@postgresql.org; Fri, 18 Aug 2017 10:05:09 +0000 Received: from host3.dynacom.ondsl.gr ([62.103.35.211] helo=smadev.internal.net) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1die9F-0001uk-E3 for pgsql-admin@postgresql.org; Fri, 18 Aug 2017 10:05:09 +0000 Received: from smadev.internal.net (smadev [10.9.200.131]) by smadev.internal.net (8.15.2/8.15.2) with ESMTP id v7IA4wsZ057161 for ; Fri, 18 Aug 2017 13:04:59 +0300 (EEST) (envelope-from achill@matrix.gatewaynet.com) Subject: Re: LDAP authentication fails with more than one entry returned To: pgsql-admin@postgresql.org References: <3d5bf42743be4b789f4e70010a9259d8@HE101867.emea1.cds.t-internal.com> <6ff6de141b5c42c8ac22863b9b308178@HE101867.emea1.cds.t-internal.com> From: Achilleas Mantzios Message-ID: <33c2a453-840d-10dc-2940-a6693f22414c@matrix.gatewaynet.com> Date: Fri, 18 Aug 2017 13:04:58 +0300 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:52.0) Gecko/20100101 Thunderbird/52.0 MIME-Version: 1.0 In-Reply-To: <6ff6de141b5c42c8ac22863b9b308178@HE101867.emea1.cds.t-internal.com> Content-Type: multipart/alternative; boundary="------------BA7D18C4578FAEE9A3107069" Content-Language: en-US List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org This is a multi-part message in MIME format. --------------BA7D18C4578FAEE9A3107069 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit On 18/08/2017 12:19, Michael.Haertel@t-systems.com wrote: > > I found a solution for my use case although it is off-topic: > > I create the LDAP entries myself and I thought that it is common practice to create a copy of a user and paste it into a different sub-tree to grant additional privileges to the user. I now found > that the LDAP objectClass “groupOfNames” can be used for that purpose. It contains an attribute “member” which is supposed to hold an entire DN as a reference to the user. > This is the standard use case. > This way the uid attribute stays unique. > > *Von:*pgsql-admin-owner@postgresql.org [mailto:pgsql-admin-owner@postgresql.org] *Im Auftrag von *Achilleas Mantzios > *Gesendet:* Freitag, 18. August 2017 08:41 > *An:* pgsql-admin@postgresql.org > *Betreff:* Re: [ADMIN] LDAP authentication fails with more than one entry returned > > On 17/08/2017 18:07, Michael.Haertel@t-systems.com wrote: > > As far as I understand you need to give the fully qualified DN to a user if you do simple binding. But in the pg_hba.conf I can only define a prefix that doesn’t change: “uid=”. > > But because all the users come from different trees the suffix depends on the sub-tree where the user has been added to. This part of the DN can’t be configured statically in the pg_hba.conf. > > Look at the DN for my example users in my play-instance of openLDAP: > > uid=mhaertel,cn=ftth,ou=Teams,dc=organization_gismobile,dc=ldap_db1,dc=mydomain,dc=com > > The part “cn=ftth,ou=Teams,dc=organization_gismobile” only is valid for a small subset of users and therefore I can’t define a full DN for the binding. > > > Alright I see. Which raises the following question : When two entries with the same uid are found in different trees, then what are the semantics behind? Are those two users represented by those DNs > supposed to be the same of different users? > IMHO its not good practice to have the same uid representing different physical persons. If the physical users are different then you may simply change their uids to be unique across the whole tree, > regardless of subtree. > However, if the same uid is found in multiple subtrees and is indeed the same user then maybe some arrangement must be done in the LDAP server to somehow present one view of all users under a common > dedicated base. In which case you'll prefer the simple bind mode again. > > > Regards, > > Michael > > *Von:*pgsql-admin-owner@postgresql.org [mailto:pgsql-admin-owner@postgresql.org] *Im Auftrag von *Achilleas Mantzios > *Gesendet:* Donnerstag, 17. August 2017 16:40 > *An:* pgsql-admin@postgresql.org > *Betreff:* Re: [ADMIN] LDAP authentication failes with more than one entry returned > > On 17/08/2017 16:58, Michael.Haertel@t-systems.com wrote: > > Hello list, > > I configured postgreSQL to only allow users that are administered in LDAP to connect to one particular database on my PostgreSQL host. This works fine as long as only one entry is returned > for the combination of “ldapbasedn” and “ldapsearchattribute”. > > > Why don't you go the simple bind mode route? Just specify ldapprefix, ldapsuffix to construct your bind DN, this should by definition be unique. > > > > I currently match the LDAP attribute UID against the login name. Problem is that the users exist several times in the specified (sub-) directory tree. Everything works if the user only > exists once within the specified “ldapbasedn”. > > How to deal with that problem? > > I think it is common practice to have several sub-trees, one per organizational unit for example. Within that OU there are several sub-trees that define privileges for SAMBA shares, database > connections or other purposes. Because I need to search for the users across several OUs, I can’t give the path to only one sub-tree. > > I am currently on windows so I can’t test the ldapurl feature. > > Would it be possible to use the ldapurl directive to allow an ldapsearch across different 1^st level trees but only look for users within one particular sub-tree in each of the 1^st level trees? > > Thank you very much for your comments, > > Michael Härtel > > -- > > Achilleas Mantzios > > IT DEV Lead > > IT DEPT > > Dynacom Tankers Mgmt > > -- > Achilleas Mantzios > IT DEV Lead > IT DEPT > Dynacom Tankers Mgmt -- Achilleas Mantzios IT DEV Lead IT DEPT Dynacom Tankers Mgmt --------------BA7D18C4578FAEE9A3107069 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
On 18/08/2017 12:19, Michael.Haertel@t-systems.com wrote:

I found a solution for my use case although it is off-topic:

 

I create the LDAP entries myself and I thought that it is common practice to create a copy of a user and paste it into a different sub-tree to grant additional privileges to the user. I now found that the LDAP objectClass “groupOfNames” can be used for that purpose. It contains an attribute “member” which is supposed to hold an entire DN as a reference to the user.


This is the standard use case.

 

This way the uid attribute stays unique.

 

 

Von: pgsql-admin-owner@postgresql.org [mailto:pgsql-admin-owner@postgresql.org] Im Auftrag von Achilleas Mantzios
Gesendet: Freitag, 18. August 2017 08:41
An: pgsql-admin@postgresql.org
Betreff: Re: [ADMIN] LDAP authentication fails with more than one entry returned

 

On 17/08/2017 18:07, Michael.Haertel@t-systems.com wrote:

As far as I understand you need to give the fully qualified DN to a user if you do simple binding. But in the pg_hba.conf I can only define a prefix that doesn’t change: “uid=”.

 

But because all the users come from different trees the suffix depends on the sub-tree where the user has been added to. This part of the DN can’t be configured statically in the pg_hba.conf.

 

Look at the DN for my example users in my play-instance of openLDAP:

 

uid=mhaertel,cn=ftth,ou=Teams,dc=organization_gismobile,dc=ldap_db1,dc=mydomain,dc=com

 

The part “cn=ftth,ou=Teams,dc=organization_gismobile” only is valid for a small subset of users and therefore I can’t define a full DN for the binding.


Alright I see. Which raises the following question : When two entries with the same uid are found in different trees, then what are the semantics behind? Are those two users represented by those DNs supposed to be the same of different users?
IMHO its not good practice to have the same uid representing different physical persons. If the physical users are different then you may simply change their uids to be unique across the whole tree, regardless of subtree.
However, if the same uid is found in multiple subtrees and is indeed the same user then maybe some arrangement must be done in the LDAP server to somehow present one view of all users under a common dedicated base. In which case you'll prefer the simple bind mode again.


 

Regards,

 

Michael

 

Von: pgsql-admin-owner@postgresql.org [mailto:pgsql-admin-owner@postgresql.org] Im Auftrag von Achilleas Mantzios
Gesendet: Donnerstag, 17. August 2017 16:40
An: pgsql-admin@postgresql.org
Betreff: Re: [ADMIN] LDAP authentication failes with more than one entry returned

 

On 17/08/2017 16:58, Michael.Haertel@t-systems.com wrote:

Hello list,

 

I configured postgreSQL to only allow users that are administered in LDAP to connect to one particular database on my PostgreSQL host. This works fine as long as only one entry is returned for the combination of “ldapbasedn” and “ldapsearchattribute”.


Why don't you go the simple bind mode route? Just specify ldapprefix, ldapsuffix to construct your bind DN, this should by definition be unique.



 

I currently match the LDAP attribute UID against the login name. Problem is that the users exist several times in the specified (sub-) directory tree. Everything works if the user only exists once within the specified “ldapbasedn”.

 

How to deal with that problem?

 

I think it is common practice to have several sub-trees, one per organizational unit for example. Within that OU there are several sub-trees that define privileges for SAMBA shares, database connections or other purposes. Because I need to search for the users across several OUs, I can’t give the path to only one sub-tree.

 

I am currently on windows so I can’t test the ldapurl feature.

 

Would it be possible to use the ldapurl directive to allow an ldapsearch across different 1st level trees but only look for users within one particular sub-tree in each of the 1st level trees?

 

Thank you very much for your comments,

 

Michael Härtel

 

-- 
Achilleas Mantzios
IT DEV Lead
IT DEPT
Dynacom Tankers Mgmt

 

-- 
Achilleas Mantzios
IT DEV Lead
IT DEPT
Dynacom Tankers Mgmt


-- 
Achilleas Mantzios
IT DEV Lead
IT DEPT
Dynacom Tankers Mgmt
--------------BA7D18C4578FAEE9A3107069--