Aleksey
Hello, I’m trying to configure LDAP authorization in a web application on django (AWX if it says something to someone).
Authorization passes, but assignment to groups based on LDAP groups does not work.
The following is specified in the "LDAP Organization Map" authorization settings:
{
"Default": {
"remove_admins": false,
"admins": [
"CN=MIQ_admins,OU=MIQ,DC=STS,DC=RUS,DC=CONTOSO",
"OU=MIQ,DC=BANK,DC=RUS,DC=CONTOSO"
],
"remove_users": false,
"users": false
}
}
When authorizing an LDAP user sn.ivanov, the following is written in the logs:
2020-06-30 15:22:13,581 DEBUG django_auth_ldap search_s('OU=MIQ,DC=BANK,DC=RUS,DC=CONTOSO', 2, '(sAMAccountName=%(user)s)') returned 1 objects: cn=ivanov sergey,ou=miq,dc=bank,dc=rus,dc=contoso
2020-06-30 15:22:13,585 DEBUG django_auth_ldap Populating Django user sn.ivanov
2020-06-30 15:22:13,587 ERROR django_auth_ldap search_s('OU=MIQ,DC=STS,DC=RUS,DC=CONTOSO', 2, '(&(objectClass=group)(member=cn=ivanov sergey,ou=miq,dc=bank,dc=rus,dc=contoso))') raised REFERRAL({'desc': 'Referral', 'info': 'Referral:\nldap://sts.rus.contoso/OU=MIQ,DC=STS,DC=RUS,DC=CONTOSO'},)
2020-06-30 15:22:13,587 DEBUG django_auth_ldap search_s('OU=MIQ,DC=STS,DC=RUS,DC=CONTOSO', 2, '(&(objectClass=group)(member=cn=ivanov sergey,ou=miq,dc=bank,dc=rus,dc=contoso))') returned 0 objects:
2020-06-30 15:22:13,595 DEBUG django_auth_ldap cn=ivanov sergey,ou=miq,dc=bank,dc=rus,dc=contoso is not a member of cn=miq_admins,ou=miq,dc=sts,dc=rus,dc=contoso
2020-06-30 15:22:13,595 DEBUG django_auth_ldap cn=ivanov sergey,ou=miq,dc=bank,dc=rus,dc=contoso is not a member of ou=miq,dc=bank,dc=rus,dc=contoso
2020-06-30 15:22:13,634 INFO awx.api.generics User sn.ivanov logged in from 10.31.252.123
The user sn.ivanov@BANK.RUS.CONTOSO is precisely a member of the group CN=MIQ_admins,OU=MIQ,DC=STS,DC=RUS,DC=CONTOSO
May be you can help me with it? Or it is wrong chat for that problem?