LDAP: Updated service acccounts on additional users , the login authenication fails for user and service account

[david1412]

Hi Team

I got a problem with LDAP configuration at additional users.
We have created a service account and when i add service accounts to the additional users, it work for me.
could you please guide me. Thanks

## The base dn for every LDAP query.
      base_dn: OU=Mail,OU=DE,DC=prd,DC=**,DC=com  
      additional_users_dn: OU=Users_test,OU=ServiceAccounts (This is the new user)
      username_attribute: sAMAccountName
      users_filter: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
      display_name_attribute: sAMAccountName
      additional_groups_dn: OU=managed,OU=Groups
      group_name_attribute: cn
      mail_attribute: mail
      user: CN=admin,OU=ServiceAccounts,OU=Mail,OU=DE,DC=prd,DC=***,DC=com
    ##

AD group : prometheus-reader
test user > prd.domain/DE/mail/Users_test
service account > prd.domain/DE/mail/ServiceAccounts

Error: The test user & service account user cannot login with this LDAP config.
Without OU=ServiceAccounts, the test user can login. it works.

@james-d-elliott Could you please help with my query.

[james-d-elliott]

Baesd on your config, only users in OU=Users_test,OU=ServiceAccounts,OU=Mail,OU=DE,DC=prd,DC=**,DC=com will be found. The additional_users_dn is used to filter users by setting the search base.

In your example you should set additional_users_dn as either blank or OU=Users_test

[david1412]

@james-d-elliott Thanks for your reply.

I removed below parameter

additional_users_dn 

- Users_test > they can login
- OU=ServiceAccounts > they cannot login.

OU=Service Accounts  ( loglevel = trace)

time="2022-08-17T21:04:34Z" level=trace msg="Computed user filter is (&(|(sAMAccountName=prd)(mail=prd))(objectCategory=person)(objectClass=user))"
time="2022-08-17T21:04:34Z" level=debug msg="Mark 1FA authentication attempt made by user 'prd'" method=POST path=/api/firstfactor remote_ip=172.20.0.1
time="2022-08-17T21:04:34Z" level=error msg="Unsuccessful 1FA authentication attempt by user 'prd': user not found" method=POST path=/api/firstfactor remote_ip=172.20.0.1 stack="github.com/authelia/authelia/v4/internal/handlers/response.go:177           markAuthenticationAttempt\ngithub.com/authelia/authelia/v4/internal/handlers/handler_firstfactor.go:52 FirstFactorPost.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/authelia_context.go:52 AutheliaMiddleware.func1.1\ngithub.com/fasthttp/[email protected]/router.go:414                             (*Router).Handler\ngithub.com/authelia/authelia/v4/internal/middlewares/log_request.go:14      LogRequestMiddleware.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/strip_path.go:21       StripPathMiddleware.func1\ngithub.com/valyala/[email protected]/server.go:2298                          (*Server).serveConn\ngithub.com/valyala/[email protected]/workerpool.go:223                       (*workerPool).workerFunc\ngithub.com/valyala/[email protected]/workerpool.go:195                       (*workerPool).getCh.func1\nruntime/asm_amd64.s:1581                                                    goexit"
time="2022-08-17T21:04:34Z" level=trace msg="Timing Attack Delay successful: false, exec duration: 498, avg execution duration: 976, random delay ms: 81, total delay ms: 1057, actual delay ms: 559" method=POST path=/api/firstfactor remote_ip=172.20.0.1
time="2022-08-17T21:04:35Z" level=trace msg="Replied (status=401)" method=POST path=/api/firstfactor remote_ip=172.20.0.1


is the user_filter which i used is not filtering the service account OU.
Correct me if there is any mistake in the userfilter. Thanks