Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

On first auth get error (LDAP search failed: Operations error LdapErr: DSID-0C090748, comment) #59

Open
dronmaxman opened this issue Oct 18, 2016 · 1 comment

Comments

@dronmaxman
Copy link

dronmaxman commented Oct 18, 2016

Use deb packages on debian 8.5

openvpn                        2.3.4-5+deb8u1  
openvpn-auth-ldap              2.0.3-6.1

OpenVPN server.conf

local XX.XX.XX.XX
plugin /usr/lib/openvpn/openvpn-auth-ldap.so "/etc/openvpn/auth-ldap.conf"
username-as-common-name
port 1194
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh2048.pem
cipher AES-128-CBC
#tls-auth keys/ta.key 0
server 10.90.1.0 255.255.255.0
ifconfig 10.90.1.1 255.255.255.0
push "route 172.30.0.0 255.255.0.0"
push "route 172.40.0.0 255.255.0.0"
#keepalive 10 120
client-cert-not-required
max-clients 20
client-to-client
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
   ping 10
   ping-restart 15
   push "ping 10"
   push "ping-restart 20"
verb 4
mute 20
daemon
mode server
#tls-server
comp-lzo no

auth-ldap.conf

<LDAP>
        # LDAP server URL
        URL             ldap://domain.test.com

         BindDN                 CN=VPN-group,OU=S,OU=Ac,OU=Sys,DC=domain,DC=test,DC=com
         Password       passwd
        Timeout         15
        TLSEnable       no
        FollowReferrals false

        #TLSCACertFile  /usr/local/etc/ssl/ca.pem
        # TLS CA Certificate Directory
        TLSCACertDir    /etc/ssl/certs
        # Client Certificate and key
        # If TLS client authentication is required
        TLSCertFile     /usr/local/etc/ssl/client-cert.pem
        TLSKeyFile      /usr/local/etc/ssl/client-key.pem

        # Cipher Suite
        # The defaults are usually fine here
        # TLSCipherSuite        ALL:!ADH:@STRENGTH
</LDAP>
<Authorization>
        BaseDN          "dc=domain,dc=test,dc=com"

        # User Search Filter
        SearchFilter    "(&(objectCategory=person)(sAMAccountName=%u)(memberof=CN=VPN-group,OU=NET,OU=SD,OU=Sys,DC=domain,DC=test,DC=com))"
        # Require Group Membership
        RequireGroup    false
        # Add non-group members to a PF table (disabled)
        #PFTable        ips_vpn_users


</Authorization>

Problem:

After restart openvpn-server (sudo service openvpn restart) and tried to connect to server get error.
Client side:

AUTH: Received control message: AUTH_FAILED

Server side:

Tue Oct 18 23:02:01 2016 us=904260 212.90.62.145:65418 Local Options hash (VER=V4): '691e95c7'
Tue Oct 18 23:02:01 2016 us=904615 212.90.62.145:65418 Expected Remote Options hash (VER=V4): '66096c33'
Tue Oct 18 23:02:01 2016 us=904695 212.90.62.145:65418 TLS: Initial packet from [AF_INET]212.90.62.145:65418, sid=b678887a 0b3ec133
LDAP search failed: Operations error (000004DC: LdapErr: DSID-0C090748, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580)
LDAP user "dronmax" was not found.
Tue Oct 18 23:02:02 2016 us=2971 212.90.62.145:65418 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
Tue Oct 18 23:02:02 2016 us=3328 212.90.62.145:65418 PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-ldap.so
Tue Oct 18 23:02:02 2016 us=3800 212.90.62.145:65418 TLS Auth Error: Auth Username/Password verification failed for peer

All next authentication connection is success. Only first authentication has problem.

@a7lan
Copy link

a7lan commented Oct 8, 2022

Any news? A have this problem too. The bug has been open for 6 years ...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants