Help me setup openldap sync

[duke8804]

Can someone please point me to an idiots walkthrough for configuring openldap and adding it to proxmox.

I have found a bunch of videos and stuff for Active Directory, but i dont want to use windows anymore.

I have the openldap setup and can use ldapsearch to connect to and get info.

It says i have successfully synced on proxmox, but users never appear.

Im sure i am not telling proxmox the correct place to look, but i have no idea where to go from here.

Hoping an idiots guide i can replicate and figure out what im doing wrong.

 

[VictorSTS]

I have found a bunch of videos and stuff for Active Directory, but i dont want to use windows anymore.

Just a side note: you don't need Windows to use Active Directory. You can use Samba and deploy a DC to use it to manage your users. You can use it from cli or try packaged solutions like Univention or Zentyal.

 

[mariol]

You've probably already seen the documentary about it... Please post your current configuration for the LDAP connection.

cat /etc/pve/domains.cfg

Have you already tried to manually create an LDAP user that should work? Apart from the sync, this is a good test.

@VictorSTS yes thanks, Univention is really nice, and OpenSource

 

[duke8804]

below is my domains.cfg

good news, i dont know what i did, but the groups and users are now syncing, BUUUUUT the group memberships are not syncing.

I have looked at Univention and Zentyal. Zentyal with some history seems sketch to me. Just my feeling could be totally wrong.

But i like just having a docker running the openldap. small and simple. Plus i have multiple user domains i need to manage and dont want multiple servers for each. would prefer multiple docker containers for each.

Also i know i should not use admin for the bind. That will be changed once i figure this out.

root@pve:~# cat /etc/pve/domains.cfg
pam: pam
        comment Linux PAM standard authentication

pve: pve
        comment Proxmox VE authentication server

ldap: unitedwayefc.org
        base_dn dc=unitedwayefc,dc=org
        server1 ldap.unitedwayefc.org
        user_attr uid
        bind_dn cn=admin,dc=unitedwayefc,dc=org
        default 1
        group_classes posixGroup
        sync-defaults-options remove-vanished=acl;entry;properties,scope=both
        user_classes inetOrgPerson

 

[mariol]

I have tried this with an OpenLdap (Univention). After the sync, the group membership was immediately under "Datacenter -> Permissions -> Grpous" visible. Group_classes and user_classes did not have to be filled out. It also works here with the classes. They are assigned the same here in LDAP. Here is my config:

ldap: proxmox.lan
        base_dn dc=proxmox,dc=lan
        server1 dc3.proxmox.lan
        user_attr uid
        bind_dn uid=proxmox-bind-user,cn=users,dc=proxmox,dc=lan
        default 1
        group_name_attr cn
        mode ldap+starttls
        port 7389
        sync-defaults-options scope=both
        sync_attributes email=mail

For bind_dn you write “cn=”, for user_attr” you use ‘uid’, do you have two different schematas running for users? Maybe you have to pass the correct user attribute too...

user_attr ???