From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id BB071C1AA6 for ; Wed, 17 Jan 2024 12:06:06 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 9F1F28DB2 for ; Wed, 17 Jan 2024 12:05:36 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 17 Jan 2024 12:05:35 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 5B1C248611 for ; Wed, 17 Jan 2024 12:05:35 +0100 (CET) Message-ID: <2b6917cd-232f-4528-9e6b-6fb319822c90@proxmox.com> Date: Wed, 17 Jan 2024 12:05:34 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: de-AT, en-US To: Proxmox Backup Server development discussion , Christoph Heiss References: <20240112161614.1012311-1-c.heiss@proxmox.com> From: Lukas Wagner In-Reply-To: <20240112161614.1012311-1-c.heiss@proxmox.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.004 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: Re: [pbs-devel] [PATCH proxmox/proxmox-backup/pwt v3 00/13] add Active Directory realm support X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Jan 2024 11:06:06 -0000 On 1/12/24 17:15, Christoph Heiss wrote: > This series adds Active Directory realm support to PBS, much like it > already exists in PVE. The logic matches it as closely as possible. > > Patches #1 through #6 are purely preparatory. > > The API, authenticator and realm sync job implementations are partly > simply copied from LDAP, replacing structs and changing some things as > needed. The realm sync job simply reuses the existing LDAP > implementation for the most part, other than setting up some things > differently. > > As for the UI, the existing panel for LDAP realms was generic enough > such that it only needed a few conditionals as what input boxes to show. > > One thing to note is that - unlike PVE - you don't have to specify a > domain name when creating an AD realm. This is due to `proxmox-ldap` > already figuring out the correct, full DN of bind and login users > itself. That is the only use of the domain name in PVE anyway, thus it > is not present here. > > The base DN is automatically determined from the `defaultNamingContext` > attribute of the root DSE object. It can be set manually in the config > if the need should arise. So that should be treated more like an > implementation detail. > > Testing > ------- > I have tested this series using: > > * slapd 2.5.13+dfsg-5 as LDAP server to ensure no regressions > * Samba 4.18.5 as an Linux-based LDAP and AD server, with and without > (START)TLS. > * AD on Windows Server 2022 to make sure that works as well > > For slapd and MS AD, I tested both anonymous binds and authenticated > binds, with Samba only authenticated binds (since there seems to way to > turn on anonymous binds in Samba, at least that I could find ..) as well > as dry-running and actual syncing of users. Further, then also logging > into PBS with a sync'd user. > Gave these changes another (quick) test, testing against AD on Windows Server 2022. Also tested regular LDAP realms to make sure that these continue to work as expected. Everything looks good, as far as I can tell: Tested-by: Lukas Wagner Reviewed-by: Lukas Wagner -- - Lukas