Re: [PVE-User] PBS3 - can't add LDAP realm, same settings work fine with PVE7

[Stefan Sterz <s.sterz@proxmox.com>]

Sorry just noticed I accidentally replied off-list, so here it is again
on-list:

Yeah, this is a known problem in PBS 3.0 that I am currently trying to
solve [1]. As a workaround you should be able to edit the file
`/etc/proxmox-backup/domains.cfg` directly and add your LDAP
configuration there. Sorry for the inconvenience.

Something like this should work:

ldap: ldap
	base-dn dc=economia,dc=cz
	bind-dn CN=<redacted>,CN=Users,DC=economia,DC=cz
	mode ldap
	server1 <server>
	server2 <fallback>
	user-attr sAMAccountName

You also need to add your bind password unter
`/etc/proxmox-backup/ldap_passwords.json` like so:

{
  "ldap": "<password>"
}

Obviously you need to replace the values between the "<>" brackets with
your actually configuration.

[1]: https://forum.proxmox.com/threads/pbs-ldap-issue.130199/#post-570923

On 12.07.23 15:53, Jan Vlach wrote:
> Hello,
> I’m preparing upgrade of our PVE7.4 + PBS2.4 infrastructure, I’ve started with PBS that boots in UEFI mode to verify that I have a re-bootable machine as per notes in upgrade guide.
> 
> I have LDAP authentication working successfully in PVE, but I can’t get it working in the PBS3
> I’m trying to copy the settings from PVE, I’m missing Group classes and Group filter in PBS and I get weird error message on trying to add:
> 
> Could not search LDAP realm, base_dn could be incorrect: LDAP operation result rc=4 (sizeLimitExceeded), dn: “”, text: “”: rc=4 (sizeLimitExceeded), dn: “”, text: “”
> 
> bind user and server are redacted, there is no fallback server, password is managed by 1Password and is same. I can successfully lookup via ldapsearch from cli (no firewall). There’s no encryption.
> 
> What am I doing wrong? 
> Thank you,
> JV
> 
> Detailed settings follow:
> 
> === PVE7.4-15 settings ===
> 
> TAB: GENERAL TAB:
> Realm: ldap
> Base Domain Name: dc=economia,dc=cz
> User Attribute Name: sAMAccountName
> Default: True
> Server: <redacted>
> Fallback Server: <empty>
> Port: Default
> SSL: False
> Verify Certificate: False, greyed out
> Require TFA: none
> Comment: LDAP
> 
> TAB: SYNC OPTIONS:
> Bind User: CN=<redacted>,CN=Users,DC=economia,DC=cz
> Bind Password: Unchanged, greyed out (I know this)
> E-mail attribute: mail
> Groupname attr.: sAMAccountName
> Default Sync Options
> Scope: Users and Groups
> 
> User classes: user
> Group classes: group
> User Filter: (MemberOf=CN=IT_OPS,OU=External,OU=Groups,DC=economia,DC=cz)
> Group Filter: (|(sAMAccountName=IT_OPS))
> Enable new users: Yes (Default)
> Remove vanished options
> ACL: True
> Entry: True
> Properties: True
> 
> === PBS3 settings ====
> TAB: GENERAL
> Realm: ldap
> Base Domain Name: dc=economia,dc=cz
> User Attribute Name: sAMAccountName
> Anonymous search: false
> Bind Domain Name: CN=<redacted>,CN=Users,DC=economia,DC=cz // same user as above
> Bind Password: <same as above, from 1Pass>
> Server: <redacted>
> Fallback Server: <empty>
> Port: Default
> Mode: LDAP
> Verify certificate: greyed out, false
> 
> TAB: SYNC OPTINS:
> First Name attribute: givenName // verified with cli ldapsearch
> Last Name attribute: sn
> E-Mail attribute: mail
> 
> Default sync options
> Enable new users: Yes (Default)
> 
> User classes: user
> User filter: (MemberOf=CN=IT_OPS,OU=External,OU=Groups,DC=economia,DC=cz)
> !! I miss group classes
> !! I miss Group Filter
> 
> Remove vanished options
> ACL: True
> Entry: True
> Properties: True
> 
> On pressing add I get:
> Could not search LDAP realm, base_dn could be incorrect: LDAP operation result rc=4 (sizeLimitExceeded), dn: “”, text: “”: rc=4 (sizeLimitExceeded), dn: “”, text: “”
> _______________________________________________
> pve-user mailing list
> pve-user@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-user