Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unchecking/disabling ldap_allow_unauthenticated odes not work #139

Open
TRoc81 opened this issue Sep 12, 2024 · 1 comment
Open

Unchecking/disabling ldap_allow_unauthenticated odes not work #139

TRoc81 opened this issue Sep 12, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@TRoc81
Copy link

TRoc81 commented Sep 12, 2024

Describe the bug
I am trying to disable the ldap_allow_unauthenticated option, which is enabled by default when creating a new LDAP authentication server.
I can re-enable it after manually disabling the option.
Same with ldap_rfc2307, but this option is not enabled by default.
I can enable both by setting them to true in the playbook, but cannot disable them by setting them to false in the playbook.

There is no error when running the playbook.
I tried FALSE, false, False, "FALSE", "false" and "False".

Expected behavior
Options will either be checked when setting them to true or unchecked when setting them to false in the playbook.

Playbook
Please paste a minimal playbook to reproduce the issue:

    - name: Add adservers authentication server
      pfsensible.core.pfsense_authserver_ldap:
        name: AD
        host: adserver.example.com
        port: 636
        transport: ssl
        scope: subtree
        authcn: cn=users
        basedn: dc=example,dc=com
        binddn: cn=bind,ou=Service Accounts,dc=example,dc=com
        bindpw: "password"
        attr_user: samAccountName
        attr_member: memberOf
        attr_groupobj: group
        ldap_allow_unauthenticated: false
        state: present

Output
Please paste the ansible output run with -vv:

PLAYBOOK: test.yaml **************************************************************************************************************************************************************************************
1 plays in test.yaml

PLAY [create ldap auth server] ***************************************************************************************************************************************************************************

TASK [Add adservers authentication server] ***************************************************************************************************************************************************************
task path: /home/ubuntu/playbooks/pfsense/test.yaml:8
changed: [fw01-a-pfsensetest] => {"changed": true, "commands": ["create authserver_ldap 'AD'"], "stderr": "", "stderr_lines": [], "stdout": "", "stdout_lines": []}

PLAY RECAP ***********************************************************************************************************************************************************************************************
fw01-a-pfsensetest         : ok=1    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

Environment

  • What version of pfsensible.core?
    0.6.2
  • What version of ansible?
    2.16.3
  • What version of pfSense?
    2.7.2
@TRoc81 TRoc81 added the bug Something isn't working label Sep 12, 2024
@Inocious
Copy link

Inocious commented Dec 1, 2024

Same issue here.
All parameters can't be set back to False once set to True

   ldap_rfc2307: false
   ldap_rfc2307_userdn: false
   ldap_utf8: false
   ldap_allow_unauthenticated: false
    ldap_nostrip_at: false

Only that one is okay:

    extended_enabled: false

Also note that Pfsensible can't interact with this key,it's not implemented : ldap_anon

What I know is when the parameters are check on pfsense GUI then saved => POST is sending information key = "yes" (ex: ldap_allow_unauthenticated "yes") for all the keys with checkbox:
(I checked all checkbox: ldap_rfc2307, ldap_rfc2307_userdn, ldap_utf8, ldap_allow_unauthenticated, ldap_nostrip_at, extended_enabled)

__csrf_magic	"sid:<REDACTED>"
name	"ldap.domain.local"
type	"ldap"
ldap_host	"ldap.domain.local"
ldap_port	"636"
ldap_urltype	"SSL/TLS+Encrypted"
ldap_caref	"global"
ldap_protver	"3"
ldap_timeout	"25"
ldap_scope	"one"
ldap_basedn	"dc=domain,dc=local"
ldapauthcontainers	"ou=users"
ldap_extended_enabled	"yes"
ldap_extended_query	"memberOf=cn=pfSense,ou=groups,dc=domain,dc=local"
ldap_binddn	"uid=ldap_srv,ou=users,dc=domain,dc=local"
ldap_bindpw	"<REDACTED>"
ldap_attr_user	"uid"
ldap_attr_group	"uid"
ldap_attr_member	"memberOf"
ldap_rfc2307	"yes"
ldap_rfc2307_userdn	"yes"
ldap_attr_groupobj	"posixGroup"
ldap_pam_groupdn	"uid=remoteshelluser,ou=groups,dc=domain,dc=local"
ldap_utf8	"yes"
ldap_nostrip_at	"yes"
ldap_allow_unauthenticated	"yes"
radius_protocol	"PAP"
radius_host	""
radius_secret	""
radius_srvcs	"both"
radius_auth_port	""
radius_acct_port	""
radius_timeout	""
radius_nasip_attribute	"wan"
userid	"0"
id	"0"
save	"Save"

When the parameters are UNcheck, POST is NOT sending any information about the key. In that case pfsense understand that he should put value to False:
(All checkbox unchecked : ldap_rfc2307, ldap_rfc2307_userdn, ldap_utf8, ldap_allow_unauthenticated, ldap_nostrip_at, extended_enabled)

__csrf_magic	"sid:<REDACTED>"
name	"ldap.domain.local"
type	"ldap"
ldap_host	"ldap.domain.local"
ldap_port	"636"
ldap_urltype	"SSL/TLS+Encrypted"
ldap_caref	"global"
ldap_protver	"3"
ldap_timeout	"25"
ldap_scope	"one"
ldap_basedn	"dc=domain,dc=local"
ldapauthcontainers	"ou=users"
ldap_extended_query	"memberOf=cn=pfSense,ou=groups,dc=domain,dc=local"
ldap_binddn	"uid=ldap_srv,ou=users,dc=domain,dc=local"
ldap_bindpw	"<REDACTED>"
ldap_attr_user	"uid"
ldap_attr_group	"uid"
ldap_attr_member	"memberOf"
ldap_attr_groupobj	"posixGroup"
ldap_pam_groupdn	"uid=remoteshelluser,ou=groups,dc=domain,dc=local"
radius_protocol	"PAP"
radius_host	""
radius_secret	""
radius_srvcs	"both"
radius_auth_port	""
radius_acct_port	""
radius_timeout	""
radius_nasip_attribute	"wan"
userid	"0"
id	"0"
save	"Save"

There is probably an issue somewhere dealing with ldap_rfc2307, ldap_rfc2307_userdn, ldap_utf8, ldap_nostrip_at and ldap_allow_unauthenticated where extended_enabled is NOT affected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants