How to implement LDAP on MRBS?

[oweeya]

Hi I've been trying to find a way to implement LDAP in MRBS. But from what I can find on the internet they are all using OpenLDAP and Active Directory, which I don't quite understand.

I would like to ask if that to in order implement LDAP in MRBS can I do it directly by just configuring the config.inc,php? Or there are other things that I should set up first?

And is OpenLDAP the right thing to use if I want to implement LDAP?

If OpenLDAP is the right thing to set up before implementing LDAP, is there any way for me to authenticate them with the user data I have created prior to setting up OpenLDAP or all the user data must be filled in manually when setting up LDAP?

I've installed MRBS 1.10.0 on ubuntu server 22.04 with PHP8.1 and using MariaDB as the database.

The documentation on here is quite fuzzy as it only tells you what to fill in and nothing more. All the information for setting also doesn't answer any of the questions I'm currently having.

Any replies and help with this topic is much appreciated.

Thank in advance.

[dmj]

If you don't have an LDAP system setup you don't need to use it.

 

The default authentication scheme is 'db', which stores users' details in theMRBS database in the 'users' table. However, the right choice for you will

depend on whether your users are already listed somehere else.

 

If you already have a central store of user ID's there is a good chance it uses LDAP as a backend and will be compatible.

eg: Okta , Google secure LDAP, MS Active Directory, FreeIPA, OpenLDAP are all identity providers that use LDAP as a backend.

 

Bear in mind you need some extra security precautions to setup LDAP across the internet, so I wouldn't do it directly.

MRBS -> SAML provider -> LDAP would be a better way and not use LDAP on MRBS at all.

[oweeya]

Thanks for the reply.

 

I wanted to do LDAP with it since I am tasked to do so (as a practice and compatibility). As for currently existing LDAP in company I can't confirm if there is one.

for now I'm just doing it in my own VM on my laptop to try and learn how to implement LDAP into MRBS so i don't think there is much to worry about.

For now the guides that I could find are all in the assumption that your machine is in the public network. I'm stuck on what should I enter when I doing it all on self-hosted network.

Any guides on this is appreciated. Thanks.

[mavhc]

Do you have a centralised login system at your workplace? Active Directory on Windows server? Or a microsoft 365 or google work setup?

[TechMonkey]

Do you have AD on your test network?

[Davit2005]

LDAP is unencrypted so if you want/need to use it I'd suggest using LDAPS as it is safer to have end to end encryption and not jus rely on a VPN. Whilst a VPN encrypts the data traveling through it at either end before it gets into the VPN it plain LDAP will be sending usernames and passwords in clear text. Edited December 9, 2022 by Davit2005

[dmj]

LDAP is unencrypted so if you want/need to use it I'd suggest using LDAPS as it is safer to have end to end encryption and not jus rely on a VPN. Whilst a VPN encrypts the data traveling through it at either end before it gets into the VPN it plain LDAP will be sending usernames and passwords in clear text.

 

You have to do both really, even LDAPS isn't really "secure" - once you've found a single LDAP login you get access to all the organisations LDAP data.

The Google secure ldap is good implementation but nobody in their right mind would expose an active directory to the internet ldaps or not - a saml IDP is a good middleware to auth against them.

[Davit2005]

You have to do both really, even LDAPS isn't really "secure" - once you've found a single LDAP login you get access to all the organisations LDAP data.

The Google secure ldap is good implementation but nobody in their right mind would expose an active directory to the internet ldaps or not - a saml IDP is a good middleware to auth against them.

 

Yep we use both in multiple systems. Only highlighting because end to end is better than jus in a VPN tunnel on its own :-)

[oweeya]

To answer the ones asking regarding having AD or other centralised login within the company network.

 

I am unable to confirm this as I am only doing things within my laptop and VM.

[oweeya]

For now security is not a concern for me as the test is only within my laptop and the VM inside of it. I am just trying to learn how to set up a LDAP and get it running to test out LDAP implementation on MRBS. Try to set up a LDAP server by following the guide here https://www.server-world.info/en/note?os=Ubuntu_22.04&p=openldap&f=1 and https://computingforgeeks.com/install-and-configure-openldap-server-ubuntu/. Not sure is these are the correct one to follow or I've been doing it all wrong.

 

I wanna know that if it is possible for the LDAP server and MRBS to be on the same VM if I want to use LDAP authentication on MRBS or it must be on separate VM if I wan it to work?

 

Some terms I might not able to explain properly or clearly as I still lack understandings regarding Linux, servers and network. I try my to best to explain but I can't guarantee my explanations is correct or easier to understand.

[TechMonkey]

To answer the ones asking regarding having AD or other centralised login within the company network.

 

I am unable to confirm this as I am only doing things within my laptop and VM.

 

You will have problem doing LDAPS then. You need a directory to authenticate against.

 

EDIT: In regard to your second post, if you aren't using AD then yes MRBS and a directory service can be on the same server. If this is a Windows environment, I would not recommend putting MRBS on the DC.

Edited December 13, 2022 by TechMonkey

[mavhc]

What's the reason to use LDAP instead of the internal database for usernames and passwords? If you're just wanting to learn how things work, that's fine of course.

[oweeya]

You will have problem doing LDAPS then. You need a directory to authenticate against.

 

EDIT: In regard to your second post, if you aren't using AD then yes MRBS and a directory service can be on the same server. If this is a Windows environment, I would not recommend putting MRBS on the DC.

 

thanks for the heads up. I'm doing this in linux environment (VM running ubuntu server 22.04). Been trying for days to no avail kinda making me wanna give up already.

[oweeya]

What's the reason to use LDAP instead of the internal database for usernames and passwords? If you're just wanting to learn how things work, that's fine of course.

 

I'm currently working as intern in a company and I assume that they tasked me to do LDAP because they want me to learn how to do it. I don't have a choice to reject and say just use db authenticate unfortunately.

[mavhc]

That's fine then, so yeah, step 1 is just run both on one computer, I assume they've asked you because they already have LDAP set up.

 

1. LDAP is a protocol, a language

2. You need an LDAP server, what OS are you using?

3. LDAP server stores usernames and passwords, so you'd add a user to it

4. You'd then use that username and password to authenticate with the LDAP server, and do multiple things

5. One thing is ask it to check if a username/password combo is correct, ie a legit user is trying to login to MRBS

 

It seems that whether the user is Level 0 1 or 2 is stored in MRBS itself, not in the LDAP server's database

[mavhc]

Ah, ubuntu, https://packages.ubuntu.com/bionic/ldap-account-manager might help.

 

Firstly ignore MRBS and get ldap working, https://ubuntu.com/server/docs/service-ldap-introduction should run you through a basic setup and test.

 

glossary: Directory Information Tree (DIT)

[oweeya]

took me days but I finally done it, got a LDAP server running. But now I have a new problem for the VMs networking.

 

so currently both of my MRBS VM and LDAP VM are running on NAT + Host-only. This enable me to access them 1 to 1 but now I need them to communicate. I found some ways to make them communicate but at the cost of losing access to the VMs externally(internal network and NAT network). Bridged network is not an option for me as my supervisor does not want to allocate IP for me to do testing.

 

Is there any way for me to make them communicate while retaining access to them externally? Or is there some way to port forward it using NAT network? I can't seem to find much tutorials and info on NAT network which is why I am very lost on it currently.

 

 

EDIT:

Nevermind I solved it. Turns out my eyes went blind and completely missed the *Apply* button after setting up port forwarding :>

Edited December 22, 2022 by oweeya