LDAP JIT group mapping problems

[freiheit]

Hello,

This is a new zabbix 6.4 installation that I'm trying to set up LDAP authentication against AD servers on with the new JIT. Everything else works, but it isn't able to map group info and I can't figure out why or even where to look to get more details.

Any hints on places to get additional debugging out of this are welcome.

Using ldapsearch on CLI with same bind user, my own record contains (corp name replaced with "redacted" or "example"):

cn: Eric Eisenhart
sn: Eisenhart
displayName: Eric Eisenhart
memberOf: CN=Senior System Engineer,OU=JobTitles,OU=Redacted Groups,DC=office,DC=redacted,DC=net
mailNickname: eric.eisenhart
sAMAccountName: eric.eisenhart
mail: [email protected]​

JIT portion of LDAP auth config looks like:

But test authentication doesn't map group:

Possibly related to /forum/zabbix-troubleshooting-and-problems/461779-struggling-with-jit-for-azure-ad-saml-v-6-4 ?

[freiheit]

Looks like this is a bug: https://support.zabbix.com/browse/ZBX-22597

[rofloslav]

try this:

[Arnold Kuehnle]

Same Problem with version 6.4.2, User Group Mapping does not work:






Any idea?

[Arnold Kuehnle]

Additional Question: are nested Groups processed or only "one level"?

[Arnold Kuehnle]

Why does the "Group Name Attribute" destroy the matching .. using cn, sAMAccountName, etc. always does not work. What am i misunderstanding?

BTW: Port 636 works fine, too.

[Arnold Kuehnle]

Aftern reading further i found the solution:

Using memberOf and leaving the "Group Name Attribute" empty did the job.

Tested nested groups: does not work, only direkt membership of the users.

[bo83snap]

in my case still doesn't. I the group membership attribute in your case returning a full dn from the group or just the short group name?
I am trying to look into CLdap.php and figure out if he's even expecting just a simple short name or just looks for full dn to split.

[bo83snap]

I'm sorry but for me nothing works!!!! and tried all the combinations!!! For several days. the test gives Login successful but no group mapping.
I get media mapping ok even.
I tried memberOf and groupOfNames configurations (which wtf are these? do they refer to objectClass? associated with the user's membership). I tried with patching the bug as well.
I am really TIRED.

All the documentation is very ambiguous to me, explaining various similar terms and attributes. Use the docs, used the blogs and mapping still doesn't work!
Enabled the debug but that's useless since doesn't really show what is the search really doing. Searching manually through the ldap works fine.

So:

• i have ou=people and ou=groups, also ou=users (for posixAccount )
• users have xyzMemberOf attribute where each group cn an user is member is listed
• groups have memberUid attribute which contains the members' uid

[bo83snap]

Is the "Search filter" the one used when searching for an user only? (I assume)
Having User group membership attribute = xyzMemberOf and a mapping of ws_admin > zabbix admins > super admin role should be all that is needed. But it's not, apparently.

Is zabbix searching with full dn for groups or users ?

[FernandoRD]

I'm also stuck in this... the only way I managed it to work was putting an * in "LDAP group pattern"