[SOLVED] LDAP help with external app

[maxxer]

Hi
I am trying to authenticate Endian Firewall's VPN users against Zimbra.
I'm following the article at this url:
Endian Knowledge Base / How to configure LDAP authentication with openvpn server

So I produced the following configuration file for openvpn:

AUTHENTICATION_STACK=ldap,local
AUTH_TYPE=psk
CLIENT_TO_CLIENT=on
DOMAIN=mydomain.it
DROP_DHCP=
GLOBAL_DNS=10.22.22.1
LDAP_BIND_DN=cn=uid=zimbra,cn=admins,cn=zimbra
LDAP_BIND_PASSWORD=ldappwd
LDAP_GROUP_BASEDN=ou=groups,dc=mydomain,dc=it
LDAP_GROUP_MEMBERATTRIBUTE=uniqueMember
LDAP_GROUP_SEARCHFILTER=(|(cn=vpn))
LDAP_REQUIRE_GROUP=on
LDAP_URI=ldap://zimbraserver
LDAP_USER_BASEDN=ou=people,dc=mydomain,dc=it
LDAP_USER_SEARCHFILTER=(&(uid=%(u)s))
OPENVPN_ENABLED=on
OPENVPN_PORT=41194
PURPLECLIENT_BEGIN_DEVICE=tap2
PURPLE_DEVICE=tap0
PURPLE_IP_BEGIN=10.22.22.231
PURPLE_IP_END=10.22.22.240
PUSH_DOMAIN=
PUSH_GLOBAL_DNS=
PUSH_GLOBAL_NETWORKS=

but it won't work.
I stripped out some of the filtering it does, as I only need 'vpn' group.
so it doesn't work.

Anyone did something like that?

I configured Zabbix LDAP login without any issue, I'm wondering what's wrong here...
thanks

[phoenix]

Have you read the Release Notes about Anonymous searches of LDAP or is the firewall likely to be blocking this request?

[maxxer]

thanks for your reply.

that doesn't look to me as an anonymous search...
and btw the vpn reside ON the firewall, there are no restrictions between it and zimbra!

[maxxer]

Ok this is the correct configuration for Endian Firewall and Zimbra LDAP, to authenticate users in the posix "vpn" group.

LDAP_BIND_DN=uid=zimbra,cn=admins,cn=zimbra
LDAP_BIND_PASSWORD=MYLDAPPASS
LDAP_GROUP_BASEDN=ou=groups,dc=MYDOMAIN,dc=it
LDAP_GROUP_MEMBERATTRIBUTE=memberUid
LDAP_GROUP_SEARCHFILTER=(|(cn=vpn))
LDAP_REQUIRE_GROUP=on
LDAP_URI=ldap://MYZIMBRASERV
LDAP_USER_BASEDN=ou=people,dc=MYDOMAIN,dc=it
LDAP_USER_SEARCHFILTER=(&(uid=%(u)s))

can be improved with checks like if the user is active, for instance.

efw vpn is based on openvpn, so I guess these settings, in one way or another, will fit for every openvpn client.