Salt Using Active Directory Auth

[Blake Ferkingstad]

I am very new to SaltStack, and I have been tasked with trying to setup AD authentication to our Salt master server, but have been running into trouble. From what I have read this should work, but maybe I am missing something.

 

auth_mode: 1

auth.ldap.server: 'domain.local'

auth.ldap.basedn: 'OU=Users,OU=IT,OU=Company,DC=domain,DC=local'

auth.ldap.binddn: 'CN=BindUser,OU=Special Accounts,OU=Company,DC=domain,DC=local'

auth.ldap.bindpw: 'BindPassword'

auth.ldap.activedirectory: 'True'

auth.ldap.persontype: 'User'

auth.ldap.filter: cn={{ username }}

 

external_auth:

  ldap:

    Users%:

      - .*

      - '@runner'

      - '@wheel'

 

When I check the master log all I see is this.

2015-05-14 12:02:01,135 [salt.master      ][WARNING ] Authentication failure of type "eauth" occurred.

 

Unfortunately this error really didn’t help me much. Is there another place to look for errors in Salt?

[C. R. Oldham]

AD authentication has changed significantly recently.  What Salt version are you working with?  

salt --versions-report

will help immensely.

--
You received this message because you are subscribed to the Google Groups "Salt-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to salt-users+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

--cro

C. R. Oldham, Platform Engineer, SaltStack

c...@saltstack.com / 801-564-4673

[Blake Ferkingstad]

Here is the results of salt –versions-report

 

           Salt: 2014.7.5

         Python: 2.7.5 (default, Jun 17 2014, 18:11:42)

         Jinja2: 2.7.2

       M2Crypto: 0.21.1

msgpack-python: 0.4.6

   msgpack-pure: Not Installed

       pycrypto: 2.6.1

        libnacl: Not Installed

         PyYAML: 3.10

          ioflo: Not Installed

          PyZMQ: 14.3.1

           RAET: Not Installed

            ZMQ: 3.2.5

           Mako: Not Installed

[C. R. Oldham]

That's what I was concerned about.  You can auth against Active Directory *users* in 2014.7.5, but not against *groups*.  Group AD auth didn't appear until 2015.5.0.  Also, better error message for eauth are in 2015.5.0.

As one extra data point, you'll need the python-ldap module installed on your master regardless of what version of Salt you are on.

[Blake Ferkingstad]

Okay, thanks for that. I have updated my test box to version 2015.5.0

           Salt: 2015.5.0

         Python: 2.7.5 (default, Jun 17 2014, 18:11:42)

         Jinja2: 2.7.2

       M2Crypto: 0.21.1

msgpack-python: 0.4.6

   msgpack-pure: Not Installed

       pycrypto: 2.6.1

        libnacl: Not Installed

         PyYAML: 3.10

          ioflo: Not Installed

          PyZMQ: 14.3.1

           RAET: Not Installed

            ZMQ: 3.2.5

           Mako: Not Installed

 

I also checked that I have python-ldap installed. I have rebooted the box and tried again, but still am having issues.

 

I checked /var/log/salt/master but that is still sending the same output as last time.

 

Is something in my configuration messed up?

[Blake Ferkingstad]

This turned out to be two things, first issue was I messed up on my groupsou and was pointing to something completely wrong. The second was on my SaltPad install I didn’t have it pointing to ldap for authentication yet.

 

Once I made those changes everything worked.

 

Thanks,

Blake

[C. R. Oldham]

Great!  Thanks for sending the followup.