New AD/LDAP users not synched with Graylog

[OK-Cactus (Omkar Kadam)]

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
Users belonging to newer OU’s are not able to login via LDAP credentials.
If I try to add/whitelist new OU’s in Search base DN, it leads to LDAP errors DSID-0310022D, DSID -03100225

Also many users of the currently added OU are not synchronized, i.e the OU has more than the number of users that are being discovered on Graylog

2. Describe your environment:

• OS Information: Private Build 1.8.0_282 on Linux 5.4.0-1041-aws

• Package Version: Graylog 4.0.5+d95b909

• Service logs, configurations, and environment variables:

Search base DN : OU=ABC,OU=XYZ,DC=ABCCORP,DC=com (values for representation purposes)
Search pattern: (&(mail=*)(sAMAccountName={0}))
name Attribute: cn
Full Name Attribute: displayName
ID Attribute: sn

3. What steps have you already taken to try and solve the problem?

Tried to add OU’s in the Authentication → User Synchronization and Test user Login (fails, if new OU is added)

If OU settings are changed Graylog login stops working, and Admin login, reverting authentication settings to previous values fixes it.

4. How can the community help?

Please suggest the configuration, LDAP settings which would help with the AD Sync.

Refer: AD/LDAP Authentication with groups, users not found - #7 by shoothub

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

[gsmith]

Hello && Welcome

Perhaps try some simple like this under User Synchronization.

Search Base DN:   CN=Users,DC=domain,DC=net
Search Pattern: (&(objectClass=user)(sAMAccountName={0}))
Name Attribute: sAMAccountName
Full Name Attribute: displayName

Lets say is your users are in a OU called mail then something like this.

Search Base DN:   CN=mail,DC=domain,DC=net
Search Pattern: (&(objectClass=user)(sAMAccountName={0}))
Name Attribute: sAMAccountName
Full Name  Attribute: displayName

This would depend on how you setup your AD and your other configurations that are not shown in this post.

I would advice checking permissions for the user your using in System User DN also.
This would require at lest a read role in Active directory for that user.

Perhaps check out this post. It might give you some clues

Unable to configure External Authentication on GrayLog- LDAP/Active Directory and SSO Authentication

Did you 100% sure, that user you want to authenticate, is member of Organization unit (OU): Ruffalo Noel Levitz If not, or want to find users in more OU, it’s better to setup Search Base DN: DC=rufallo,DC=int (so you search whole domain), and after that use LDAP filter setup in parameter User Search Pattern. I usually use want only member of specific group to login to graylog, so create group for example Graylog_users and add members of this group to it. After that use filter in field: User Sea…

When posting please take a look here this may help out.

How to Post a Question in the Community that Gets Responses

This platform is made with love for community discussions on the open source tool Graylog, it components and usage. Here’s a Graylog support-inspired template (thank you, @aaronsachs ) that’ll get responses: Description of your problem <!-- Use this section to describe the problem that you're encountering. Please include any screenshots or recordings of the problem you're running into.--> Description of steps you’ve taken to attempt to solve the issue <!-- Use this section to provide detail…

Thanks

[OK-Cactus (Omkar Kadam)]

Hello,

Thanks for your reply.

While adding multiple OU’s did not work, and the suggested configuration worked, but still new users were not discovered.

At the moment, I have broadened the OU search base DN (to the entire Organization), thereby all the OU’s under the top level root, are now accessible.

This is not a best case solution as huge Active directories might cause slower lookups/authentication as the search base filter is fully open.

Thanks & Regards,

Omkar Kadam

[gsmith]

Hello

@OK-Cactus

While adding multiple OU’s did not work, and the suggested configuration worked, but still new users were not discovered.

Working with someone’s AD is kind of touchy, meaning there is sensitive data. What I found was how you structure your Active Directory then configure your Attribute mapping for user accounts and
Attribute mapping for groups. This would be applied to your Search Base DN.

To find the correct configurations needed I would do the following.

Open a Windows command prompt.
Type the command:

dsquery user -name <known username>

Example: If you are searching for all users named "John", you can enter the username as John* to get a list of all users who's name is John.

The result will look like:

"CN=John.Smith,CN=Users,DC=MyDomain,DC=com"
 
- In Symantec Reporter's LDAP/Directory settings, when asked for a User Base DN, enter:

CN=Users,DC=MyDomain,DC=com

Now for Groups I would execute this.

Finding the Group Base DN
Open a Windows command prompt.
Type the command:

dsquery group -name <known group name>.

Example: If you are searching for a group called Users, you can enter the group name as Users* to get a list of all groups who's name contains "Users"

The result will look like:

"CN=Users,CN=Builtin,DC=MyDomain,DC=com"
 
In Symantec Reporter's LDAP/Directory settings, when asked for a User Base DN, enter:

CN=Users,CN=Builtin,DC=MyDomain,DC=com

I don’t think this is a Graylog issue, I believe you need the correct configurations and/or permission
on the Attribute mapping for groups in the active directory.

Hope that helps

[tmacgbay]

You can narrow your user and group search patterns - Is the user a member of Graylog_Kahunas…

User search pattern:
(&(objectClass=user)(sAMAccountName={0})(objectCategory=person)(memberOf=CN=graylog_kahunas,OU=admin_groups,OU=permissions,OU=process,DC=comapny,DC=tld))

Group search pattern:
(&(objectClass=group)(cn=graylog_kahunas))