@thenorthernlight Thanks! It appears I had two problems with the configuration I posted earlier that were causing the Test plugin to fail:

Use StartTLS should be off
User filter should be (userPrincipalName={{name}})

Now onto testing if actual AD logons are working.

Cheers.

@Darkbeldin Got ya, thanks!

Hello, I set up my auth-ldap (v0.10.4) plugin as follows:

ldaps://ad_serv.something.company.com
Certificate authentication item: /etc/ssl/certs/company_root.pem
check cert = OFF
Use StartTLS = OFF

base= DC=something,DC=company,DC=com
Credentials:
dn = admin@something.company.com
password = xxxxx
user filter=(userPrincipalName={{name}})
ID Attribute= dn

and I’m able to log onto XOA with AD domain credentials. The next challenge is to get LDAP groups working. I used the settings from this post:
https://xcp-ng.org/forum/topic/3760/ldap-plugin-syncing-groups-from-windows-ad-server-2016-help/3

Base			DC=something,DC=company,DC=com
Filter			objectClass=group
ID Attribute		cn
Display name attribute	cn

Members mapping

Group attribute		member
User attribute		dn

After rebooting XOA I got the domain groups to show up under Settings > Groups. The problem is each of the groups is empty (no users in group).

My knowledge of LDAP is very limited. Would anyone know how to modify the configurations so users will populate, I’m assuming that’s what you would want. I would like different AD groups to have different abilities in XO

Cheers.

@olivierlambert May I propose a Windows Active Directory plugin? It should only require the domain name and credentials to "join the domain". I believe Synology has this setup, as does QNAP. I would strongly suspect that Windows Server has a specific way of setup up LDAP if using defaults during install. I believe I read on Phoronix that Ubuntu now supports "joining the domain" during the install process as well. By "joining the domain" I mean automatic LDAP configuration and domain controller root certificate should be added XO's trusted certificates.

For someone like me who never really dealt with or set up LDAP, this would make XO way more appealing to use. Just my two cents.

Thank you for all your work, other than this I'm really impressed with XO, especially the backups!

Cheers.

@thenorthernlight Thanks! It appears I had two problems with the configuration I posted earlier that were causing the Test plugin to fail:

Use StartTLS should be off
User filter should be (userPrincipalName={{name}})

Now onto testing if actual AD logons are working.

Cheers.

@pdonias Thanks for getting back to me. I enabled debug level under logs and rebooted the VM. Here is what the logs show:

Jan 12 17:37:05 xoa xo-server[536]: 2022-01-12T22:37:05.296Z xo:xo-server-auth-ldap DEBUG attempting to bind with as user@lan.company.com...
Jan 12 17:37:05 xoa xo-server[536]: 2022-01-12T22:37:05.313Z xo:xo-server-auth-ldap DEBUG successfully bound as user@lan.company.com
Jan 12 17:37:05 xoa xo-server[536]: 2022-01-12T22:37:05.314Z xo:xo-server-auth-ldap DEBUG searching for entries...
Jan 12 17:37:05 xoa xo-server[536]: 2022-01-12T22:37:05.336Z xo:xo-server-auth-ldap DEBUG 0 entries found
Jan 12 17:37:05 xoa xo-server[536]: 2022-01-12T22:37:05.336Z xo:xo-server-auth-ldap DEBUG could not authenticate user@lan.company.com
Jan 12 17:37:05 xoa xo-server[536]: 2022-01-12T22:37:05.373Z xo:api WARN user | plugin.test(...) [89ms] =!> Error: could not authenticate user

I copied and pasted the user name and password from the ldapsearch command. Ldapsearch command still works.

To troubleshoot, I have installed ldapsearch on XOA via ssh (sudo apt-get install ldap-utils) and edited /etc/ldap/ldap.conf. After fine tuning some settings I was able to get ldapsearch to return results. When I attempt to use "the same" settings to configure the XOA LDAP plugin however, I get this in the logs: "could not authenticate user"

Here is what's inside my /etc/ldap/ldap.conf:

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
BASE   OU=Accounts,DC=lan,DC=company,DC=com

#URI    ldap://ldap.example.com ldap://ldap-provider.example.com:666
URI    ldaps://server.lan.company.com

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

# TLS certificates (needed for GnuTLS)
TLS_CACERT      /etc/ssl/certs/company_root.pem

Executing this at the XOA command line I get a long list of entries pertaining to my AD users:

ldapsearch -H ldaps://server.lan.company.com -x -D user@lan.company.com -w password

My plugin settings are as follows:
ldaps://server.lan.company.com
/etc/ssl/certs/company_root.pem
Check certificate: Yes
Use StartTLS: off
Base: OU=Accounts,DC=lan,DC=company,DC=com

dn: user@lan.company.com
password: password
User filter: (uid={{name}})
ID attribute: dn

Any hints on how to trouble shoot this further?

I will patiently wait for @pdonias to be back from holidays

@pamadmax Guess what? I'm facing the exact same problem and if I don't get this going I'm going to be in trouble with my boss!

Install this on your computer to help figure out your LDAP URL
http://www.ldapbrowser.com/download.htm
Select: Softerra LDAP Browser

Connect to your AD domain LDAP with this software.
Verify you can brows the contents of LDAP with in the software.
On the left most pain, you should see an entry for your Windows LDAP.
Right click on it and select properties.
In the profile tab you should see your LDAP URL.

@olivierlambert Thanks!

I figured it out, you have to start the trial manually, now all the plugins are there.