Mixing LDAP and local users possible?

[rel33]

Hello,
short question - can I mix LDAP user (using sftpgo-plugin-auth) and local users (not existing in LDAP) created via SftpGo webpanel?
I tried to do so, but it looks like sftpgo-plugin-auth is disabling local user passwords and existence.

EDIT: I continue testing LDAP auth plugin.
LDAP user password is accepted by SFTP connection, while local sftpgo user (and passwords) are accepted by FTP connection.
LDAP user password is not accepted by FTP connection, and sftpgo user password is accepted by FTP connection.
Does it mean that LDAP auth plugin does work only for SFTP connection?
Strange that FTP user authentication is different now from FTP user authentication.

Best regards,
Piotr

[Macleykun]

hey @rel33 i sadly can't answer your question, but i was wondering if you happen to configure the ldap auth plugin using the config file.
I can't figure out what problem i have with the formatting of the json file. Is is possible that you show and example how you formatted it?
#1373

[rel33]

Hello @Macleykun, here it is (you need to set proper username, password, IP address and group, or omit group):

cat /etc/sftpgo/env.d/sftpgo-plugin-auth

SFTPGO_PLUGIN_AUTH_LDAP_URL="ldaps://IP.IP.IP.IP:636"
SFTPGO_PLUGIN_AUTH_LDAP_BASE_DN="dc=domain,dc=name"
SFTPGO_PLUGIN_AUTH_LDAP_BIND_DN="cn=account.name,ou="Full OU to",ou=ExactOUPlace,dc=domain,dc=name"
SFTPGO_PLUGIN_AUTH_LDAP_USERNAME="account.name"
SFTPGO_PLUGIN_AUTH_LDAP_PASSWORD="account.pass"
SFTPGO_PLUGIN_AUTH_LDAP_SEARCH_QUERY="(&(objectClass=user)(sAMAccountType=805306368)(sAMAccountName=%username%))"
SFTPGO_PLUGIN_AUTH_PRIMARY_GROUP_PREFIX="DEF"
SFTPGO_PLUGIN_AUTH_REQUIRE_GROUPS=true
SFTPGO_PLUGIN_AUTH_SKIP_TLS_VERIFY=1
SFTPGO_PLUGIN_AUTH_CACHE_TIME=60
SFTPGO_PLUGINS__0__TYPE=auth
SFTPGO_PLUGINS__0__AUTH_OPTIONS__SCOPE=5
SFTPGO_PLUGINS__0__CMD="/usr/local/sbin/sftpgo-plugin-auth"
SFTPGO_PLUGINS__0__ARGS="serve"
SFTPGO_PLUGINS__0__AUTO_MTLS=1

[Macleykun]

sorry for the late reply, i eventually figured it out and configured it in the json config file!

  "plugins": [
    {
      "cmd": "/usr/local/bin/sftpgo-plugin-auth",
      "type": "auth",
      "auth_options": {
        "scope": 1
      },
      "args": [
        "serve",
        "--ldap-url=ldap://192.168.15.168:389",
        "--ldap-base-dn=DC=mcdonalds,DC=local",
        "--ldap-bind-dn=CN=macley,CN=Users,DC=mcdonalds,DC=local",
        "--ldap-password=TestWindowsAD!2023",
        "--ldap-search-query=(&(objectClass=user)(sAMAccountType=805306368)(sAMAccountName=%username%)(memberof:1.2.840.113556.1.4.1941:=CN=APP-Linux-Satellite-Admin,OU=Application Groups,OU=Groepen,DC=mcdonalds,DC=local))",
        "--ca-certificates=/tmp/rootca.crt"
      ],
      "auto_mtls": true
    }
  ]

Hope you can find out if you can mix local and ldap users and resolve this issue :)

[JonBendtsen]

is /usr/local/bin/sftpgo-plugin-auth a single file or is it a checkout of https://github.com/sftpgo/sftpgo-plugin-auth ?

[JonBendtsen]

is /usr/local/bin/sftpgo-plugin-auth a single file or is it a checkout of https://github.com/sftpgo/sftpgo-plugin-auth ?

I looked in the container image and it is a single file. Documentation does not seem to write how you build it though, so I'll just run the container image

[iteossp]

Hi @rel33 @JonBendtsen.
I've been trying to mix LDAP and local auth but I've not been able to do that.
Have you been able to achieve that?

Regards.

[JonBendtsen]

I have not tried to mix local and LDAP users, I run multiple SFTPgo servers, some in DMZ that is externally exposed and one internally with a virtual folder that uses ldap users.

Through the virtual folder the ldap users on a windows platform can write data through to a different linux server in the DMZ

[iteossp]

Is anyone able to confirm if its possible to mix ldap and local auth for sftp purpose?

[leotog]

something new?
Since the scope used for ldap is = 1, if I assign scope values ​​that have the "1" incorporated (such as 3, 5, 15) it tries to validate by ldap and does not try with the rest then the local user validation will not work. works.
On the contrary, if I set scope values ​​that do not have a "1" (such as 2, 4, 8), it tries the other methods and skips the ldap test completely.

Is there a way to use both? Or that for the web it is ldap and sftp is local?