How to combine local admin login and LDAP login

[JairoVV]

Hi,

I would like to know if it is possible to combine login with the local Meshcentral administrator and login with LDAP users.

Thanks in advance

[si458]

yes you create a local account first,
then setup the authStrategies for ldap,
then when a user logs in meshcentral checks local first then asks LDAP

[JairoVV]

Hi,

I'm using this config.json, but only work local login, ldap is not workin, if I don't use authStrategies config LDAP connection works correctly:

{
    "settings": {
        "MongoDb": "mongodb://mesh:[email protected]:27017/meshcentralDB",
        "Cert": "meshcentral-server.domain.local",
        "_WANonly": true,
        "_LANonly": true,
        "port": 443,
        "aliasPort": 443,
        "redirPort": 80,
        "redirAliasPort": 80,
        "allowlogin": true,
        "debug": true,
        "ldap": {
            "enabled": true,
            "ldapUserEmail": "mail",
            "ldapOptions": {
                "url": "ldap://DC.IP:389",
                "binddn": "CN=Mesh,OU=USERS,DC=domain,DC=local",
                "bindpass": "password",
                "basedn": "OU=USERS,DC=domain,DC=local",
                "userobjectclass": "person",
                "userfilter": "(sAMAccountName={{username}})",
                "groupfilter": "(&(objectCategory=group)(member={{dn}}))",
                "groupattribute": "cn",
                "defaultdomain": "domain.local",
                "reconnect": true
                }
        }
    },
    "domains": {
        "": {
            "title": "MeshCentral",
            "_userquota": 100,
            "auth": ["authlocal", "authldap"],
			"authstrategies": {
					"authlocal": {
							"order": 1,
							"title": "Local Accounts",
							"enabled": true,
							"type": "local"
					},
					"authldap": {
							"order": 2,
							"title": "Active Directory",
							"enabled": true,
							"type": "ldap"
					}
			}
		}
    }
}

Is this the correct syntax for use authStrategies with local and LDAP login? Thanks in advance

[si458]

oh no no no thats completely wrong the whole thing is wrong!? give me a mo and ill send bk a sample

[si458]

sample based on the info you provided

{
  "settings": {
    "MongoDb": "mongodb://mesh:[email protected]:27017/meshcentralDB",
    "Cert": "meshcentral-server.domain.local",
    "_WANonly": true,
    "_LANonly": true,
    "port": 443,
    "aliasPort": 443,
    "redirPort": 80,
    "redirAliasPort": 80,
    "debug": true
  },
  "domains": {
    "": {
      "title": "MeshCentral",
      "_userquota": 100,
      "auth": "ldap",
      "ldapUserEmail": "mail",
      "ldapOptions": {
        "url": "ldap://DC.IP:389",
        "binddn": "CN=Mesh,OU=USERS,DC=domain,DC=local",
        "bindpass": "password",
        "basedn": "OU=USERS,DC=domain,DC=local",
        "userobjectclass": "person",
        "userfilter": "(sAMAccountName={{username}})",
        "groupfilter": "(&(objectCategory=group)(member={{dn}}))",
        "groupattribute": "cn",
        "defaultdomain": "domain.local",
        "reconnect": true
      }
    }
  }
}

also LDAP video/screenshot examples here too - https://ylianst.github.io/MeshCentral/meshcentral/#ldap

[JairoVV]

Hi,

With this configuration I'm able to login with LDAP but local admin doesn't work. How I can set up config.json for use local LDAP login and also local admin login? Thanks in advance

[si458]

In theory it should allow it? I'll have to check later when I'm stationary again

[JairoVV]

Hi,

with this config.json LDAP login works but local login doesn't. How I can setup both types of login? Thanks in advance

[si458]

unfortunally after my testing, you cant, when you enable ldap with "auth": "ldap"
any local accounts cannot be logged in with as the authentication gets sent to LDAP instead

[JairoVV]

Hi, ok, thanks for the help

[si458]

If u wanted the ability to still allow local logins,

we could implement it via a value in config.json like "ldapfallbacktolocal": true
And if the ldap fails to auth, it will try local authentication too

Just open up an enhancement issue in issues and let us know :)

It take about a week to do maybe less

[JairoVV]

Hi, We just opened an enhancement issue as you suggest, thanks for all, we will be waiting for this new feature. Regards, El mié, 9 oct 2024 a las 15:02, Simon Smith ***@***.***>) escribió:

…

If u wanted the ability to still allow local logins, we could implement it via a value in config.json like "ldapfallbacktolocal": true And if the ldap fails to auth, it will try local authentication too Just open up an enhancement issue in issues and let us know :) It take about a week to do maybe less — Reply to this email directly, view it on GitHub <#6438 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN7BEYD6FLDDXYR2WCE6L3LZ2USOXAVCNFSM6AAAAABPSBSFYKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAOBZGI2DCOA> . You are receiving this because you modified the open/close state.Message ID: ***@***.*** com>