Multi Domain query #89

timmjd · 2016-04-24T16:58:10Z

Will query for the NetBIOS name within the ConfigurationNamingContext to get all available Domains within the configured Parition.

Testing

Setup an AD forest as described
- https://www.youtube.com/watch?v=M4kNJVCnAok
- https://www.youtube.com/watch?v=b1z48OdpovY
- https://www.youtube.com/watch?v=RpXZPd6ttGg
- Create some additional users and groups on all servers (local / global / universal)
Within GHE Management console
- Connect to any AD server via port 389
- Add all root basedn from your domains
Within GHE
- Login as any user from within your AD forest
- Use any group (local / global / universal) for team management

Details
This modification works within our Active Directory infrastructure with six sub domains and thousands AD servers as well as with the testing example described within the pull request: I can bind to a single AD server and GitHub will show up all available groups: local / global or universal and also allow to login even if my user is present within another AD that I have bound to.

Technically it will do an additional query to CN=Configuration,DC=foobar,DC=com to search for nETBIOSName=* to obtain all available AD server by there DNS names and there responsible root basedn. Within every search this information will be reused and do a query to all available AD to get available users & groups.

Improvement could be done to evaluate the base of the search to only fire requests to the servers if it's basedn is matching the request.
Also this search behavior could be made available by a configuration switch to not break an existing installation.

jch · 2016-04-25T17:56:28Z

@timmjd thanks for the PR. I don't have enough AD experience to review this PR, but I will find someone who can. cc @davesims

gnawhleinad · 2016-05-12T03:49:41Z

🙇, thanks again for the pull request!

Also this search behavior could be made available by a configuration switch to not break an existing installation.

That would be ✨! While we're glad to hear that this solution works well for your Active Directory infrastructure, we want to put this behind a configuration switch (with default off) to not change the behavior for other customers.

Improvement could be done to evaluate the base of the search to only fire requests to the servers if it's basedn is matching the request.

Another improvement could be to route searches based off of replication configuration in Active Directory Site and Services.

Testing

Appreciate these steps! Would it be possible to also add testing in test/?

timmjd · 2016-05-16T17:03:27Z

Hello @gnawhleinad, thanks for the review. What do you mean by 'searches based off of replication'?

Option search_forest added to be passed from the outside configuration
Search query will only be opened to affected servers that hold the containing basedn

Writing tests would to be problematic due to it would require interaction with your active directory testing environment that seems currently not to be integrated with travis.

timmjd · 2016-05-16T17:23:24Z

lib/github/ldap.rb

+            @connection.search(options, &block)
+          else
+            @forest.each_with_object([]) do |(rootdn, server), res|
+              if options[:base].end_with?(rootdn)


Requires to use end_with?() and not eql?() which will result in unnecessary requests if you have a setup like DC=foo,DC=bar,DC=com & DC=bar,DC=com. Issue is that calls to the library contain requests where the basedn points to the object of interest.

Login to GHE for example will query the full path: options[:base]='CN=user,OU=org,DC=foo,DC=bar,DC=com'

Possible fix would be to form such queries (outside the library) to search for the distinguished name: options[:filter]='distinguishedName=CN=user,OU=org,DC=foo,DC=bar,DC=com' with a basedn options[:base]='DC=foo,DC=bar,DC=com'

gnawhleinad · 2016-05-27T00:53:15Z

What do you mean by 'searches based off of replication'?

Rather than iterating through the list of domain controllers, could we query based off the biases dictated by the replication configuration (e.g. locality, cost, ...)?

Writing tests would to be problematic due to it would require interaction with your active directory testing environment that seems currently not to be integrated with travis.

While we don't have Active Directory tests integrated with TravisCI, we do have tests that can be run from a local Active Directory environment via test/support/vm/activedirectory.

Option search_forest added to be passed from the outside configuration

Would it be possible to explore a new search_strategy that iterates through the forest for group membership lookups? For user attributes, this information is already available from the Global Catalog (so it's not necessary to iterate through the forest).

/ref: lib/github/ldap/membership_validators/active_directory.rb

gnawhleinad · 2016-05-27T00:54:20Z

lib/github/ldap.rb

@@ -307,6 +331,37 @@ def configure_member_search_strategy(strategy = nil)
        end
    end

+    # Internal: Queries configuration for available domains
+    #
+    # Membership of local or global groups need to be evaluated by contacting referral Donmain Controllers


s/Donmain/Domain/g

davesims · 2016-07-08T04:11:36Z

@timmjd 🙇 ✖️ 💯 for all your hard work on this! To get this merged in faster, I'm going to close this PR and continue working on these changes in a new PR based on your fork: #91.

fix travis to update gems before build

8c945ce

timmjd force-pushed the feature/multi_domain branch from 1b8e607 to 9405990 Compare April 24, 2016 17:05

Implement forest search to obtain non universal groups from ad

0ba3966

timmjd force-pushed the feature/multi_domain branch from 9405990 to 0ba3966 Compare May 16, 2016 16:38

timmjd reviewed May 16, 2016
View reviewed changes

gnawhleinad reviewed May 27, 2016
View reviewed changes

davesims mentioned this pull request Jul 8, 2016

Support Active Directory Forest searches #91

Closed

6 tasks

davesims closed this Jul 8, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Multi Domain query #89

Multi Domain query #89

Uh oh!

timmjd commented Apr 24, 2016 •

edited

Loading

Uh oh!

jch commented Apr 25, 2016 •

edited

Loading

Uh oh!

gnawhleinad commented May 12, 2016

Uh oh!

timmjd commented May 16, 2016 •

edited

Loading

Uh oh!

timmjd May 16, 2016 •

edited

Loading

Uh oh!

gnawhleinad commented May 27, 2016

Uh oh!

gnawhleinad May 27, 2016

Uh oh!

davesims commented Jul 8, 2016

Uh oh!

Uh oh!

Multi Domain query #89

Multi Domain query #89

Uh oh!

Conversation

timmjd commented Apr 24, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jch commented Apr 25, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gnawhleinad commented May 12, 2016

Uh oh!

timmjd commented May 16, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

timmjd May 16, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gnawhleinad commented May 27, 2016

Uh oh!

gnawhleinad May 27, 2016

Choose a reason for hiding this comment

Uh oh!

davesims commented Jul 8, 2016

Uh oh!

Uh oh!

timmjd commented Apr 24, 2016 •

edited

Loading

jch commented Apr 25, 2016 •

edited

Loading

timmjd commented May 16, 2016 •

edited

Loading

timmjd May 16, 2016 •

edited

Loading