Add LDAP HLD #1487

davidpil2002 · 2023-09-27T09:24:47Z

This LDAP HLD doc describes the requirements, architecture and configuration details of LDAP feature in SONiC.

PR title	state	context
[sonic-buildimage] Added support for LDAP
[sonic-utilities] Added support for LDAP
[sonic-host-services]Added support for LDAP

zhangyanzhao · 2023-10-03T15:35:23Z

community review recording https://zoom.us/rec/share/CWWs8a-ijENKTpO-2Eojvv8mggPVzBLQtzsM-xRk7u6HthGQy2APcQUkl4iIZIgW.-OE34KvTzSJlhFy8

doc/aaa/ldap/hld_ldap.md

madhupalu · 2023-10-04T20:57:13Z

doc/aaa/ldap/hld_ldap.md

+-	Configure version
+
+#### System Test cases
+


Is the LDAP test cases integrated with sonic-mgmt?

yes, the LDAP functional test should be integrated to sonic-mgmt

madhupalu · 2023-10-04T20:59:57Z

doc/aaa/ldap/hld_ldap.md

+LDAP Main flow – As mentioned in the LDAP authentication desc, the LDAP supports authentication by authenticating users via a remote server instead of locally (in the switch device).
+In high level the connection flow is the following:
+User will connect to a switch using ssh/login, the switch is an LDAP client (configured with LDAP feature - description of the configuration flow below), the client switch will “referred” the authentication of the user to the LDAP server binded, then the LDAP server will approve the authentication if the user & password match the LDAP server DB.
+And finally, the user will get approved and will be connected to the Switch.


How does the design handle LDAP client handles w.r.t LDAP server users lifecycle (add/del/update) and any stale entries?

In our design, LDAP clients don't handle the deletion/addition/modification of users.
For now, we decided to remain aligned to the original design of the LDAP package, which means, that only the LDAP server is allowed to add/remove users and configure the permissions (mainly by setting to which group each user belongs.)

Note:
LDAP package has a tool named ldapmodify that can be used to modify the configuration in the server after passing LDAP bind authentication by remote, but we are not going to support this flow in the CLI.
If a user likes to use this application it will be his responsibility.

madhupalu · 2023-10-04T21:00:19Z

doc/aaa/ldap/hld_ldap.md

+Authentication failed – user will not be able to connect like regular authentication fail.
+
+### Restrictions/Limitations  
+


Do you support multiple LDAP servers with various priorities?

yes, can be seen in the schema

madhupalu · 2023-10-04T21:02:16Z

doc/aaa/ldap/hld_ldap.md

+Note: no restart is required when modifying PAM configuration. Only required to restart the NSLCD service after any modification in nslcd.conf file
+
+#### LDAP NSS
+LDAP can be used as an option in the Name Services Switch(NSS) configuration. The NSS configuration enables various programming APIs to use other sources than the default files (e.g., Use LDAP directory information instead of /etc/passwd for user and group information). User information includes uid, gid, and home directory.


What is the rationale behind using NSL CD instead of SSSD for ldap?
There is a concern was the NSLCD does not support cache so it affects performance for scaling w.r.t many users. Is there any reason to go with NSLCD?
Can you explore SSSD as well.

NSLCD working smoothly, until today we haven't issues related to performances.
SSSD it's more complex to configure and use, so, for now, we go to the NSLCD direction.
The PR will be share soon

But, it can be a future item to review.
should be review:
if the performance really enhances in our use cases and also if sssd makes the configuration even more complex to the customer from the UX (User experience).

davidpil2002 · 2023-10-19T13:06:30Z

@madhupalu

answered all the comments, pls can you approve/review?

a-barboza · 2023-10-20T01:33:40Z

doc/aaa/ldap/hld_ldap.md

+Specifies the credentials with which to bind. This option is only applicable when used with binddn above. If you set this option you should consider changing the permissions of the nslcd.conf file to only grant access to the root user.
+
+So, this file will contain all the LDAP configurations besides the login configuration that was described in the functional section above.
+Note: no restart is required when modifying PAM configuration. Only required to restart the NSLCD service after any modification in nslcd.conf file


Are any changes being made to nslcd sources ? i.e. will the nslcd be source patched in SONiC ? It appears many of the CONFIG_DB schema (key) names for LDAP (or the corresponding sonic yang) names are not matching the corresponding nslcd.conf file configuration directives. One advantage of keeping the names similar (wherever possible) would be the ease of mapping the names in the hostcfg/jinja template to the corresponding nslcd.conf options. (Eg: binddn as opposed to bind_dn, bindpw as opposed to bind_password). Some options are missing from the nslcd.conf (Eg: hostname_check). Are those changes made to nslcd ? Would this be in the code PR shared?

nslcd will be installed, and is part of those packages: libnss-ldapd libpam-ldapd - no patches are required to be supported in SONiC.
about the naming, we will try to be aligned, but sometimes the name has no good human-readable name.

hostname_check - this is not part of the code, we will remove it from HLD.

I will share the PR soon, hope this week, due to the situation in IL, could be delayed a little bit.

in conclusion - at first, we will support the minimum requirement to use the remote authentication of LDAP.
(already tested internally in SONiC)

In the future, if required more LDAP features can be added on top of our code that will support easy extension in LDAP class

…hat supported and tested. (more feature can be added in the future if required)

davidpil2002 · 2023-10-23T13:59:57Z

Share the PRs related to the feature support. Pls see in the HLD description

WC to merge/comment the HLD and start the PRs review

liat-grozovik · 2023-12-07T12:57:53Z

@zhangyanzhao all comments and answers were handled. HLD should be merged. Can you please assist?

qiluo-msft · 2023-12-19T19:20:49Z

@a-barboza @madhupalu Do you have more concern? Could you explicitly approve PR if you are satisfying?

Yarden-Z · 2024-01-23T19:07:15Z

@a-barboza can you please approve this HLD?

a-barboza · 2024-01-25T22:33:11Z

@a-barboza can you please approve this HLD?

@Yarden-Z : Can you please check this submission? There are some issues which were deferred from the HLD to the code PR for details..

davidpil2002 · 2024-02-01T10:59:06Z

@a-barboza can you please approve this HLD?

@Yarden-Z : Can you please check this submission? There are some issues which were deferred from the HLD to the code PR for details..

We approved some name suggestions and some not.
Added a commit that aligns the name fixes done in the yang model to the yang model appended in the HLD.
no more name fixes are planned to be done.

@a-barboza
pls, can you approve this HLD PR?

zhangyanzhao · 2024-02-05T06:49:20Z

@a-barboza @madhupalu can you please help to review this PR and approve if no more concern? Thanks.

nmoray · 2024-02-06T11:18:21Z

doc/aaa/ldap/hld_ldap.md

+Hostcfgd – listen to changes in CONFIG_DB in the LDAP table, and when the table has a new modification/or init happens it will trigger a callback in hostcfgd handle in AAA class to modify the PAM & NSS configuration files in Linux.
+
+#### SSH/Local login
+After enabling the LDAP configuration the ssh/local login to the switch will be authenticated by the LDAP server.


I have one query related to the authentication. Is there a passkey used to locally authenticate an user against the centralised identity management system? Similar to TACACS and RADIUS?

yes - similat to tacacs/radius, you have a passkey to bind to the AAA server, and then, a user need to authenticate via the AAA server authentication defined in the AAA server.

liat-grozovik · 2024-02-12T13:58:11Z

@zhangyanzhao i think we need to close this HLD PR
that was review long time ago and comments were addressed. additional review feedback can be provided but should not hold the PR review nor the HLD approval flow. please help to close the loop

liat-grozovik · 2024-04-14T10:43:59Z

As not further comments or feedback , this PR is getting merge. Code PR should be reviewed and this feature should be included in 202405.

liat-grozovik · 2024-04-14T10:44:47Z

@davidpil2002 please go over the PRs, ensure they are aligned with the HLD and ask for review comments.
we have few more weeks to close 202405 and since this is under review for quite some time we dont want to miss 202405.

Why I did it To support LDAP feature - How I did it Similar to Radius/Tacacs authentication methods, the SONiC device is the LDAP client. Installed the Debian LDAP packages related to making SONiC able to function as an LDAP client. More description in the following HLD: sonic-net/SONiC#1487 - How to verify it Do LDAP configuration according to the HLD, then connect to the SONiC switch by using a user that exists in your LDAP server.

- What I did Add LDAP CLI - How I did it created the CLI by using YANG model generator, the YANG model can be found in the LDAP HLD: sonic-net/SONiC#1487 - How to verify it Manually: you can use configurations command like"config ldap global " or "show ldap global" (more examples in the HLD.) Auto: 1.There are unitest of each policy including good & bad flow in this commit, that should pass.

davidpil2002 force-pushed the dev-ldap-hld branch 3 times, most recently from 5d8e620 to c411de6 Compare October 2, 2023 08:49

Add LDAP HLD

01fac15

davidpil2002 force-pushed the dev-ldap-hld branch from c411de6 to 01fac15 Compare October 2, 2023 09:06

andriydnvd added 2 commits October 2, 2023 13:38

Add ldap yang model

a70b5f6

Add unit test and remove not needed parts

202eebf

andriydnvd force-pushed the dev-ldap-hld branch from 9027192 to 202eebf Compare October 2, 2023 14:14

Add LDAP intro image, and remove duplicate sentences

26d02bc

andriydnvd force-pushed the dev-ldap-hld branch from 8d5e327 to 0e13192 Compare October 3, 2023 14:58

Add cli

eb77e53

andriydnvd force-pushed the dev-ldap-hld branch from 0e13192 to eb77e53 Compare October 3, 2023 14:59

madhupalu reviewed Oct 3, 2023

View reviewed changes

doc/aaa/ldap/hld_ldap.md Show resolved Hide resolved

madhupalu reviewed Oct 4, 2023

View reviewed changes

ldap: fix LDAP attributes names

25d4cda

a-barboza reviewed Oct 20, 2023

View reviewed changes

davidpil2002 force-pushed the dev-ldap-hld branch 2 times, most recently from 0e68b6d to 094b958 Compare October 22, 2023 13:04

ldap: Fix yang model according the nslcd naming and functionalities t…

e15f32a

…hat supported and tested. (more feature can be added in the future if required)

davidpil2002 force-pushed the dev-ldap-hld branch from 094b958 to e15f32a Compare October 22, 2023 13:11

davidpil2002 mentioned this pull request Oct 24, 2023

Add LDAP feature support sonic-net/sonic-buildimage#16969

Merged

11 tasks

ldap: fix LDAP attributes

b1d1c4d

This was referenced Oct 26, 2023

Add LDAP feature CLI support sonic-net/sonic-utilities#3022

Merged

Add LDAP feature support sonic-net/sonic-host-services#80

Merged

ldap: fix names in yang model

7228a54

davidpil2002 force-pushed the dev-ldap-hld branch from 26aa994 to 7228a54 Compare February 1, 2024 11:05

nmoray reviewed Feb 6, 2024

View reviewed changes

madhupalu approved these changes Feb 7, 2024

View reviewed changes

liat-grozovik approved these changes Apr 14, 2024

View reviewed changes

liat-grozovik merged commit e888d97 into sonic-net:master Apr 14, 2024
1 check passed

liat-grozovik assigned davidpil2002 Apr 17, 2024

liat-grozovik mentioned this pull request Apr 25, 2024

LDAP support #1387

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add LDAP HLD #1487

Add LDAP HLD #1487

davidpil2002 commented Sep 27, 2023 •

edited by liat-grozovik

Loading

zhangyanzhao commented Oct 3, 2023

madhupalu Oct 4, 2023

davidpil2002 Oct 19, 2023

madhupalu Oct 4, 2023

davidpil2002 Oct 12, 2023

madhupalu Oct 4, 2023

davidpil2002 Oct 12, 2023

madhupalu Oct 4, 2023

davidpil2002 Oct 12, 2023 •

edited

Loading

davidpil2002 commented Oct 19, 2023

a-barboza Oct 20, 2023

davidpil2002 Oct 22, 2023 •

edited

Loading

davidpil2002 commented Oct 23, 2023 •

edited

Loading

liat-grozovik commented Dec 7, 2023

qiluo-msft commented Dec 19, 2023

Yarden-Z commented Jan 23, 2024

a-barboza commented Jan 25, 2024

davidpil2002 commented Feb 1, 2024 •

edited

Loading

zhangyanzhao commented Feb 5, 2024

nmoray Feb 6, 2024 •

edited

Loading

davidpil2002 Feb 12, 2024

liat-grozovik commented Feb 12, 2024

liat-grozovik commented Apr 14, 2024

liat-grozovik commented Apr 14, 2024

		Authentication failed – user will not be able to connect like regular authentication fail.

		### Restrictions/Limitations

Add LDAP HLD #1487

Add LDAP HLD #1487

Conversation

davidpil2002 commented Sep 27, 2023 • edited by liat-grozovik Loading

zhangyanzhao commented Oct 3, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

davidpil2002 Oct 12, 2023 • edited Loading

Choose a reason for hiding this comment

davidpil2002 commented Oct 19, 2023

Choose a reason for hiding this comment

davidpil2002 Oct 22, 2023 • edited Loading

Choose a reason for hiding this comment

davidpil2002 commented Oct 23, 2023 • edited Loading

liat-grozovik commented Dec 7, 2023

qiluo-msft commented Dec 19, 2023

Yarden-Z commented Jan 23, 2024

a-barboza commented Jan 25, 2024

davidpil2002 commented Feb 1, 2024 • edited Loading

zhangyanzhao commented Feb 5, 2024

nmoray Feb 6, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liat-grozovik commented Feb 12, 2024

liat-grozovik commented Apr 14, 2024

liat-grozovik commented Apr 14, 2024

davidpil2002 commented Sep 27, 2023 •

edited by liat-grozovik

Loading

davidpil2002 Oct 12, 2023 •

edited

Loading

davidpil2002 Oct 22, 2023 •

edited

Loading

davidpil2002 commented Oct 23, 2023 •

edited

Loading

davidpil2002 commented Feb 1, 2024 •

edited

Loading

nmoray Feb 6, 2024 •

edited

Loading