secure LDAP on macos

[jhaff]

is anyone using google's secure LDAP for macOS authentication?  i'm trying to make a decision for our upcoming summer deployment, but have concerns about deployment and potential stability...

google's solution offers a python script to deploy the directory settings which poses the deployment problem - apple has announced the sunset of built in python, and with it, the objective-c bridge that their deployment script utilizes.  i'm working on migrating their script to swift, but am not a swift programmer...

i'm also on the fence about the lack of vetting and testing and dealing with potential (and widespread) issues when apple changes things... i.e. apple broke kerberos for anyone using their own AD directory plug-in preventing user logins/authentication after installing their last 10.14/15 security update.  luckily, the AD user base is expansive and a fix was published quickly.  

any feedback is appreciated.

[JeromeMartevill]

Hello, 

I'm trying to configure it to put it on our laptops.

the query via ldapsearch works but the network account server remains in red

I found some articles about connections between MacOS and Google LDAP:
https://forums.macrumors.com/threads/connecting-mac-to-google-ldap.2233562/

[Bsloane]

Did you ever find a solution for this? 12.3 has removed Python and I have not been able to get the Google script to run after installing Python 3 and pyobjc.

[flebec · Accepted solution]

You can use macadmin Python3 framework. 

https://github.com/macadmins/python/releases/tag/v3.9.10.02082022223633

- Modify shebang in Google python script to use python3

#/usr/local/bin/managed_python3

- Change path on postinstall script to use python3

I believe pyobj is one of the common libraries already prebuilt in that python3 framework.

That should work on 12.3 (for now).

[jhaff]

for now... i did get a swift script working, but you need to bundle the script and the resources into an application.  if you want to run the script outright you'd need to download and install the xcode command line tools.  using @flebec 's suggestion of macadmin's python is probably the way to go.  we package their python into our deployments for a number of other things, such as outset.

[JeromeMartevill]

It doesn't work at all. 

My configuration can't access to ldap server 😕 

[jhaff]

We've been using the ldap connection successfully for almost a year now on different mass deployments, it works well.  I would double and triple check that your following Google's instructions to a T.  

[FluxSine]

Google Ldap works with Monterey up to the Deployable phase. When you try to use the python script using managed_python3 we end up with

"line 17, in <module>
request.appendData_(NSData.dataWithBytes_length_(CONFIG, len(CONFIG)))
TypeError: Expecting byte-buffer, got str"

Even trying "sudo python3 -m pip install pyobjc-framework-opendirectory" still same issue. Any thoughts? 

[FluxSine]

Here is the script that we are trying to run. Any ideas or help would be greatly appreciated.

#!/usr/bin/managed_python3
from OpenDirectory import ODNode, ODSession, kODNodeTypeConfigure
from Foundation import NSMutableData, NSData

import os
import sys

# Reading plist
GOOGLELDAPCONFIGFILE = open(sys.argv[1], "r")
CONFIG = GOOGLELDAPCONFIGFILE.read()
GOOGLELDAPCONFIGFILE.close()

# Write the plist
od_session = ODSession.defaultSession()
od_conf_node, err = ODNode.nodeWithSession_type_error_(od_session, kODNodeTypeConfigure, None)
request = NSMutableData.dataWithBytes_length_(b'\x00'*32, 32)
request.appendData_(NSData.dataWithBytes_length_(CONFIG, len(CONFIG)))
response, err = od_conf_node.customCall_sendData_error_(99991, request, None)

# Edit the default search path and append the new node to allow for login
os.system("dscl -q localhost -append /Search CSPSearchPath /LDAPv3/ldap.google.com")
os.system("bash -c 'echo -e \"TLS_IDENTITY\tLDAP Client\" >> /etc/openldap/ldap.conf' ")

[FluxSine]

Was able to fix it by using this:

request.appendData_(NSData.dataWithBytes_length_(str.encode(CONFIG), len(CONFIG)))

[Kirubakaran]

Hey @jhaff 

Glad to know that you've been able to made Google Secure LDAP connection successfully on your deployments. 
Here's my situation: I was able to connect our Mac devices with Google's Secure LDAP and able to login to network account (Google credential at the Mac login) but when I created a mobile user account for the same network user I cannot login at the Mac login screen at all. Is there anything you can guide? 

I followed the same instructions in this page 

[BrianNader]

I'm completely stuck after setting up the LDAP Client and importing and configuring the cert on the Mac.  I can query LDAP and poll the target user to be provisioned on the Mac.  All valid LDAP queries to ldap.google.com work for my domain, it even picks up user directory data like phone number etc.  When I reboot and move to the sign-in screen to login as the tested LDAP user, I get the red dot and Network accounts are unavailable.  What am I missing?  If the queries work, what else is there?  I'm running 14.2.1 on a fresh MacBook.

[FluxSine]

Working for Monterey as of 10/03/2022:
Working on Ventura as of 04/23/2023
Working on Sonoma 14.2.1 01/25/2024

Step 1: From OSX Terminal type in Python3 (it should ask to install xcode, agree and install)
Step 2: after x code finished visit: https://github.com/macadmins/python and install the latest macadamin python (have to use since apple broke their version around Monterey)
Step 3: from terminal run sudo pip3 install --upgrade pip 
Step 4: from terminal run sudo pip3 install pyobjc-framework-SystemConfiguration
Step 5: from terminal run sudo pip3 install --upgrade pyobjc-framework-SystemConfiguration
Step 6: copy the files you got from google the certificate and what not should be 3 files (ldap.google.com.plist, Ldap_pythong_config.py, and your cert somename.mobileconfig) to the desktop or location you want.
Step 7: from terminal navigate to the directory you put them in.
Step 8: run this from terminal in the folder they are in sudo managed_python3 Ldap_pythong_config.py ldap.google.com.plist
*May need to use: /usr/local/bin/managed_python3 Ldap_python_config.py ldap.google.com.plist
Step 9: from finder go to the Deployable folder and double click on WCOSXLDAP (name.mobileconfig)
Step 10: open System preferences and go to Profiles (Lower Right Corner)
Step 11: install and authenticate certificate
Step 12: go to Users & Groups(lock screen) and click on Login Options, push unlock and change Display login window to Name and password:
Step 12:  reboot (should now be able to login with Google Credentials)

*setup a lock screen message to help inform users how to logon as well as setup startup and shutdown schedule. Use the message below:

Login using your email address (without “@domain.org”) & password. Example: bob@domain.org you would use only bob as the username.

*Make sure there are no spaces before your username.

[FluxSine]

Here is what our .py file looks like with the modified line 17:

#!/usr/bin/managed_python3
from OpenDirectory import ODNode, ODSession, kODNodeTypeConfigure
from Foundation import NSMutableData, NSData

import os
import sys

# Reading plist
GOOGLELDAPCONFIGFILE = open(sys.argv[1], "r")
CONFIG = GOOGLELDAPCONFIGFILE.read()
GOOGLELDAPCONFIGFILE.close()

# Write the plist
od_session = ODSession.defaultSession()
od_conf_node, err = ODNode.nodeWithSession_type_error_(od_session, kODNodeTypeConfigure, None)
request = NSMutableData.dataWithBytes_length_(b'\x00'*32, 32)
request.appendData_(NSData.dataWithBytes_length_(str.encode(CONFIG), len(CONFIG)))
response, err = od_conf_node.customCall_sendData_error_(99991, request, None)

# Edit the default search path and append the new node to allow for login
os.system("dscl -q localhost -append /Search CSPSearchPath /LDAPv3/ldap.google.com")
os.system("bash -c 'echo -e \"TLS_IDENTITY\tLDAP Client\" >> /etc/openldap/ldap.conf' ")

[cmarengere]

Hi FluxSine,

Work find the problem I have is when a LDAP user locks the screen he can't unlock it.

Thanks

[FluxSine]

Are you using Sonoma? if so its a apple bug and annoying. The user needs to press the Command, Option, and Return keys simultaneously

Then they can login as normal. Alternatively we have setup autologoff after 15 minutes so instead of letting them have a lock screen to avoid this issue on Sonoma. If you find an alternate solution let me know. Really wish Apple would address the bug.