Since version 2.6, there has been a problem with self-service filtering and AD groups

tux · January 20, 2025 - 09:21

Hello,

since upgrading to version 2.6, we've been experiencing a packet filtering issue in the self-service interface.
We have a self-service configuration package that defines filters based on the user's Active Directory (AD) group membership.
For some groups, the applications no longer appear in the self-service interface.
I've checked, and the setting is the same in both the AD configuration and the configuration package.

Server: Debian 12, Wapt Enterprise 2.6.0.16795.
Client: Windows 10

January 20, 2025 - 10:11

Hello,

could you please specify your authentication method for the self-service portal?

Do you have an Active Directory forest? Could you please specify your "service_auth_type" in wapt-get.ini?

tux · January 20, 2025 - 11:43

Hello,

WAPT is linked to our Active Directory domain and performs SSO at the self-service level.
Kerberos is configured on the server.
Clients are configured with the following parameter:
`service_auth_type=waptserver-ldap`

January 20, 2025 - 12:01

If I understand correctly, the problem is not systematic but only affects certain groups?

tux · January 20, 2025 - 1:04 PM

That's right.

I put some software in the "Domain Users" group => everyone can see it.
Software put in other groups isn't visible.

For example, I have a "Systems_information" group, and the software isn't displayed to users who are part of that group.

January 20, 2025 - 1:42 PM

Do you have commas in your users' DNS records?

We recently released a patch for this, but it's not yet live.

On the server, you can run:

/opt/wapt/waptserver/scripts/testing-ldap-connectivity.sh

to check the result.

tux · January 20, 2025 - 4:00 PM

I ran the script, it tells me that the user is not part of the group even though they are.

{'success': True, 'groups' : [], 'error': False, 'msg': ''}

Yes, there are commas in the Distinguished Name (DN).

January 20, 2025 - 4:27 PM

Okay, this is a problem identified last week in the current version.

If there's a comma in the user's DN, it doesn't work...

We need to release a new version with the fix. I'll write here when it's done.

tux · February 5, 2025 - 10:18

Hello,

I see that a new version has been released: 2.6.0.16881.
Does it include the fix?

February 5, 2025 - 12:30

Hi Sébastien,

yes, it's in this release. However, I advise you to wait until tomorrow; we should have a new release today or tomorrow with several fixes, including a problem with the registration loop if the local machine name is different from its AD samAccountName, which is quite common under Linux (shortnames in /etc/hostname are longer than 15 characters, with samAccountName being the truncated 15-character version...).

Best regards,

Denis