Connectrix MDS: Incorrect Role Is Assigned to The LDAP User
Summary: This article explains an issue where LDAP users on Connectrix MDS switches are assigned to an incorrect role due to improperly interpreted role attributes from Active Directory.
Symptoms
After configuring the remote AAA on the MDS switches, the LDAP user can log in but the incorrect role is assigned.
The LDAP user has been configured with "shell:roles=network-admin" in the "Description" on the AD server, and the search map has been correctly specified.
It is expected that the user is assigned the "network-admin" role, but the 'show user-account' returns "network-operator" role.
Cause
Enable LDAP debug on the switch, and the AD server did not return "network-admin" correctly for the search, although in the UI of the AD user, it is set to "network-admin."
2017 Feb 9 15:17:09.938288 ldap: ldap_handle_user_role_search_rsp: entering for user <ldap user> 2017 Feb 9 15:17:09.938435 ldap: ldap_handle_user_role_search_rsp: (user jleung0) DN CN=<ldap user>,OU=<example.com> 2017 Feb 9 15:17:09.938562 ldap: attribute: description 2017 Feb 9 15:17:09.938686 ldap: value: shell:roles="network 210\222admin" 2017 Feb 9 15:17:09.938719 ldap: retrieve_user_profile: vsa_string: shell:roles="network 210\222admin" 2017 Feb 9 15:17:09.938757 ldap: retrieve_user_profile: protocol shell 2017 Feb 9 15:17:09.938788 ldap: retrieve_user_profile: attribute roles 2017 Feb 9 15:17:09.938812 ldap: extract_value: vsa_string: "network 210\222admin" 2017 Feb 9 15:17:09.938834 ldap: extract_value: after quote found, vsa_string: 2017 Feb 9 15:17:09.938854 ldap: retrieve_user_profile: extracted role value:network 210\222admin: 2017 Feb 9 15:17:09.938888 ldap: extract_user_roles:Role Group string : shell:roles="network 210\222admin 2017 Feb 9 15:17:09.938931 ldap: extract_user_roles: user roles : empty
Since there is no matching role name "network 210\222admin" in the switch, the switch assigns "network-operator" role to the user.
Copy the " " from the AD server and convert it to binary, the value is 11100010 10001000 10010010.
For the normal dash "-," the binary value is 00101101.
Resolution
Manually enter the following in the AD server with "English - US Keyboard."
shell:roles=network-admin
Additional Information
It is always recommended to manually enter "network-admin" in the AD server with "English - US Keyboard," instead of a copy and paste, or entering the value with other language or keyboard mode.