Connecting to multiple AD servers

[sea2space]

Hello!

Is it possible to connect tac_plus-ng to different AD servers (and different domains)?
So when connecting to a network device, the user is checked for presence in both AD servers.

My config now:

        user backend = mavis
        pap backend = mavis
        login backend = mavis chpass

        mavis module = groups {
        resolve gids = yes
        resolve gids attribute = TACMEMBER
        groups filter = "(AdminTSPD|ReadonlyTSPD)"
        memberof filter =  "(AdminTSPD|ReadonlyTSPD)"
        }

        mavis module = external {
                childs min = 4
                childs max = 64
                setenv LDAP_SERVER_TYPE = "microsoft"
                setenv LDAP_HOSTS = "192.192.192.1"
                setenv LDAP_SCOPE = sub
                setenv LDAP_BASE = "dc=test,dc=domain"
                setenv LDAP_FILTER = "(&(objectclass=user)(sAMAccountName=%s))"
                setenv LDAP_USER = "suim_tacacs@test.domain"
                setenv LDAP_PASSWD = "password"
                setenv USE_TLS = 0
                setenv UNLIMIT_AD_GROUP_MEMBERSHIP = 1
                setenv EXPAND_AD_GROUP_MEMBERSHIP = 0
                setenv AD_GROUP_PREFIX = ""
                setenv REQUIRE_TACACS_GROUP_PREFIX = 0
                #setenv FLAG_USE_MEMBEROF = 1
                exec = /usr/local/lib/mavis/mavis_tacplus-ng_ldap.pl
        }

[MarcJHuber]

Hi,

sure, the MAVIS modules are stackable and you can just add another "external" module to query a different server.

Cheers,

Marc

[sea2space]

@MarcJHuber Thx!

I.e. i need this in my config:

        mavis module = external {
                childs min = 4
                childs max = 64
                setenv LDAP_SERVER_TYPE = "microsoft"
                setenv LDAP_HOSTS = "192.192.192.1"
                setenv LDAP_SCOPE = sub
                setenv LDAP_BASE = "dc=test,dc=domain"
                setenv LDAP_FILTER = "(&(objectclass=user)(sAMAccountName=%s))"
                setenv LDAP_USER = "suim_tacacs@test.domain"
                setenv LDAP_PASSWD = "password"
                setenv USE_TLS = 0
                setenv UNLIMIT_AD_GROUP_MEMBERSHIP = 1
                setenv EXPAND_AD_GROUP_MEMBERSHIP = 0
                setenv AD_GROUP_PREFIX = ""
                setenv REQUIRE_TACACS_GROUP_PREFIX = 0
                #setenv FLAG_USE_MEMBEROF = 1
                exec = /usr/local/lib/mavis/mavis_tacplus-ng_ldap.pl
        }

        mavis module = external {
                childs min = 4
                childs max = 64
                setenv LDAP_SERVER_TYPE = "microsoft"
                setenv LDAP_HOSTS = "123.123.123.1"
                setenv LDAP_SCOPE = sub
                setenv LDAP_BASE = "dc=test2,dc=domain2"
                setenv LDAP_FILTER = "(&(objectclass=user)(sAMAccountName=%s))"
                setenv LDAP_USER = "suim_tacacs@test2.domain2"
                setenv LDAP_PASSWD = "password"
                setenv USE_TLS = 0
                setenv UNLIMIT_AD_GROUP_MEMBERSHIP = 1
                setenv EXPAND_AD_GROUP_MEMBERSHIP = 0
                setenv AD_GROUP_PREFIX = ""
                setenv REQUIRE_TACACS_GROUP_PREFIX = 0
                #setenv FLAG_USE_MEMBEROF = 1
                exec = /usr/local/lib/mavis/mavis_tacplus-ng_ldap.pl
        }

and now the user will be searched in two different domains (192.192.192.1, 123.123.123.1)?

[MarcJHuber]

Hi,

yes, exactly. That should work just fine.

Cheers,

Marc