WaykDen User/Computer management question
Hello,
I've installed WaykDen without much of an issue (only suggestion I have is to also add the default login credentials to the regular guide and not only in he argo tunnel guide, since I couldn't find this at first).
Now I'm trying to understand how the product should be "used" from a management perspective.
I configured LDAP with our internal AD using the example string
Set-WaykDenConfig -LdapServerType ActiveDirectory -LdapUsername ldap-user@contoso.local -LdapPassword ldap-password -LdapServerUrl ldap://ipaddress -LdapUserGroup 'Domain Users'
After this, I restarted the WaykDen service.
However I'm unable to log on to the website using my AD credential
Neither UPN, samaccountname, contoso\samaccountname work.
p.s.: There is no device such as a firewall of windows firewall blocking the traffic from the WaykDen to the DC.
Hopefully these questions are easy to answer:
- Is there any more documentation in regards to setting up and troubleshooting LDAP authentication?
- On the topic of authentication, any plans for identity federation with SAML 2.0? Or RADIUS. Either of these options will make it easy to support in place multi factor authentication methods.
- If I create a local user in WaykDen, I can log on to the website with it, but immediately presented with a forbidden message, is this normal?
- I get that same forbidden message, if I change the user permission from reader to machine contributor: what are these two roles supposed to be?
- What are the Machine groups for? I for example created a goup and assigned the local normal user to it, but that user account is still not able to see anything from the dashboard.
- If I assign a computer to a machine group, it is still only listed in the top level "Machines" section. I also can't see which group a computer belongs to (I think..)?
Right now, I really don't see the use of user accounts in WaykDen. Is there anymore documentation on the product itself instead of just the GitHub stuff?
Kind regards,
Stephan Schwarz
Security Administrator - Leiden University Medical Center
All Comments (1)
Hi Stephan,
To help diagnose this issue, you can extract the following logs and send them to wayk@devolutions.net (the credentials are not logged, don't worry):
docker logs den-server > den-server.txt docker logs den-lucid > den-lucid.txt
There is currently no more documentation on how to troubleshoot LDAP authentication, but we are in the process of making it configurable through the Web UI rather than the cmdlet, as it is rather cumbersome to configure and test this way. The LDAP documentation also needs a refresh with more guidance, I agree. Active Directory integration should require LDAPS, as we do not support the LDAP signing + encryption that is now enforced by default in Windows Server. LDAPS is more secure, so this is all for the best, but we should at least say that LDAP (not LDAPS) is unlikely to work now.
Here is an excellent guide on LDAPS:
https://astrix.co.uk/news/2020/1/31/how-to-set-up-secure-ldap-for-active-directory
I suggest you start by disabling certificate validation to make sure that it works (-LdapCertificateValidation $false), and then enforce certificate validation in a second time. The LdapServerUrl needs to use the same hostname as the common name shown in the certificate, and your Active Directory root CA certificate needs to be imported with the Import-WaykLdapCertificate command for the certificate trusted.
If you create a user in Wayk Den, you need to add them to the "Reader" role. It is a drop down, but you need to click the '+' sign to add the role assignment on the user, otherwise nothing is modified. The "Reader" role allows a user to log in to Wayk Den and see most things but not modify anything, this is the basic role we came up with at this point for unprivileged users.
As for the "Machine Contributor" role, it is necessary to make modifications to the list of registered machines. This is why you need to assign this role to users who will register their machines for unattended access, but we plan on making this process much simpler in the future.
There is no other documentation that what can be found on GitHub, we try to improve it as we go. Feel free to open tickets on GitHub for missing pieces of documentation to remind us of things that require clarification.
Regarding identity federation, it is on our roadmap, but we have no timeline for it yet. This is how we plan to get MFA supported, instead of implementing MFA directly in Wayk Den. Our initial plan is to support OAuth federation with services like Office 365 or other standard OAuth services. I see you mention SAML 2.0 and RADIUS, but is OAuth federation a possibility in your case?
Best regards,
Marc-André Moreau