hi all,

I've tried to configure OpenVPN user auth with LDAP pointing to Active Directory Domain Controller.

yes, I know, there are some articles that this doesn't work, AD not supported and so on, suggesting to install the Windows version of openLDAP....

as I have some other software products communicating fine with AD using LDAP protocol, I've started packet capturing on domain controller to see what is happening.

as a baseline I'll take the LDAP user auth dialog of Zabbix (monitoring tool):

Zabbix <--> AD DC:
--> bindRequest with bind user(*) and simple auth
<-- bindResponse: success
--> searchRequest with baseObject(**), scope=wholeSubtree and filter="(sAMAccountName=<my name>)
<-- searchResEntry - success (1 result) << returning DN of my account
--> bindRequest with user to be auth and simple auth << try to bind with my account
<-- bindResponse: success << my credentials are confirmed, I'm logged in
--> unbindRequest << close the dialog...

and now auth dialog between router and domain controller:

ER605 <--> AD DC:
--> bindRequest with bind user(*) and simple auth
<-- bindResponse: success
--> searchRequest with baseObject(**), scope=wholeSubtree and filter="(sAMAccountName=<my name>)
<-- searchResEntry - success (1 result) << returning DN of my account
--> unbindRequest << close the dialog...

(*) bind user is called "Regular DN" at Controller

(*) baseObject is called "Base Distinguished Name" at the Omada Controller

as I can see, the router doesn't even try to verify my password using bindRequest and just reports back to the OpenVPN client, that the password is incorrect.......

is this a bug or am I missing something?