Account bypassing group requirement

All,

Twice now, we've run across a situation where a compromised alumnus account has been able to log in through our proxy server despite not actually belonging to any of the required Active Directory groups.

Our user.txt currently looks like this (slightly edited to remove sensitive details):

::LDAP
BindUser [email protected]
BindPassword -Obscure REDACTED
DisableReferralChasing
URL ldaps://ad.example.edu/OU=Users1,DC=ad,DC=example,DC=edu?sAMAccountName?sub?(objectClass=person)

# If the password was wrong or authentication failed for any reason, bail.
IfUnauthenticated; Stop

# Everybody belongs to the group General
Group General

# Sort people into groups.
# Faculty.
IfMember CN=SYS_Faculty,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Faculty

# Staff, including affiliated users (and off-campus affiliates),
IfMember CN=SYS_Staff,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Staff
IfMember CN=SYS_Affiliate,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Staff

# Students.
IfMember CN=SYS_Students,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Students

/LDAP

Later, in config.txt, all of the database stanzas are behind a line like this:

Group Faculty+Staff+Students

You have to be a member of one of the EZ Proxy groups "Students", "Faculty" or "Staff" to get into the databases.  Membership in those is dependent on the Active Directory groups SYS_Faculty, SYS_Staff, SYS_Affiliate, and SYS_Students.

Most of the time that works just fine. The campus identity management team has programs and processes that automatically add/remove people from the Active Directory groups based on whether they're currently enrolled/employed/affiliated, and all is well.

But twice this year we've had an account that was deactivated in Active Directory continue working.  We really don't know why.  The accounts were created legitimately; they're both alumni.  The accounts still exist, but they're not in any of the required groups any more.  By all rights, EZ Proxy should deny them access.  But it didn't.  Everything looks correct on the Active Directory side of things.

Anyone have any idea what's going on, or what we should do to diagnose the problem?

Will Martin

Head of Digital Initiatives, Systems and Services
Chester Fritz Library
University of North Dakota

P: 701.777.4638




********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].