Re: Account bypassing group requirement

Hi Willl.

You do not have a check which prevents login if the password succeeds but the user is none of "Students", "Faculty" or "Staff". I have added lines below which I believe will work for you.

I am assuming that the same user may be student and staff and perhaps also affiliate or faculty at the same time.

IfUnauthenticated; Stop
Group General
# Faculty.
IfMember CN=SYS_Faculty,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Faculty
# Staff, including affiliated users (and off-campus affiliates),
IfMember CN=SYS_Staff,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Staff
IfMember CN=SYS_Affiliate,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Staff
# Students.
IfMember CN=SYS_Students,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Students

# stop processing if any of the authorised groups has been assigned
IfMember CN=SYS_Faculty,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; STOP
IfMember CN=SYS_Staff,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; STOP
IfMember CN=SYS_Affiliate,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; STOP
IfMember CN=SYS_Students,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; STOP
# no gropus assigned, so no access to the requested resource
Deny logup.htm
/LDAP
​# unauthenticated
Deny loginbu.htm
​
In my ezproxy setup I have a logup.htm page which says you are not authorised to access this page, and an loginbu.htm page which says your login failed.

Best,

Laszlo.


Laszlo Gercsov

Senior Systems Analyst Library Systems

Library  |  Level 4
16 Macquarie Drive
Macquarie University, NSW 2109, Australia

T: +61 2 9850 6533 | F: +61 2 9850 7568

M: + 61 402 175 101  |  mq.edu.au/library<http://mq.edu.au/>

[Macquarie University]<http://mq.edu.au/>

CRICOS Provider Number 00002J. Think before you print.
Please consider the environment before printing this email.

This message is intended for the addressee named and may
contain confidential information. If you are not the intended
recipient, please delete it and notify the sender. Views expressed
in this message are those of the individual sender, and are not
necessarily the views of Macquarie University

________________________________
From: EZproxy List <[email protected]> on behalf of Martin, Will <[email protected]>
Sent: Tuesday, 5 November 2019 7:51 AM
To: [email protected] <[email protected]>
Subject: [EZPROXY-L] Account bypassing group requirement


All,



Twice now, we’ve run across a situation where a compromised alumnus account has been able to log in through our proxy server despite not actually belonging to any of the required Active Directory groups.



Our user.txt currently looks like this (slightly edited to remove sensitive details):



::LDAP

BindUser [email protected]

BindPassword -Obscure REDACTED

DisableReferralChasing

URL ldaps://ad.example.edu/OU=Users1,DC=ad,DC=example,DC=edu?sAMAccountName?sub?(objectClass=person)<https://protect-au.mimecast.com/s/E151CmO5wZsAg971uG6smA>



# If the password was wrong or authentication failed for any reason, bail.

IfUnauthenticated; Stop



# Everybody belongs to the group General

Group General



# Sort people into groups.

# Faculty.

IfMember CN=SYS_Faculty,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Faculty



# Staff, including affiliated users (and off-campus affiliates),

IfMember CN=SYS_Staff,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Staff

IfMember CN=SYS_Affiliate,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Staff



# Students.

IfMember CN=SYS_Students,OU=Groups,OU=Users1,DC=ad,DC=example,DC=edu; Group +Students



/LDAP



Later, in config.txt, all of the database stanzas are behind a line like this:



Group Faculty+Staff+Students



You have to be a member of one of the EZ Proxy groups "Students", "Faculty" or "Staff" to get into the databases.  Membership in those is dependent on the Active Directory groups SYS_Faculty, SYS_Staff, SYS_Affiliate, and SYS_Students.



Most of the time that works just fine. The campus identity management team has programs and processes that automatically add/remove people from the Active Directory groups based on whether they're currently enrolled/employed/affiliated, and all is well.



But twice this year we've had an account that was deactivated in Active Directory continue working.  We really don't know why.  The accounts were created legitimately; they're both alumni.  The accounts still exist, but they're not in any of the required groups any more.  By all rights, EZ Proxy should deny them access.  But it didn't.  Everything looks correct on the Active Directory side of things.



Anyone have any idea what's going on, or what we should do to diagnose the problem?



Will Martin



Head of Digital Initiatives, Systems and Services

Chester Fritz Library

University of North Dakota



P: 701.777.4638





________________________________

To unsubscribe from the EZPROXY-L list, click the following link:
http://listserv.oclclists.org/scripts/wa.exe?SUBED1=EZPROXY-L&A=1<https://protect-au.mimecast.com/s/JlNOCoV1Y2SBgQ1lhVe3XS?domain=listserv.oclclists.org>

********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].