TrueNAS CORE authentication using Google Workspace Secure LDAP

[chrisnavigation]

Hello all,

I'd like to be able to have people access SMB shares to use their Google Workspace user name (email address) and password.

We have Google Workspace Enterprise license level, which include Google Secure LDAP.

I have a created a new LDAP client entry in Google Workspace admin console for TrueNAS, and I am provided with the following:

1. Certificate with CRT and KEY file
2. User name and password

I believe the Google Secure LDAP endpoint is: ldap.google.com

How can I configure TrueNAS with the above have users authenticate?

Thanks!

 

[anodos]

Hello all,

I'd like to be able to have people access SMB shares to use their Google Workspace user name (email address) and password.

We have Google Workspace Enterprise license level, which include Google Secure LDAP.

I have a created a new LDAP client entry in Google Workspace admin console for TrueNAS, and I am provided with the following:

1. Certificate with CRT and KEY file
2. User name and password

I believe the Google Secure LDAP endpoint is: ldap.google.com

How can I configure TrueNAS with the above have users authenticate?

Thanks!

The SMB protocol has a limited set of options available for client authentication. For all practical purposes they are:
1. NTLM
2. Kerberos

There is a legacy and insecure way of storing NT hashes in the remote LDAP server, and granting the SMB server access to them (Samba schema). This allows (1) through LDAP server. (2) requires a Kerberos realm in addition to the LDAP server. Note that configuring windows to talk to a non-AD kerberos realm can be somewhat involved from an admin perspective.

TL;DR, if you want to use SMB, it's better generally to use AD (either Microsoft or Samba).

 

[chrisnavigation]

The SMB protocol has a limited set of options available for client authentication. For all practical purposes they are:
1. NTLM
2. Kerberos

There is a legacy and insecure way of storing NT hashes in the remote LDAP server, and granting the SMB server access to them (Samba schema). This allows (1) through LDAP server. (2) requires a Kerberos realm in addition to the LDAP server. Note that configuring windows to talk to a non-AD kerberos realm can be somewhat involved from an admin perspective.

TL;DR, if you want to use SMB, it's better generally to use AD (either Microsoft or Samba).

Thanks for the information.

In our case we would like to authenticate to Google Secure LDAP and move away from Microsoft Active Directory to enable a modern cloud based (internet accessibility) auth strategy that avoids VPN's and DC being available.

In regards to the certificate that Google Secure LDAP generates (CERT and KEY files), how can I import this into TrueNAS?

When I go to "System > CAs > Add" the change the "Type" to "Import CA", how can I paste in the "Certificate Subject > Certificate" from either of the two files Google Secure LDAP generated?