Rejected LDAP/Active Directory Authentication - Replaced with SSO

[James Gauci]

Hi All,

I am a prospective customer of 3CX for a team of 200 clients across a WAN, however one area that is essential for us is LDAP/Active directory authentication of users.

While I see that LDAP integration is available for the web meeting system, the contact component of 3CX has is own seperate credentials database.

Passwords can be revealed in clear text which I agree is a handy feature for some but a security concern in our environment.

Furthermore, it means we need to manage two seperate directory username/password systems which is time consuming.

Other competitive solutions have this functionality by default, however if this issue was resolved for us, we would jump onto 3CX tomorrow.

 

[m.jeu]

Hi,

thank you for the reply. This does not work for us as we have about 40-50% non-Windows user. Even if we would store the username and password in a password manager, that will not meet our compliance policy plus as there is still no central user management.

Best,
M.Jeu

 

[Smartnet]

+1

 

[VoIPTools]

After further reflection, I don't need to keep the 3CX credentials locally. The assumption is that the user has already successfully authenticated to AD/LDAP since they are now logged into the computer. Therefore, all I need is the username. With the username, I can get the 3CX credentials and log you into 3CX.

If you are also looking to synchronize the users password in AD/LDAP with the password in 3CX... that's a problem because the password in AD/LDAP is encrypted. I've looked into obtaining the password, and it is not possible without reducing the security of your AD/LDAP environment.

As you know, 3CX's security system is not based on AD/LDAP, but we can get you logged into both systems with a single sign-on.

 

[Samuele]

+1

 

[jbland]

This is a necessary feature in an enterprise system!

 

[MarioSan]

+1

 

[0xDECAFBAD]

Why is this not already implemented?

 

[GereMarie]

+1

 

[m.jeu]

*upvote*

 

[James Gauci]

3 years since originally posting. This feature request is now more important than ever.

 

[Andreas Conrad]

3CX sometimes is impossible to place for a project, because of this missing feature:

+1
a potential customer with 500+ extensions is strongly considering 3CX.
The project probably won´t go forward without a working LDAP or RADIUS auth or sync on linux 3CX

+1
LDAP contact sync was the second missing critical feature
https://www.3cx.com/community/threads/ldap-integration-as-phonebook.62900/page-2#post-347268

 

[Ricardo Duarte]

I was able to implement LDAP/AD authentication in 30 minutes. Just did simple authentication proxy that overrides webclient/api/login call. No changes to the 3CX code are even required. And users can login with extension + AD Password or username + AD Password. Or whatever you like. Even did a AD Password + 2FA token. Quite easily could use RADIUS instead.
Also did SAML/ADFS with a similar (but slightly different) approach.

If a regular guy like me can do it in 30 minutes I can't understand why 3CX can't in 3 years.

 

[Quentin D]

I was able to implement LDAP/AD authentication in 30 minutes. Just did simple authentication proxy that overrides webclient/api/login call. No changes to the 3CX code are even required. And users can login with extension + AD Password or username + AD Password. Or whatever you like. Even did a AD Password + 2FA token. Quite easily could use RADIUS instead.
Also did SAML/ADFS with a similar (but slightly different) approach.

If a regular guy like me can do it in 30 minutes I can't understand why 3CX can't in 3 years.

Hi Ricardo,

Could you explain how you managed to do that ?

Thank you

 

[Ricardo Duarte]

Sure.
* Divert 3CX /webclient/api/login URL to your own web server (either reverse proxy or use the proxy directive with nginx conf).
* Then on your web server validate username and password with AD/LDAP. The json you receive has the real username and password the user entered on the form. To validate, try to bind against the LDAP with the credentials, for example. (If you want RADIUS, just query RADIUS instead. Want 2FA? Ask users to login with password+mfa_code and then split them on your code and send password to LDAP and mfa_code to your RADIUS server).
* If it succeeds, query the 3CX SQL database and get the extension username and password
* Call the real /webclient/api/login with the extension username and password you got from the SQL query
* Return the cookies to the client

You will need to build the web server with your authentication logic (or maybe license it from me ). It's quite easy if you know how to use python or ruby on rails.

There are some small additional details to keep blacklist working, etc, but basically you can do it like this.
Similar, you can also do the same for SAML. Instead of validate the username and password with LDAP, you just validate the SAML assertion. If it is valid, query the SQL database, post a login to the real login endpoint and return the cookies.

This, of course, only works for webclient.
But it is sufficient for my use case. Users login to the webclient with their LDAP/AD username and password, and then provision their apps using the QR code or do Resend Credentials.

I also did some LDAP/AD sync that creates and updates the extensions with LDAP/AD data, by using the undocumented API the web management console uses.

 

[rc179]

+1 for this.
LDAP would also get us 2FA by using DUO's LDAP Proxy, i'm using it on other systems. The system queries the DUO LDAP Proxy server, this contacts the DUO system to handle the 2FA and passes the LDAP on to my LDAP server. Once the user is authenticated via the LDAP and the DUO 2FA is confirmed, the user is permited access.

3CX gets 2FA and LDAP, but only needs to develop LDAP

 

[JasonCimtel]

+1

 

[DFP]

+1

 

[Clark-Ritchotte]

We ended up having our clients and employees use Microsoft App Registration, Seeing we are all using AzureAD/ AzureHybridAD we can have Microsoft provide 2FA and have it handle auto-login into 3CX.

Basically, you would create an insane password on the account in 3CX, then store the creds in the app configuration for each user in AzureAD. The End user just clicks 3CX in their app portal and it completes the login for them without any interaction with the login screen using the My Sign-in Browser Extension.

 

[FMTelecom]

We received another request from a client for this. Please add this feature soon.

 

[N_G]

We will have SSO for Microsoft and Google in v18