GCP LDAP server for WiFi authentication

andres_fastweb

Hi,

I'm trying to set up an LDAP service in GCP that can authenticate the WiFi clients in our network. I plan later to use GCP Managed AD service as central identity repository but for now I'm happy just to have basic email/pwd authentication.

i've found a couple of guide on the Google Cloud LDAP application as part of Google Cloud Identity which seems quite straightforward but I want GCP connectivity and I haven't found any guides on this except LDAP Connector (at https://cloud.google.com/integration-connectors/docs/connectors/ldap/configure) that explains how to set up a LDAP server. However in this guide I don't see any IP addres that is set as the server IP so I have my doubts I am on the right track. Seems like it should be quite straightfoward.

If anyone can point me in the right direction I would truly appreciate it.

Cheers,

Andres

kensan

Hi @andres_fastweb,

Welcome to Google Cloud Community.

The LDAP connector acts as a client, enabling GCP services such as Cloud Functions or Application Integration to connect to an existing LDAP server. It is not an LDAP server itself.

You can do a workaround by deploying a traditional LDAP server in the Compute Engine. This gives you a full control and IP address that can point in your Wifi infrastructure.

Here’s a guide:

Create your VPC network.

This will be the network for your Compute Engine.

Create Compute Engine Instance.

In the Network interface: make sure the external IP(Ephemeral) is static IP. this will be used as a point IP for your Wifi network.

Configure VPC Firewall.

Create a firewall that will deny all traffic except LDAP port (Port 389)

Install and Configure your LDAP server software on the Compute Engine Instance.
Configure your Wifi network.

Point the external IP of the Compute Engine Instance for your authentication.

This will also align when you eventually use the GCP Managed AD.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help

andres_fastweb

Hi Kensan,

Thank. you for your detailed answer.

Assuming I follow your instructions and set up an LDAP server in Compute Engine, my only concern is if it is possible to sync my server with GCP Managed AD since I don't want to have to maintain two directories.

If not, would a RADIUS solution work better i.e. have it synced with GCP Managed AD? My wifi network also supports it.

The whole idea is to have a single user directory.

Thsnks,

AA