1

I'm trying to add a Linux server to a network which is controlled by AD. The aim is that users of the server will be able to authenticate against the AD domain. I have Kerberos working, but NSS / PAM are more problematic. I'm trying to debug with a simple command such as the following, please see the error. Can anyone assist me to debug?

root@antonyg04:~# ldapsearch -H ldap://raadc04.corp.MUNGED.com/ -x -D
"cn=MUNGED,ou=Users,dc=corp,dc=MUNGED,dc=com" -W uid=MUNGED
Enter LDAP Password:
ldap_bind: Invalid credentials (49)
    additional info: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext 
error, data 525, vece

I have had to munge some details, but I can tell you that cn=MUNGED is my username for logging into the AD domain, and the password that I typed was the password for said domain. I don't know why it says "Invalid credentials", and the rest of the error is so cryptic, I have no idea.

Is my approach somehow flawed? Is my DN obviously wrong? How can I confirm the correct DN? There was a tool online but I can't find it.

NB I have no access to the AD Server for administration or configuration.

2 Answers 2

1

I got some good help on IRC, and I can now bind with:

ldapsearch -H ldap://raadc04.corp.MUNGED.com/ -x -D USERNAME_MUNGED@DOMAIN_MUNGED.com
-W sAMAccountName=MUNGED

So I changed the -D parameter, and the lookup from uid to sAMAccountName.

0

I have documented this process here, it was a while ago but I have some positive f/b and this did work v well with recent Fedora.

Your problem here is that your username and password for using the ldap tools needs to be a bind user for the AD and your credentials are insufficient.

However, I suspect that the key thing you need is to be able to get keys and bind, which you have to have an admin account for. i.e. You need a friend in admin.

There are some simpler ldap auth models but your AD has to agree to talk to them.

http://educationukblog.blogspot.co.uk/

1
  • Thanks for the answer. I read the link but I'm not sure how much is relevant to my use case, as you don't appear to use libnss-ldap. I do agree that the bind user is the problem. Is it the case that I can't just bind as my "normal" user? And if not, what are the characteristics of a bind user i.e. what should I ask admin for? It's a big company, and it might be hard to find a real expert - I might have to spoon-feed them a little.
    – antgel
    Jul 8, 2012 at 8:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .