1

I've recently joined a painfully large corporation that uses AD for authentication. I would like various services in my group (Bugzilla, mailman, Apache) to use AD for authentication.

This guide:

http://www.rhyous.com/2009/11/10/how-to-configure-bugzilla-to-authenticate-to-active-directory/

looks pretty good for the Bugzilla case, but it assumes you know all your AD credentials/parameters like:

  1. Bind DN
  2. Base DN
  3. LDAP server
  4. UID attribute

My question is how do I discover what those are? The IT people here are exquisitely unhelpful so I'm wondering if there's some programmatic way for an unprivileged user to find them out.

3
  • 3
    Unfortunately to do this right, you'll need to have the IT department set up an LDAP bind account for you in AD. You don't want this application using your personal credentials to bind to AD. Honestly, it sounds like you're trying to fly under the radar with these applications. That doesn't go over very well with most here due to the fact that most of us are professional sysadmins that get to deal with things like rogue applications on a fairly regular basis.
    – EEAA
    Apr 25, 2011 at 22:02
  • OK, I guess I'll do that; thanks.Could I ask why you marked this question as off-topic? I read the FAQ and this question seems to match all the good criteria and none of the bad.
    – user79438
    Apr 26, 2011 at 13:30
  • From the FAQ, "Server Fault is for system administrators and desktop support professionals". Not for non-IT people trying to implement things their IT department doesn't want to do.
    – EEAA
    Apr 26, 2011 at 13:33

1 Answer 1

2

You will need a service account in order to bind (authenticate) to the domain controller, but you can test it in a dev environment with just your own user account.

  • The "bind DN" is the LDAP distingusihed name (CN=value, OU=value, DC=value, etc) of the user that connects to the server in order to verify a user. You will probably need to specify the password somewhere in the config also.

  • The "base DN" is the distinguished name of the OU where you are going to look for users to exist in the LDAP structure. Probably a "users" OU off the root, but your structure may vary.

  • The LDAP server is an domain controller using port 389. You can also look at port 3268 for global catalog info if you have multiple AD domains in a single forest.

  • The UID attribute is the LDAP attribute that you are going to use to compare usernames when they attempt to authenticate. More than likely this will be 'Name' or 'CN'

2
  • Thank you for your response, but the question is "how do I find these things out?".
    – user79438
    Apr 26, 2011 at 13:19
  • you can use adsiedit.msc or dsa.msc and point those tools to your local domain to discover the properties of all these things. Those tools are available from Microsoft as a part of the RSAT (remote server admin toolkit) or server 2003 admin toolset. Other LDAP tools will work as well (ldp.exe).
    – BoxerBucks
    Apr 26, 2011 at 18:00

Not the answer you're looking for? Browse other questions tagged .