Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to add a Linux server to a network which is controlled by AD. The aim is that users of the server will be able to authenticate against the AD domain. I have Kerberos working, but NSS / PAM are more problematic. I'm trying to debug with a simple command such as the following, please see the error. Can anyone assist me to debug?

root@antonyg04:~# ldapsearch -H ldap://raadc04.corp.MUNGED.com/ -x -D
"cn=MUNGED,ou=Users,dc=corp,dc=MUNGED,dc=com" -W uid=MUNGED
Enter LDAP Password:
ldap_bind: Invalid credentials (49)
    additional info: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext 
error, data 525, vece

I have had to munge some details, but I can tell you that cn=MUNGED is my username for logging into the AD domain, and the password that I typed was the password for said domain. I don't know why it says "Invalid credentials", and the rest of the error is so cryptic, I have no idea.

Is my approach somehow flawed? Is my DN obviously wrong? How can I confirm the correct DN? There was a tool online but I can't find it.

NB I have no access to the AD Server for administration or configuration.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I got some good help on IRC, and I can now bind with:

ldapsearch -H ldap://raadc04.corp.MUNGED.com/ -x -D USERNAME_MUNGED@DOMAIN_MUNGED.com
-W sAMAccountName=MUNGED

So I changed the -D parameter, and the lookup from uid to sAMAccountName.

share|improve this answer

I have documented this process here, it was a while ago but I have some positive f/b and this did work v well with recent Fedora.

Your problem here is that your username and password for using the ldap tools needs to be a bind user for the AD and your credentials are insufficient.

However, I suspect that the key thing you need is to be able to get keys and bind, which you have to have an admin account for. i.e. You need a friend in admin.

There are some simpler ldap auth models but your AD has to agree to talk to them.

http://educationukblog.blogspot.co.uk/

share|improve this answer
    
Thanks for the answer. I read the link but I'm not sure how much is relevant to my use case, as you don't appear to use libnss-ldap. I do agree that the bind user is the problem. Is it the case that I can't just bind as my "normal" user? And if not, what are the characteristics of a bind user i.e. what should I ask admin for? It's a big company, and it might be hard to find a real expert - I might have to spoon-feed them a little. –  topper Jul 8 '12 at 8:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.