Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We use Apache 2.2 for authentication against Active Directory. The configuration is following:

AuthFormLDAPURL "ldap://*.*.*.*:389/DC=domain,DC=com?userPrincipalName,sAMAccountName?sub?(objectClass=*)"

Note: All traces below using WireShark.

I defined the user john when the CN is equal to the sAMAcountMame name:

enter image description here

I can authenticate using only john (sAMAcountMame). Please find below LDAP bind request:

enter image description here

LDAP bind response:

enter image description here

Then I defined the user johnd when the CN is NOT equal to the sAMAcountMame name:

enter image description here

Unfortunately, I can not authenticate using johnd (sAMAcountMame). Please find below LDAP bind request:

enter image description here

LDAP bind response:

enter image description here

I can authenticate using a full name jonhd@domain.com. Please find below LDAP bind request:

enter image description here

LDAP bind response:

enter image description here

Questions:

  1. Why I can not authenticate using sAMAcountMame when the CN is NOT equal to the sAMAcountMame?
  2. Why I can authenticate using sAMAcountMame at domain in this case?
  3. Should we recommend to our users always to authenticate using sAMAcountMame at domain to prevent the authentication problems?

Thanks for your help!

share|improve this question
    
Please give more details about your AuthLDAP* configuration. There is something strange — because the user-specified name ends up in the bind request, looks like you are using something like AuthLDAPInitialBindAsUser on, but you also tell that you are using Apache 2.2, and there is no such option in that version (it was added in 2.3.6). Also AuthFormLDAPURL is either a typo or some custom module not known even to Google. –  Sergey Vlasov May 6 '13 at 4:50

1 Answer 1

up vote 3 down vote accepted
+50

When performing LDAP simple bind, AD does not try to match the passed name against the sAMAccountName attribute without any suffixes. However, it could try to find a match against displayName, which worked for you in the first test (where it looked like a match against sAMAccountName, because values of those attributes were the same).

The precise description of name matching rules used when handling LDAP simple binds can be found in the Microsoft documentation: http://msdn.microsoft.com/en-us/library/cc223499.aspx

Using UPN is probably more reliable, because displayName might contain some human-readable string (e.g., full name of a person) and is not guaranteed to be unique. The DOMAIN\USERNAME form should also be unique, but depend on NetBIOS domain names, which are considered to be obsolete now.

share|improve this answer
    
Thanks for you answer (+1). Can you guess why I can not to login using DOMAIN\USERNAME but can login using USERNAME@DOMAIN? The DOMAIN\USERNAME is unique. –  Michael May 6 '13 at 3:45
    
Did you look at the bind request using Wireshark in this case, and is DOMAIN\USERNAME there? Note that DOMAIN must be the NetBIOS domain name, which is by default the same as the first component of the DNS domain name, but can also be set to something else when creating the domain. –  Sergey Vlasov May 6 '13 at 4:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.