Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a project in which I have to authentificate clients from differents computers using an LDAP server. Do simulate that I have installed virtualbox in my PC and run two virtual machines, one with ubuntu 11.10 and other with Windows XP. and I am working with ubuntu 12.04 in my real machine.

What I did :

  1. I installed OpenLDAP and phpldapadmin in my real machine and created a simple annuaire of test.
  2. I followed this tutorial http://askubuntu.com/questions/33636/how-can-i-setup-ldap-client-authentication to configure the ubuntu virtual machine as a client and it is working well.
  3. I installed pGina 3.1.8 in my windows XP virtual machine and tried to configure the LDAP authentification plugin but it is not working.

What I need:

I need your help to configure the ldap authentification plugin of pGina, what I really don't understand are pattern fields, what should I write there ? I read this page but not fully unserstood : http://pgina.org/docs/v3.1/ldap.html

could anyone give me a concrete exemple of an LDAP annuiare and the equivalente configuration in pGina 3.1.8 ?

Thanks a lot

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

I will take a crack at this.

Group DN Pattern. This is forcing you to put all of your groups into one ou (Organizational Unit) on your LDAP server. So you will need to have them in one location and make the pattern reflect that. Say for instance all of your groups are in ou=pgina,ou=groups,dc=mydomain,dc=com and your groups use cn for naming in their DN. Then your group DN pattern would be "cn=%g,ou=pgina,ou=groups,dc=mydomain,dc=com".

For member attribute normally the attribute would by "member" if it is looking for the member's DN but if it just looking for their uid then "memberUid" will work.

For authentication with LDAP best practice is to search based on userid and then retrieve the DN and not to statically generate a DN. So you will want to select "Search for DN" and then your search filter should be "(&(uid=%u)(objectClass=person))". Your search contexts will be the top level of your ldap tree where you want to start searching for users. If they are all in one ou say ou=users,dc=mydomain,dc=com then that would be your context.

For reference DN is Distinguished Name and it is an absolute reference to a user within an LDAP server. You can use an LDAP browser to look at entries and look at either the entrydn or distinguishedname attribute (depending on server) to see what an entries distinguished name is.

share|improve this answer
    
Thanks for the explaination :) –  webNeat Jun 23 '13 at 2:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.