Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What permissions are needed to perform an LDAP bind to an active directory server? I have a central domain (call it MAIN) that has two-way trusts to domains in other forests (call then REMOTE and FARAWAY)

Using MAIN\myaccount as the username and my password I can bind to REMOTE fine, but not to FARAWAY; I get an invalid credentials response

80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext error, data 525, v893

In all other ways the trusts seem to work fine.

What permissions do I need to check to figure out why the bind is failing? My understanding is that anyone in AUTHENTICATED USERS should be able to bind to LDAP, but that only seems to hold true for some domaians and not others.

share|improve this question
add comment

3 Answers 3

Error 49, subtype 525 is bad user DN. I.e. The bind DN is not a valid object in the directory.

share|improve this answer
    
It shouldn't be a valid object in the FARAWAY directory, it's an object in the MAIN directory... I'm trying to figur eout why REMOTE is OK with this but FARAWAY isn't. –  DrStalker Oct 20 '09 at 23:27
    
So then the question is, how does AD handle authing to one domain, with a user in another domain. In vanilla LDAP, that probably would not work well. So how do trusts between domains convert to AD cross domain boundaries. Sorry, I do not know the answer to that one. –  geoffc Oct 21 '09 at 1:30
add comment

Error 525 is actually a DN not being found, you can take a look at this thread on the Oracle forums : http://forums.sun.com/thread.jspa?threadID=703398

share|improve this answer
add comment

Your error isn't that you don't have permission to bind, but that you are binding to a non-existent DN. Please be aware that LDAP DNs do not look like Active Directory usernames, but that they use a different format.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.