Lightweight Directory Access Protocol (LDAP) for reading and editing directories over an IP network

learn more… | top users | synonyms

5
votes
1answer
674 views

Special characters in ssh usernames

I've got a few users configured on LDAP, and would like them to be able to connect to a Linux machine via SSH using those users and password on the LDAP directory. However, there are 2 issues I do not ...
5
votes
1answer
5k views

How to manage groups and users in Jenkins

I'm trying to use role based security plugin in Jenkins, but i'm not sue i am using it right. I've decided to go with jenkin's own user database as a security realm instead of LDAP. i'm adding the ...
4
votes
2answers
745 views

Is it generally acceptable to expose LDAP in read only mode to the Internet?

I need to support Mac clients who need to access a LDAP server to locate SMIME keys. Since the keys are already in AD, and it's easy for me to create a RODC or read only forest where I push the ...
4
votes
7answers
6k views

Suggestions for using Active Directory credentials (user name/password) with Google Apps?

I run a small college network with approximately 150 user accounts both in my Active Directory and in Google Apps. I'm looking to link AD with G-Apps. Currently my users are required to maintain ...
4
votes
2answers
9k views

How do I get openldap on Centos 6 to write anything to it's log files

I don't get any information in my log file for openldap on my Centos 6 server. This is how i configured it. SELinux is disabled at the moment. First created a folder where I'd like to store the log ...
4
votes
2answers
7k views

How to get ldapsearch on Scientific Linux?

How do I get the ldapsearch on Scientific Linux? I am trying to find the ldapsearch client for Scientific Linux but cannot find how to install the client in order to do LDAP queries.
4
votes
4answers
15k views

Is my AD already an LDAP server?

I have installed an LDAP browser, to try and browse my AD information (this is part of enabling Google Directory Sync process). however, I keep getting a connection error (using port: 19389). the ...
4
votes
3answers
2k views

libpam-ldap or libpam-ldapd?

I'm setting up LDAP authentication on my personal VPS, and Ubuntu has two packages for the same purpose: libpam-ldap and libpam-ldapd. Which should I use?
4
votes
5answers
5k views

Is LDAP the only way to authenticate an web application against Active Directory?

I'm a PHP programmer and I've never work with active directory or ldap. I need to integrate my web app with an active directory and after ask the IT guy of the client company he said to me that isn't ...
4
votes
3answers
3k views

Can Windows integrate with LDAP?

Given an existing LDAP server used for authentication, can Windows desktops authenticate users against LDAP or perhaps Kerberos?
4
votes
3answers
4k views

Active Directory authentication load balancing and failover

For applications that authenticate against an Active Directory DC, obviously it would be best to just point them to the main domain DNS record rather than a specific DC for failover, load balancing, ...
4
votes
5answers
4k views

Central Authentication For Windows, Linux, Network Devices

I'm trying to find a way to centralize user management & authentication for a large collection of Windows & Linux Servers, including network devices (Cisco, HP, Juniper). Options include ...
4
votes
2answers
225 views

Which field to use when authenticating against Active Directory?

Active Directory user objects include a number of fields that can be considered an identifier. The following lists some of these with their label in ADUC and their attribute name: Full Name - cn ? ...
4
votes
3answers
544 views

Can nss/pam ldap send password to ldap server already hashed?

I have nss & pam configured so that I can authenticate linux users via LDAP against my companies AD server. All works fine except password are sent in plain text. For reasons out of my control our ...
4
votes
5answers
522 views

Can I get AD to authenticate via another LDAP server?

I need to set up an AD. The larger organisation I'm in has its own LDAP service which handles authentication and some other details. I would like to get AD to use that LDAP info just for ...
4
votes
9answers
3k views

Password Self-serve Active Directory via LAMP environment

I would like to be able to change active directory passwords via a Linux/Apache based webpage. This would be a self serve web page for the user. I have SSL-LDAP setup on the Active Directory to make ...
4
votes
5answers
637 views

Common user accounts between linux machines

I have a base system with a few (currently two) VMs on top of it, all running Ubuntu Server. I have to keep adding my user account on each system when I bring a new one up, as well as giving it sudo ...
4
votes
1answer
512 views

How to get Active Directory domain objectGUID anonymously

As an authenticated Active Directory user, I can run this to get the domain GUID (objectGUID): dsquery * "DC=lab,DC=local" -scope base -attr objectguid I can use this command in Linux to get the ...
4
votes
3answers
973 views

Svn authorizing over sasl+ldap failing after Ubuntu update 10.04 -> 12.04

I have working svnserve solution on Ubuntu 10.04 for authorizing svn users over SASL to Active directory (LDAP, not LDAPDB). Config files are at the bottom. After upgrading server to 12.04 release, ...
4
votes
5answers
4k views

Ubuntu 12.04 LDAP SSL self-signed cert not accepted

I'm working with Ubuntu 12.04, using OpenLDAP server. I've followed the instructions on the Ubuntu help pages and can happily connect without security. To test my connection, I'm using ldapsearch ...
4
votes
2answers
1k views

How do I determine if an Apple Open Directory user is disabled via LDAP?

I have an Open Directory user that has the "Access Account" box unchecked in Workgroup Manager so they cannot login. Is there a way to determine this using an LDAP query? It would also be good to be ...
4
votes
1answer
768 views

How to use PAM to check LDAP password for some users, yet always use UID/GIDs from local files?

For a subset of my users in /etc/passwd, I would like to configure PAM (on Linux) to do the password checking part of the logon against an LDAP server, ignoring that these users are actually are ...
4
votes
2answers
333 views

In LDAP is it best to nest groups under organizational units or create an organization unit directly under the root dn just for groups?

I'm not sure whether it's better to nest groups under each of my organizational units or to make an organization unit directly under the root DN just for groups. Is one considered best practice over ...
4
votes
2answers
1k views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
4
votes
1answer
832 views

Slappasswd output randomized

I was expecting slappasswd to produce a fixed hash but it appears that the output is randomized as I never get the same output for the same input password: $ slappasswd -s secret ...
4
votes
3answers
4k views

How do I get Bugzilla to authenticate with Active Directory LDAP?

After reading this guide and trying a ton of permutations based on that, is there an easy way to get Bugzilla working with an AD server? I keep getting the error: 80090308: LdapErr: DSID-0C0903A9, ...
4
votes
2answers
1k views

SSH and Active Directory authentication

Is it possible to set up Linux (and Solaris) SSH server to authenticate users in this way: i.e. user john is a member of the group Project1_Developers in the Active Directory. we have something on ...
4
votes
1answer
3k views

How can I find all groups a user belongs to via DSQUERY

How can I find all groups for a specific user (groups for which the user is assigned) using dsquery?
4
votes
1answer
449 views

How can I retrieve the LDAP server certificate for Windows 2008 and 2003 global catalog servers?

Windows Server 2008 | Windows Server 2003 I want to leverage LDAPS on a linux appliance. The vendor requires the server certificate for my Windows 2008 | Windows 2003 global catalog servers so it ...
4
votes
4answers
4k views

Using slapcat to backup LDAP

I'm running an OpenLDAP directory on a Debian server, using the hdb backend. I've been wondering about backups, and did som reading on the net. Slapcat seems to be the way to go, but I keep seeing ...
4
votes
2answers
2k views

Keep AD Group Synced in OpenLDAP with POSIX Account Augmentation

What's the most obvious way of achieving the following: The site has an working AD infrastructure and certain parts of the infrastructure are tightly coupled GNU/Linux machines where people from the ...
4
votes
1answer
2k views

Configuring RADIUS or LDAP on Supermicro (ATEN) IPMI

I'm trying to get our new server, a X8DTN+-F's IMPI configured to talk to our authentication servers. The two choices are LDAP and RADIUS. I'm debugging this by looking at packet captures, as it ...
4
votes
2answers
347 views

Samba: read-only LDAP + additional local users

My server has access to a read-only LDAP where information about 99% of user accounts will reside. On my server I want to configure Samba to use LDAP for authentication. Now and then there will be ...
4
votes
2answers
2k views

Authenticating Nested Groups in LDAP

I don't know much about LDAP so I apologise in advance. I am looking at a bug in an application that does some authentication using LDAP. The LDAP directory structure set up by the client contains ...
4
votes
1answer
984 views

LDAP passwords encryption (userPassword attribute)

I'm trying to import passwords from an LDAP to a MySQL database. When I look at the userPassword attribute for the known password test I get this: userPassword:: ...
4
votes
2answers
855 views

Account management tools supporting self-service registration and email verification?

I work in a university environment that has in the past offered services almost exclusively to university affiliates who already have "formal" accounts in central user database. We are increasingly ...
4
votes
3answers
4k views

LDAP Account Locked Out Sporadically after Password change - Finding the source of invalid attempts

On a small network of machines (<1000) we have a user whose account is being locked out after an indeterminate interval following a password change. We are having severe difficulties finding the ...
4
votes
2answers
10k views

How Do I Configure OpenLDAP to use MySQL (Ubuntu 9.04)?

My intention is to make a MySQL table of Customer Contact Information available to Outlook/Thunderbird clients as an Address Book (via LDAP). I'm aware that OpenLDAP has a MySQL backend option, but I ...
4
votes
1answer
4k views

How to correctly ldapmodify replace olcAccess lines?

This is a part from olcDatabase={1}hdb.ldif olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=somesite,dc=com" write by * none olcAccess: ...
4
votes
3answers
330 views

Apache multiple ldap groups

I am configuring Apache to authenticate against LDAP and require multiple groups to be present. I have done this with require statements, however I need the authentication to be successful if all ...
4
votes
1answer
820 views

Openfire Active Directory Trusted Domains

I'm in the process of setting up an Openfire XMPP server for intra-company communication. I have it authenticating against our local DC fine. Our company has two different offices (one in the US, ...
4
votes
2answers
506 views

Active Directory, Linux, and User Private Groups

We're in the process of moving from NIS on our Linux systems to binding everything to Active Directory. The NIS environment follows the common standard used by many Linux distributions that a user's ...
4
votes
1answer
402 views

What are best practices to store delegated permissions in OpenLDAP?

My network's core user database is managed by OpenLDAP. Recently we need to introduce a possibility for one user to act on second user's behalf. As all application-related rights and permissions are ...
4
votes
0answers
123 views

Configuring Synology NAS as freeIPA client

I'm attempting to deploy freeIPA in my company. The network is quite simple: < 10 FC20 (and FC21 beta) desktops < 5 FC20 servers (including the one with freeIPA) 1 Synology NAS DS1813+ (DSM ...
4
votes
0answers
175 views

CentOS requires entering password twice for sudo, login

At every login or sudo prompt, the server always rejects the password when it is first supplied, but accepts it the second time. I found this thread which describes what seems to be the same problem, ...
4
votes
2answers
235 views

OSX Server - How to set environment variable on network user login

I have a group of users on my server, "Developers", and I would like an environment variable to be set for them whenever they login. More specifically, when anyone in this group logs in, I would ...
4
votes
1answer
302 views

Apache LDAP auth: denied all time

There is my config (httpd 2.4): <AuthnProviderAlias ldap zzzldap> LDAPReferrals Off AuthLDAPURL "ldaps://ldap.zzz.com:636/o=zzz.com?uid?sub?(objectClass=*)" AuthLDAPBindDN ...
4
votes
1answer
1k views

How do I configure Subversion Edge to use LDAP Groups for authentication?

I'd like to make use of LDAP groups in my Subversion Edge "Repository Access Rules". For example, if LDAP user smokris is a member of LDAP group dev, I'd like to be able to grant the dev group access ...
4
votes
1answer
568 views

Cisco ASA LDAP Group Privilege Level

We have a pair of ASA 5510s (8.4.3) on which we use LDAP authentication for VPN and SSH access. On all of our Catalyst switches, which use RADIUS, we're able to set the shell:priv-lvl to 15 in the ...
4
votes
1answer
444 views

openldaps wildcard certificate not accepted

my wildcard certificate doesn't get accepted with ldap 2.4.23. when i try to connect i get the following error: TLS certificate verification: subject: ...