Lightweight Directory Access Protocol (LDAP) for reading and editing directories over an IP network

learn more… | top users | synonyms

5
votes
4answers
4k views

Sudo asks for password twice with LDAP authentication

I have Ubuntu 8.04 LTS machine and Windows 2003 AD domain. I have succesfully set up that I can log in with domain username and password, using domain prefix, like "domain+username". Upon login to ...
5
votes
3answers
9k views

How can I proxy multiple LDAP servers, and still have grouping of users on the proxy?

I have 2 problems that I'm hoping to find a common solution to. First, I need to find a way to have multiple LDAP servers (Windows AD's across multiple domains) feed into a single source for ...
5
votes
2answers
3k views

Network authentication + roaming home directory - which technology should I look into using?

I'm looking into software which provides a user with a single identity across multiple computers. That is, a user should have the same permissions on each computer, and the user should have access to ...
5
votes
2answers
739 views

LDAP, Active Directory

What I have: Workstations running Ubuntu Jaunty mounting /home on a remote NFS server. User accounts are still created locally on each individual workstation. Workstations running Windows XP / Vista ...
5
votes
4answers
1k views

Solaris 10 authentication in an AD world

I'm beginning to tire of maintaining individual system files on my increasing number of Solaris servers (was 2, now 10 and growing strong). I'm looking at the Sun Java Directory Server as a non ...
5
votes
5answers
3k views

Is there a simple LDAP-to-HTTP gateway out there?

We have a local LDAP directory that provides basic contact information about our user community. We would like to integrate this into some third-party hosted services that allow us to implement ...
5
votes
4answers
2k views

Login using Active Directory in Linux using Kerberos 5

I have a problem with setting up auth for users on Linux (Fedora Core 15 to be exact) using Active Directory on Windows 2008 Server with installed support for UNIX systems. I've successfully setup ...
5
votes
2answers
724 views

Access control to 100's of LAMP box via LDAP

This is every SysAdmin's nightmare of things to do. Basically we want to control who has access to which hosts. As simple it may sound, the problem is to find a scalable and low maintenance(mgmt. ...
5
votes
5answers
5k views

ldapsearch password file format

How am I supposed to pass a password to ldapsearch using the -y <password file> option? If I write the password in the password file in plain text, I get this error: ldap_bind: Invalid ...
5
votes
2answers
8k views

How to handle nested groups in LDAP

I am total LDAP newbie and I am just researching if I can use it for my next project or better stay away from it. The project will depend heavily on the concept of nested groups and I frequently need ...
5
votes
3answers
2k views

LDAP Users Home Directories

I'm trying to setup linux login via an LDAP server. I have everything working except setting the user's home directory. There is no parameter in the LDAP database that I can map to the ...
5
votes
5answers
714 views

LDAP for privilege control?

I've been wondering for a while if LDAP can be used to control user privileges. For example, if I have UNIX and web logins, is there an easy way to grant a user access to just or just UNIX (or even ...
5
votes
3answers
4k views

What permissions are needed to do an LDAP bind to an Active Directory Server

What permissions are needed to perform an LDAP bind to an active directory server? I have a central domain (call it MAIN) that has two-way trusts to domains in other forests (call then REMOTE and ...
5
votes
2answers
461 views

Samba: read-only LDAP + additional local users

My server has access to a read-only LDAP where information about 99% of user accounts will reside. On my server I want to configure Samba to use LDAP for authentication. Now and then there will be ...
5
votes
2answers
2k views

Active Directory and Apple's Workgroup Manager

I thought I'd share my experiences here. I work for a small business with only ~20 users. I wanted the ability to use managed client preferences to assign things like the software update server. ...
5
votes
1answer
765 views

Special characters in ssh usernames

I've got a few users configured on LDAP, and would like them to be able to connect to a Linux machine via SSH using those users and password on the LDAP directory. However, there are 2 issues I do not ...
5
votes
2answers
10k views

How Do I Configure OpenLDAP to use MySQL (Ubuntu 9.04)?

My intention is to make a MySQL table of Customer Contact Information available to Outlook/Thunderbird clients as an Address Book (via LDAP). I'm aware that OpenLDAP has a MySQL backend option, but I ...
5
votes
1answer
218 views

SSSD process won't die

Thanks for taking the time to check out my problem. I'm currently working on an issue that has only appeared once before. Back on Jan 3rd when this first appeared we were able to reboot the server ...
5
votes
1answer
8k views

How to manage groups and users in Jenkins

I'm trying to use role based security plugin in Jenkins, but i'm not sue i am using it right. I've decided to go with jenkin's own user database as a security realm instead of LDAP. i'm adding the ...
4
votes
2answers
833 views

Is it generally acceptable to expose LDAP in read only mode to the Internet?

I need to support Mac clients who need to access a LDAP server to locate SMIME keys. Since the keys are already in AD, and it's easy for me to create a RODC or read only forest where I push the ...
4
votes
8answers
6k views

Suggestions for using Active Directory credentials (user name/password) with Google Apps?

I run a small college network with approximately 150 user accounts both in my Active Directory and in Google Apps. I'm looking to link AD with G-Apps. Currently my users are required to maintain ...
4
votes
5answers
6k views

Is LDAP the only way to authenticate an web application against Active Directory?

I'm a PHP programmer and I've never work with active directory or ldap. I need to integrate my web app with an active directory and after ask the IT guy of the client company he said to me that isn't ...
4
votes
2answers
2k views

Which field to use when authenticating against Active Directory?

Active Directory user objects include a number of fields that can be considered an identifier. The following lists some of these with their label in ADUC and their attribute name: Full Name - cn ? ...
4
votes
3answers
18k views

Howto setup a LDAP server on Windows 7?

Question: I need to setup a LDAP-Server on my windows (7) machine for development purposes. How do I do that? And how do I get data in there?
4
votes
5answers
5k views

Central Authentication For Windows, Linux, Network Devices

I'm trying to find a way to centralize user management & authentication for a large collection of Windows & Linux Servers, including network devices (Cisco, HP, Juniper). Options include ...
4
votes
3answers
595 views

Can nss/pam ldap send password to ldap server already hashed?

I have nss & pam configured so that I can authenticate linux users via LDAP against my companies AD server. All works fine except password are sent in plain text. For reasons out of my control our ...
4
votes
5answers
589 views

Can I get AD to authenticate via another LDAP server?

I need to set up an AD. The larger organisation I'm in has its own LDAP service which handles authentication and some other details. I would like to get AD to use that LDAP info just for ...
4
votes
9answers
3k views

Password Self-serve Active Directory via LAMP environment

I would like to be able to change active directory passwords via a Linux/Apache based webpage. This would be a self serve web page for the user. I have SSL-LDAP setup on the Active Directory to make ...
4
votes
3answers
5k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
4
votes
5answers
7k views

Ubuntu 12.04 LDAP SSL self-signed cert not accepted

I'm working with Ubuntu 12.04, using OpenLDAP server. I've followed the instructions on the Ubuntu help pages and can happily connect without security. To test my connection, I'm using ldapsearch ...
4
votes
5answers
712 views

Common user accounts between linux machines

I have a base system with a few (currently two) VMs on top of it, all running Ubuntu Server. I have to keep adding my user account on each system when I bring a new one up, as well as giving it sudo ...
4
votes
1answer
969 views

How to get Active Directory domain objectGUID anonymously

As an authenticated Active Directory user, I can run this to get the domain GUID (objectGUID): dsquery * "DC=lab,DC=local" -scope base -attr objectguid I can use this command in Linux to get the ...
4
votes
3answers
1k views

Svn authorizing over sasl+ldap failing after Ubuntu update 10.04 -> 12.04

I have working svnserve solution on Ubuntu 10.04 for authorizing svn users over SASL to Active directory (LDAP, not LDAPDB). Config files are at the bottom. After upgrading server to 12.04 release, ...
4
votes
2answers
3k views

dn-based linux groups from ldap

Is there any way to use one of LDAP's DN-based groups for linux groups instead of using the uid-based posixGroup objectclass? More broadly, is there any way I can avoid having one set of groups for ...
4
votes
2answers
1k views

How do I determine if an Apple Open Directory user is disabled via LDAP?

I have an Open Directory user that has the "Access Account" box unchecked in Workgroup Manager so they cannot login. Is there a way to determine this using an LDAP query? It would also be good to be ...
4
votes
1answer
2k views

How to use PAM to check LDAP password for some users, yet always use UID/GIDs from local files?

For a subset of my users in /etc/passwd, I would like to configure PAM (on Linux) to do the password checking part of the logon against an LDAP server, ignoring that these users are actually are ...
4
votes
2answers
850 views

In LDAP is it best to nest groups under organizational units or create an organization unit directly under the root dn just for groups?

I'm not sure whether it's better to nest groups under each of my organizational units or to make an organization unit directly under the root DN just for groups. Is one considered best practice over ...
4
votes
2answers
4k views

Unable to authenticate using Apache and authnz_mod_ldap in Active Directory

I have a problem with Apache2 authentication using authnz_ldap_module in order to authenticate users from Active Directory. My Apache version is 2.2.16-6+squeeze10. Here is the configuration I am ...
4
votes
2answers
2k views

Multiline data list (ldif file) manipulation with awk or other tool

I'm trying to manipulate an ldif file with multiple entries. My purpose is to parse this existing ldif file, extracting the "givenName" and "sn" attributes, so to generate a "mail" attribute. I was ...
4
votes
3answers
4k views

How do I get Bugzilla to authenticate with Active Directory LDAP?

After reading this guide and trying a ton of permutations based on that, is there an easy way to get Bugzilla working with an AD server? I keep getting the error: 80090308: LdapErr: DSID-0C0903A9, ...
4
votes
2answers
1k views

SSH and Active Directory authentication

Is it possible to set up Linux (and Solaris) SSH server to authenticate users in this way: i.e. user john is a member of the group Project1_Developers in the Active Directory. we have something on ...
4
votes
4answers
1k views

How can I require a certain group of users to login via LDAP while letting others use either LDAP or local login?

I have set up my system to allow either LDAP or the local password for login. I did this by adding "password sufficient pam_ldap.so" to PAM and calling "pam_unix2.so" afterwards. However I would ...
4
votes
1answer
4k views

How can I find all groups a user belongs to via DSQUERY

How can I find all groups for a specific user (groups for which the user is assigned) using dsquery?
4
votes
1answer
891 views

How can I retrieve the LDAP server certificate for Windows 2008 and 2003 global catalog servers?

Windows Server 2008 | Windows Server 2003 I want to leverage LDAPS on a linux appliance. The vendor requires the server certificate for my Windows 2008 | Windows 2003 global catalog servers so it ...
4
votes
3answers
2k views

Can I force the passwd command to use MD5 hash (and not crypt)?

How can I force the passwd command to use MD5 hash and not to use crypt? I need to get the passwd command to talk to the ldap server (which it does) and use MD5 when I change passwords for the users.
4
votes
2answers
6k views

How do I use ldapdelete to delete an improperly set up olc database?

I've been walking through this tutorial and kept getting errors -- likely because I was typing it in manually -- so I retried, executing it after entering in # Load dynamic backend modules dn: ...
4
votes
1answer
14k views

Log LDAP access of the Active directory

I am looking for a method to log ldap access of a Active Directory domain controller. I want to be able to log the username and source IP address access to both 389, and 636(encrypted). A simple ...
4
votes
4answers
4k views

Using slapcat to backup LDAP

I'm running an OpenLDAP directory on a Debian server, using the hdb backend. I've been wondering about backups, and did som reading on the net. Slapcat seems to be the way to go, but I keep seeing ...
4
votes
2answers
2k views

Keep AD Group Synced in OpenLDAP with POSIX Account Augmentation

What's the most obvious way of achieving the following: The site has an working AD infrastructure and certain parts of the infrastructure are tightly coupled GNU/Linux machines where people from the ...
4
votes
3answers
5k views

Disable requiring authentication to bind in Active Directory

By default Active Directory requires authentication for all but the simplest searches. What's the recommended way to disable this policy? (I searched, but found only a few nonspecific Microsoft blog ...