Lightweight Directory Access Protocol (LDAP) for reading and editing directories over an IP network

learn more… | top users | synonyms

16
votes
4answers
7k views

Common wisdom about Active Directory authentication for Linux Servers?

What is the common wisdom in 2014 about Active Directory authentication/integration for Linux servers and modern Windows Server operating systems (CentOS/RHEL-focused)? Over the years since my first ...
30
votes
2answers
69k views

How do I configure LDAP on Centos 6 for user authentication in the most secure and correct way?

During the last couple of days I have been using a lot of F-words, while browsing Internet for good documentation about how to setup an LDAP-server. So far I have found none, but plenty that are less ...
12
votes
2answers
22k views

How do I configure Reverse Group Membership Maintenance on an openldap server? (memberOf)

I am currently working on integrating LDAP authentication into a system and I would like to restrict access based on LDAP group. The only way to do this is via a search filter and therefore I believe ...
10
votes
2answers
7k views

Configure OpenLDAP with TLS=required

Nowadays, OpenLDAP needs to be configured with ldapmodify cn=config, as describe here. But nowhere I can find how you configure it to only accept TLS traffic. I just confirmed that our server accepts ...
6
votes
2answers
2k views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
17
votes
18answers
23k views

Are there any good and lightweight LDAP querying tools? [closed]

As developers we sometimes need querying LDAP. Do you know useful tools for this task? edit: I don't mean in code, I mean utility/tool (command-line or gui, mostly gui) for just to look/confirm data, ...
4
votes
8answers
6k views

Suggestions for using Active Directory credentials (user name/password) with Google Apps?

I run a small college network with approximately 150 user accounts both in my Active Directory and in Google Apps. I'm looking to link AD with G-Apps. Currently my users are required to maintain ...
3
votes
2answers
3k views

dn-based linux groups from ldap

Is there any way to use one of LDAP's DN-based groups for linux groups instead of using the uid-based posixGroup objectclass? More broadly, is there any way I can avoid having one set of groups for ...
7
votes
6answers
4k views

Active Directory OU design for <500 users, 4 locations

We are looking to add some logical structure to our (Win 2003) AD hierarchy. We have a single domain and around 500 users. All users and computers are currently organized into one OU. All security ...
3
votes
2answers
9k views

VsFTPd - LDAP - PAM

I am trying to configure a VsFTPd server to authenticate agains an LDAP server. It may be easy, but since it is the first time that I am using both LDAP and PAM, I have some difficulties. VsFTPd runs ...
61
votes
6answers
217k views

How can I figure out my LDAP connection string?

We're on a corporate network thats running active directory and we'd like to test out some LDAP stuff (active directory membership provider, actually) and so far, none of us can figure out what our ...
11
votes
4answers
13k views

How to authenticate users in nested groups in Apache LDAP?

I've working LDAP authentication with the following setup AuthName "whatever" AuthType Basic AuthBasicProvider ldap AuthLDAPUrl ...
6
votes
2answers
3k views

apache auth: combination of LDAP and htpasswd

We're using Apache with mod_svn to serve the subversion repo. Apache is hooked to an LDAP server so all users can use their domain passwords. For the build machine to be able to checkout, I want to ...
8
votes
6answers
9k views

Use LDAP for MySQL authentication?

We run a couple dozen different MySQL servers for our users. These use the free/Open Source version of MySQL, not the commercial version. Managing the Account Passwords on these servers is painful. ...
7
votes
3answers
7k views

Apache mod_auth_kerb and LDAP user groups

I've been considering deploying mod_auth_kerb on our internal web servers to enable SSO. The one obvious problem I can see is that it's an all-or-nothing approach, either all your domain users can ...
6
votes
8answers
4k views

Best practices or experience with company wide Username policies and resolving duplicates

I am a programmer with an application that needs to be integrated into the new company wide Active Directory login scheme. This means changing all the usernames in our system to use the new scheme. ...
3
votes
1answer
352 views

build user chroot on first login

I'm using ldap for remote user authentication and I basically need to either figure out how to: a. chroot a user on machine b from machine a via nfs,(which doesn't seem possible without mounting ...
2
votes
3answers
2k views

SFTP server on Windows using LDAP for authentication [closed]

I need to set up an SFTP server on a Windows 2008 Server machine that will be used to recieve large files (~200MB). I need the server to authenticate any users trying to log on, against the company's ...
1
vote
2answers
3k views

Upgrading to Debian 7: Postfix Auth fails

I'm upgrading various Debian 6 servers to Debian 7. There are a few minor issues, but this one is a show stopper. On Debian, Postfix runs in a chrooted environment. That environment is setup ...
3
votes
3answers
853 views

How to add a web folder via command line (Windows)

I am trying to add a web folder via command line in windows. At first I though I should use the "net use" command, but when I tried I kept getting System error 67: C:>net use * ...
3
votes
6answers
675 views

Looking for Exchange alternatives for email, calendar and directory serivices [closed]

I am look into what LDAP is and how it works in regards to a Mail Client. My question is how does LDAP work? I understand that LDAP is: A directory set of objects with attributes organized in a ...
2
votes
3answers
4k views

How does someone restrict read rights to certain user attributes on Active Directory?

We use this code to query an ADAM instance. DirectoryEntry adRoot = new DirectoryEntry(ConfigurationManager.AppSettings["LdapConnectionString"].ToString()); DirectorySearcher adSearch = new ...
11
votes
1answer
11k views

How Do I Install Gerrit Under Tomcat with LDAP?

I'm trying to find good instructions for installing Gerrit under Tomcat with LDAP support. I need this installed on a Windows 2008 Server, preferably. However, I can opt for Linux if not possible. ...
5
votes
7answers
10k views

Automated configuration of ldap authentication for RHEL5 servers

I use puppet for managing our production servers. Under rhel5 the standard way of enabling ldap is to use the authconfig tool. Which works successfully, but isn't really capable with the puppet way of ...
8
votes
4answers
5k views

Linux Central Authentication/Authorization Methods

I have a small but growing network of Linux servers. Ideally I'd like a central place to control User Access, change passwords, etc... I've read a lot about LDAP servers, but I'm still confused about ...
7
votes
2answers
10k views

Authenticating Apache HTTPd against multiple LDAP servers with expired accounts

We're using mod_authnz_ldap and mod_authn_alias in Apache 2.2.9 (as shipped in Debian 5.0, 2.2.9-10+lenny7) to authenticate against multiple Active Directory domains for hosting a Subversion ...
6
votes
13answers
13k views

can't figure out why apache LDAP auth fails

Suddenly, yesterday, one of my apache servers became unable to connect to my LDAP (AD) server. I have two sites running on that server, both of which use LDAP to auth against my AD server when a user ...
5
votes
2answers
3k views

Network authentication + roaming home directory - which technology should I look into using?

I'm looking into software which provides a user with a single identity across multiple computers. That is, a user should have the same permissions on each computer, and the user should have access to ...
3
votes
3answers
12k views

Configuring OpenLDAP as a Active Directory Proxy

We try to set up an Active Directory server for company-wide authentication. Some of the servers that should authenticate against the AD are placed in a DMZ, so we thought of using a LDAP-server as ...
12
votes
2answers
3k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
10
votes
4answers
1k views

Managing access to multiple linux system

A searched for answers but have found nothing on here... Long story short: a non-profit organization is in dire need of modernizing its infrastructure. First thing is to find an alternatives to ...
9
votes
1answer
3k views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
8
votes
1answer
17k views

What permissions are required for enumerating users groups in Active Directory

I have a .net web application which needs to obtain the groups a user is a member of in Active Directory. Todo this I am using the memberOf attribute on the users records. I need to know the ...
7
votes
5answers
4k views

Debian 6.0 AD integration

Despite multiple questions already about this, e.g. Linux on Windows AD Domain I'd like to know how to get Debian 6.0 Squeeze integrated with AD using open source or otherwise free of charge for ...
1
vote
2answers
4k views

Is there any bad thing happens if I change /etc/ldap/slapd.d/cn=config.ldif manually?

Since 2.3, OpenLDAP uses a configuration engine called slapd-config. They said that use it make all LDAP configuration can be changed on fly. This is the header of /etc/ldap/slapd.d/cn=config.ldif: ...
10
votes
1answer
33k views

LDAP authentication for SonicWALL VPN

I'm trying to configure my SonicWALL to allow LDAP authentication for VPN users. I've done this before with another device, and I remember it being pretty simple. But I can't get it to work this ...
6
votes
4answers
270 views

Using AD as a general purpose directory [closed]

Is there anyone using AD as a general purpose directory (meaning for uses other than domain authentication / authorisation and stuff) ?
4
votes
3answers
16k views

Howto setup a LDAP server on Windows 7?

Question: I need to setup a LDAP-Server on my windows (7) machine for development purposes. How do I do that? And how do I get data in there?
4
votes
5answers
5k views

Central Authentication For Windows, Linux, Network Devices

I'm trying to find a way to centralize user management & authentication for a large collection of Windows & Linux Servers, including network devices (Cisco, HP, Juniper). Options include ...
4
votes
2answers
2k views

Keep AD Group Synced in OpenLDAP with POSIX Account Augmentation

What's the most obvious way of achieving the following: The site has an working AD infrastructure and certain parts of the infrastructure are tightly coupled GNU/Linux machines where people from the ...
3
votes
1answer
1k views

Linux (Ubuntu vs CentOS) LDAP Client for 389-ds - password policy

389-ds on Ubuntu 12.04 server up and running. Enabled Fine-grained password policies and User must change password after reset for the whole tree. Created test user afterwards. Login from CentOS ...
3
votes
1answer
5k views

How do I connect my FreeNAS File Server to my Mac OS X Directory Server?

I am trying to connect my File Server (FreeNAS 8.0.1 / 8.2-RELEASE-p7) with my Mac OS X 10.7 Lion Directory Server's Open Directory... I know that Mac OS X provides an LDAP service via which other ...
3
votes
7answers
19k views

How can I enable LDAP in PHP - Windows Server 2008

I've installed PHP in my Win Server 2008 using Web Platform Installer. The installation was success and I can correctly display phpinfo page from my virtual directory. How can I enable LDAP support? ...
3
votes
7answers
38k views

What's the AD query syntax to enumerate all users for a particular group?

Here's what does not work so far; (&(objectCategory=Person)(objectClass=Group)(CN=group_in_question)) (&(objectClass=Group)(objectCategory=Group)(member=CN=group_in_question)) ...
2
votes
2answers
3k views

Troubleshooting sudoers via ldap

The good news is that I got sudoers via ldap working on Red Hat Directory Server. The package is sudo-1.7.2p1. I have some LDAP/Kerberos users in an LDAP group called wheel, and I have this entry in ...
1
vote
1answer
475 views

Postfix Splitting Domain to Separate Mailstores using LDAP

I'm investigating a new mail setup to replace Exchange in our organization using Cyrus-IMAP, Postfix and Perdition IMAP proxy server. I'm running into issues dealing with sending emails to different ...
0
votes
3answers
3k views

Get an object by its objectGUID using ldapsearch

If I have the objectGUID attribute as returned by the ldapsearch command, how can I search the whole directory for an object with that objectGUID? For example, if I search a user getting its ...
8
votes
3answers
1k views

What good Active Directory + Exchange competition is there?

Based on this question regarding enhanced permission support in filesystems, what is the best permissions + directory and mail stack to compare against Active Directory on NTFS with Exchange? I'm ...
6
votes
5answers
4k views

Small, simple LDAP server as an alternative to OpenLDAP [closed]

I have taken a look at the installation and configuration instructions for the newer OpenLDAP releases and decided that it's too much work to set up for my small userbase. Basically, I only use LDAP ...
6
votes
2answers
1k views

What's the default hash format / algorithm of Active Directory?

I'm wondering what format I need to put hashes in to write to userPassword via LDAP. Apache Directory Studio gives me several options, but I don't think any of them are it. Can anyone document the ...