Lightweight Directory Access Protocol (LDAP) for reading and editing directories over an IP network

learn more… | top users | synonyms

3
votes
0answers
42 views

Expensive LDAP queries from Workstations

Troubleshooting high LSASS process on a DC found expensive queries originating from a few workstations. Each query is as follows: Visited Entries: 1Million+ Returned Entries: <50 (most of the ...
3
votes
0answers
218 views

Apache LDAP auth: denied all time

There is my config (httpd 2.4): <AuthnProviderAlias ldap zzzldap> LDAPReferrals Off AuthLDAPURL "ldaps://ldap.zzz.com:636/o=zzz.com?uid?sub?(objectClass=*)" AuthLDAPBindDN ...
2
votes
0answers
9 views

RHEL 6.5 web application PAM AUTH pam_oddjob_mkhomedir

I've got a RHEL 6.5 that authenicates against an AD server, that side is working fine. The machine is also running a web application that uses a PAM module to authenticate. I copied login to make a ...
2
votes
0answers
17 views

Are External LDAP referrals similar to a DNS Recursive or non recursive entry?

I'm very familiar with DNS, but less so with LDAP. In DNS I have the ability to delegate the CPU and IO load of referral chasing a given DNS query... or I can set norecurse and have the client ...
2
votes
0answers
22 views

Kerberos, .k5login and sudo

Background: I am using a Debian 7 system which I have integrated with an LDAP+Kerberos system using libnss-ldap, libpam-krb5 and nscd. I have modified sudoers to permit an LDAP group the right to sudo ...
2
votes
0answers
61 views

Allowing LDAP authentication from DMZ to Active Directory. Is my idea secure?

I have a internet-facing application server that I want to use AD authentication. This is my first time doing this for a none MS application or without some sort of proxy. I already have a idea in my ...
2
votes
0answers
67 views

Unix nslcd login with sAMAccountName and/or userPrincipalName from Active Directory

I'm trying to setup authentication from Active Directory in FreeBSD 10.0 using nslcd (nss-pam-ldapd-sasl package) and would like to allow both sAMAccountName and userPrincipalName as valid login ...
2
votes
0answers
58 views

configuration CAS with LDAP active Directory

I am using CAS server version 3.5.2 and after I configured it to connect to an LDAP server I got this message. Anyone have a clue about what is happening? My LDAP server is pfeserver.pfe.dz ...
2
votes
0answers
113 views

Set Linux GID based on LDAP OU in ldap.conf

In our company we have a given LDAP Server, which represents the Users of our Windows Active Directory. Unfortunately the gidNumber sent to the LDAP client is always containing the Value "1001" for ...
2
votes
0answers
607 views

LDAP over SSL Unsuccessful on 2003 DC, Working on 2008 R2 DC in Same Domain

I have a publicly signed UCC for LDAP over SSL in a test domain. It contains the Server Authentication OID Extension and works fine on a 2008 R2 DC in the same domain. The CSR was generated on the ...
2
votes
0answers
43 views

How can I force a schema replacement operation in LDAP

I am using ApacheDS. I have created a custom schema such that it is in its own container under schema. When I make changes to the LDIF file and re-import it, I keep getting errors indicating that the ...
2
votes
0answers
137 views

How can I configure an LDAP ACL such that users may *only* use allowed services?

I am trying to configure acl with attribute allowedService in such a way that users with an application name entry can only login to that particular application. We have users as follows: dn: ...
2
votes
0answers
164 views

How do I download the avatar image from an Active Directory server?

I'm using the ldapsearch.exe binary that was installed along with an Oracle client. It took awhile to tease out the arguments that it wanted, but I'm able to successfully connect to AD and parse out ...
2
votes
0answers
54 views

How do i map group to set of groups, and then filter by one of them?

I love idea of LDAP, however i find it hard to use (at least as long as i'm a newbie in it). This is the reason why i kindly ask for your help, dear fellows. I'm on phase of designing my directory, ...
2
votes
0answers
280 views

issue with heimdal kerberos in ldap backend

I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in LDAP itself. The KDC uses SASL EXTERNAL authentication as root to ...
2
votes
0answers
402 views

Troubleshooting Redmine performance

I've got a Redmine instance (Bitnami Stack) that's unusually slow. Because I'm just trying to get to the bottom of this, I have some theories which I'd like to discuss here. So, if anybody has any ...
2
votes
0answers
47 views

Auxiliary class

I try to modify an AD schema, adding a custom auxiliary class in user (Cn=MyName,CN=Users,DC=xxx,DC=yyy) With adsiedit when the new object window pops-up to add the class, I can only select ...
2
votes
0answers
569 views

Dynamically translate posixGroup to groupOfNames in slapd (Apple Open Directory)

I'm setting up an application to authenticate to Open Directory using LDAP. Open Directory stores groups in RFC 2307 posixGroups format, like this: cn: mygroup objectClass: top objectClass: ...
2
votes
0answers
156 views

Reviewboard/LDAP groups

I'm curious if anyone has a solution for sync'ing RB and LDAP groups? I want to manage user/group data in LDAP and have those changes propagate to RB. The RB API doesn't allow creation/modification ...
2
votes
0answers
182 views

LDAP authentication for Trixbox

I have a trixbox IP PBX for a 700 user company and currently it is a painful process for managing user names & passwords. I wanted to use LDAP authentication for connecting to Trixbox so that ...
2
votes
0answers
1k views

Domain Admins do not have Administrative rights on Windows Server 2008 using Samba PDC

Members of Domain Admin using CentOS Directory Server as backend do not have Admin rights in Windows Server 2008. I have joined the domain, see that the users are populated, and can login using LDAP ...
2
votes
0answers
893 views

Performance comparison between LDAP servers

Has anyone ever compared different LDAP servers? I am currently planning to upgrade ADAM to another server, and I'd like to know how do they perform. Currently the options that I am researching are: ...
2
votes
0answers
2k views

TLS (STARTTLS) Failure After 10.6 Upgrade to Open Directory Master

Environment: Mac OS X 10.6.3 install/import of a MacOS X 10.5.8 Open Directory Master server. After that upgrade, LDAP+TLS fails on our MacOS X 10.5, 10.6, CentOS, Debian, and FreeBSD clients ...
1
vote
0answers
13 views

How to determine the values for an LDAP bind to a Windows Server 2012 DC? [ldap_bind: Invalid Credentials (49)]

Sigh. I have been trying for nearly 6 hours to get my Gitlab deployment to authenticate via Windows Server 2012 Essentials Active Directory LDAP. I am running Ubuntu 14.04 for my Gitlab server. ...
1
vote
0answers
43 views

allow Windows 2012 AD users to ssh into a linux computer

I have a Windows Server 2012 R2 running as a domain controller. I also have a Debian 7.2 server (running Webmin 1.6) which I would like to give users ssh access to using their domain accounts. On the ...
1
vote
0answers
34 views

OpenLDAP syncrepl probblem with password policies

Recently I have been working to get slapd syncrepl working using an LDAP backend (push based replication). While I have had fantastic results with syncrepl doing pull based, the push based is killing ...
1
vote
0answers
40 views

LDAP + NFS + automount home directories permissions issue

When an LDAP user logs into the system they have incorrect permissions to their home directory. LDAP and NFS services exist on the same server. The directory shows the correct ownership / ...
1
vote
0answers
9 views

bind-sdb does not query for wildcard entry

I have successfully set up Bild with LDAP on a Fedora VM. The Problem is, bind-sdb simply does not query wildcard entries. When I do: nslookup doesnotexist.example.com. 127.0.0.1 The LDAP server ...
1
vote
0answers
64 views

Disabling LDAP Signing on Windows PDC in Local Policy

I just tripped over my own feet it seems. Playing around on a Windows 2008 R2 server (set up as domain controller), I was intrigued by certain warning event (event id 2886) which says: "To enhance ...
1
vote
0answers
39 views

Groups with local and LDAP users

I'm exploring the idea of authenticating users on some RHEL 6.4 boxes using LDAP. I'm using sssd with an LDAP provider, and setting the nsswitch.conf file to use sss for passwd/shadow/group. How can ...
1
vote
0answers
82 views

ldapmodify TLS: certificate is not valid - error -8179:Peer's Certificate issuer is not recognized

In trying to connect to an MS active directory server over ssl, I am trying to run this: ldapmodify -vv -H 'ldaps://abc.def.com:636' -D 'cn=user,cn=Users,dc=abc,dc=def,dc=com' -f test.ldif -w ...
1
vote
0answers
90 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
1
vote
0answers
36 views

Connect an LDAP realm with an AD domain, with the same name?

The situation is a separate group has created an LDAP domain. We'll call it foo.bar. (fyi, none of these are connected in any way to the Internet) They also have a Windows domain and renamed it to ...
1
vote
0answers
40 views

Creating users in 389 Directory Server: Autofill UID & GID

I have a 389 Directory Server cluster as ldap. I can create users using 389 management console but... When Selecting "Posix User" tab and checking "Enable Posix User Attributes" is necessary manually ...
1
vote
0answers
60 views

Why can a local root turn into any LDAP user?

I know this has been asked here before, but I am not satisfied with the answers and don't know if it's ok to revive and hijack an older question. We have workstations that authenticate users on an ...
1
vote
0answers
39 views

LDAP Integration with the firewall

I am trying to integrate Sonicwall NSA2400 with AD so users can VPN with their domain credentials and able to change password if it expires. Do i need to install ADLS role and configure LDAP, or LDAP ...
1
vote
0answers
81 views

Shibboleth Authentication to AD failed with error “file not found”

I am new to Shibboleth and try to configure authentication between ADFS and Shibboleth. The users are stored in AD. I've already connected ADFS and Shibboleth and able to see the login page, after ...
1
vote
0answers
218 views

adamsync.exe /sync is failing with “Naming Violation”

I am trying to synchronize my AD LDS instance (localhost:50006) with AD DS entries (basically trying to get user and computer accounts from AD DS so that I can use windows security principals in my ...
1
vote
0answers
39 views

Samba authentication using read-only LDAP server without samba attributes

I have read-only access to an LDAP server which only stores unix account information (no samba attributes). I’d like to grant the users in the LDAP directory access to the samba shares on my server. ...
1
vote
0answers
107 views

OpenLDAP on ArchLinux users cannot change passwd

I started an office and i NEED centralized login and home directories to work. Since all workstations are going to run Arch and problems with different LDAP versions I finally concluded the LDAP ...
1
vote
0answers
153 views

LDAP authentication very slow on production server

We are developing a Spring MVC application which does LDAP authentication using Spring Security framework. The problem we are facing is that the authentication works just fine on our development ...
1
vote
0answers
98 views

Restrict server login via LDAP hostObject objectClass and host Attribute

How do I configure my LDAP server to allow all hosts except one? All users by default have the host: * attribute, which allows any user to login to any server. I've tried the following regex, but it ...
1
vote
0answers
38 views

Can you write an LDAP query that returns accounts modified in the previous day?

I have a system that synchronizes from a master LDAP store. The synchronization process has gotten longer and longer as our directory grows. I had to stop syncing hourly, and moved it to an overnight ...
1
vote
0answers
31 views

Automatically create LDAP groups for each new system user according to its username

is there any way to set and create a default group for each newly created system user so he belongs to its own user group? I mean, when a create a user foo i would like to create automatically a ...
1
vote
0answers
90 views

How to create LDAP bind account in Centos/RedHat that allows me to search by ldapbind@server.com

I am creating an LDAP directory and searching by the full DN shows the proper results. $ ldapsearch -x -D "cn=ldapbind,dc=server,dc=com" -w bind I want / need to be able to search using the email ...
1
vote
0answers
12 views

Can the Apach AuthLDAPNURL be pointed at the root of a tree?

I have a server where I need to use Apaches AuthLDAPNURL value, but I cannot start at any specific O, OU, or DC. For whatever reason this tree has everybody in 19 Organization (O) objects, hanging ...
1
vote
0answers
63 views

Which attributes does Active Directory currently use for POSIX compatibility?

In a heterogeneous environment that uses Windows Active Directory as the central directory, some attributes are essential for compatibility with Linux systems. uidNumber gidNumber gecos loginShell ...
1
vote
0answers
187 views

Change DN in OpenLDAP “on the fly”

I'm a newbie in LDAP and I have the following issue: I use OpenLDAP as a caching proxy for remote Active Directory. And the full DN of a user is like "cn=Doe\, ...
1
vote
0answers
78 views

openldap make sure password does not contain username

Is there a way using openldap to ensure that a user's password does not contain their name or their username? I know that you can use the ppolicy overlay pwdCheckModule by writing a C function to do ...
1
vote
0answers
300 views

Samba + LDAP: user authentication works for one but not another server

I have a very frustrating problem I'm trying to solve for a few days now, maybe one of you can help me. I have two (standalone) samba servers which should authenticate the users using an LDAP server. ...