Hot answers tagged

3

The 5th query is probably against a domain controller in another site (see https://technet.microsoft.com/en-us/library/cc782048%28v=ws.10%29.aspx, this is for 2003 AD but still valid). With a query like this: ldapsearch -h domaincontroller -LLL -s sub -x -W -b cn=configuration,dc=your,dc=domain -Z -D "cn=youruser,ou=container,dc=your,dc=domain" ...


1

Do you have an 'unprotected' page? Like a login page? If so, then you could use this page as the ELB health check. If not, can you add a simple page (ping.html) which does not require LDAP authentication?


1

as always, 'it depends'. I assume you are using some kind of linux. For one-off authentication, provided your ldap client supports GSSAPI, you can use the GSSAPI mechanism. So once you kinit successfuly and you have a tgt ticket, then you can use something like this (using the publicly available freeipa demo (http://www.freeipa.org/page/Demo): $ kinit ...


1

Is your ldap base really "uid=john.martin,ou=Users,dc=company,dc=com"? It could be, but I think that is your binddn, am I right? When using ldapsearch with simple authentication I use this: ldapsearch -h host -LLL -s sub -x -W -b dc=your,dc=base -Z -D "cn=youruser,ou=org,dc=your,dc=base" ldapfilter attributes Use the manpage of ldapsearch to understand ...


1

You should use SSSD and configure it to use LDAP instead of working with PAM directly. Then you can use the following in the SSSD domain configuration: access_provider = simple simple_allow_groups = groupname which is a very basic way to limit users, but you could also use access_provider=ldap and then use much more advanced LDAP queries to control ...


1

Finally found another piece of the solution while using PHP 7.x. Hope this helps someone else. Thanks to reddit user gripejones here: https://www.reddit.com/r/PHPhelp/comments/3tykpc/php_7_and_ldap/ PHP 7 requires an environment variable (LDAPCONF) set to the location of your config file. It used to be that you could put the config file either in this ...


1

I know this is an old question, but I just had to look up the same thing. You can verify that an AD account has become a room mailbox by checking the following attributes: msExchResourceMetaData -> ResouceType:Room msExchResourceDisplay -> Room msExchResourceSearchProperties -> Room If you're trying to access the actual capabilities of the room (or ...


1

PHP Version 5.6.20 debian and based: su aptitude install libldb-dev ln -s /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/libldap.so then, try to compile it


1

I ran into this issue trying to get PHP extensions involved in a Docker container. Here is what I had to do: apt-get install libldb-dev libldap2-dev ln -s /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/libldap.so \ && ln -s /usr/lib/x86_64-linux-gnu/liblber.so /usr/lib/liblber.so


1

I was able to take the openvpn-auth-ldap-2.0.3-14.fc21 SRPM and make a few really minor tweaks to update it for the current version of OpenVPN, which makes use of a new plugin version. I've tested it on CentOS 7 with OpenVPN 2.3.10-1 (installed from EPEL) and it seems to be working properly. While I'm reaching out to people about getting it in EPEL, it is ...


1

DNS and NTP being synced between your IPA server and clients is critical for kerberos tickets to be issued and considered valid. That is why it is recommended by RedHat to set up your IPA server as an NTP server. DNS is more optional; the critical part of DNS is that forward and reverse lookups succeed and match. The RedHat published guide on IdM (built on ...


1

you don't have to. You can use your existing dns and ntp server infrastructure but you will need to manage the ipa records on your on your own instead of having ipa take care of it. In fact it does not really matter what servers run the dns service as long as the clients get their answers from you the infrastructure in place. You can, for instance, delegate ...


1

Read the Friendly Manual: http://www.postgresql.org/docs/9.5/static/auth-methods.html You probably want to use https://github.com/larskanis/pg-ldap-sync to sync your LDAP users and groups to PostgreSQL


1

Thanks everyone, I just made a change in /var/lib/pgsql/9.4/data/pg_hba.conf with : local all all ldap ldapserver=ldap.server ldapport=389 ldaptls=0 ldapprefix="uid=" ldapsuffix=",ou=People,dc=domain,dc=com" And the authentication works!


1

No, there will be no inteference. ADLDS is the Microsoft version of a LDAP-directory. There is no default connectivity to your companys ActiveDirectory that is containig all your companys user abd computer accounts.


1

The problem was that group.exact not work with groupOfUniqueNames. I solved it by changing this rule: by group.exact=cn=people-admins,ou=groups,dc=example,dc=com write to this rule: by group/groupOfUniqueNames/uniqueMember=cn=people-admins,ou=groups,dc=example,dc=com write


1

If you're just starting out, I recommend switching to using groupOfNames rather than groupOfUniqueNames. Most systems that interact with OpenLDAP for group membership expect groupOfNames by default, including OpenLDAP itself. While they can generally be modified to use groupOfUniqueNames/uniqueMember (e.g. sssd-ldap ldap_group_member or your own use in ...


1

As @natxoasenjo points out, you shouldn't use the global catalog port to add users. I used port 389 and got passed this issue.


1

Do not use the global catalogue port for user creation. If your server requires a SSL connection, use the ldaps port which defaults to to 636. Also, please ensure the new password complies with your password complexity policy and password history policy. The unwilling to perform error message is a common result of a conflict with the password policy.


1

I haven't actually done this. But there are no other answers yet, so... According to classes/documentation, things are never really delted from the AD schema, they are only marked inactive. I am unsure what affect this will have on user accounts that were created when the attributes in question were deleted (aka marked inactive). I kind of doubt the ...



Only top voted, non community-wiki answers of a minimum length are eligible