Hot answers tagged

5

I can recommend LDAP for rocket scientists, very nice and thorough intro to the protocol To answer your question: distinguishedname: full path of the object in the tree. So if the ldap server has a base of dc=domain,dc=tld and the object is in the container ou=users, then the dn could be cn=object,ou=users,dc=domain,dc=tld rdn is in the example cn=object, ...


5

2 ways so far: canonical name: get-adgroup -identity "your group" -properties canonicalname | sel -property canonicalname [enter] canonicalname Your.Domain/ou name/ou name/your group using the distinguishedname: $group = get-adgroup identity "your group" [enter] ($group.DistinguishedName -split"," ,2)[1] [enter] ou=name,ou,name,dc=your,dc=domain,dc=...


4

Even if this was possible, it is a horrible idea. Just use key authentication. That is the canonical way to allow programmatic access via ssh from one system to another.


3

You have to negate matching the wildcard * (any value) : (&(objectCategory=computer)(whenCreated>=20160101000000.0Z)(!description=*)) From Microsoft's LDAP Query Basics: The ! operator in conjunction with the wildcard operator will look for objects where that attribute is not set to anything.


2

I am afraid it is not supported by directive AuthLDAPURL from module mod_authnz_ldap. At least at the time i wrote these lines. A bug track report has been published and describes exactly the behaviour you are facing : https://bz.apache.org/bugzilla/show_bug.cgi?id=44302 if you enter ldapi:///, it is (silently) treated as ldap://localhost:389, that ...


2

If you always have folks leaving & joining, and you care a bit about security you might want to consider multi factor authentication along with Teleport. The 'cluster' concept in Teleport should let users automatically login to new hosts in a cluster with no intervention. You can also specify the duration of SSH keys and create/delete users across ...


2

dsquery uses the credentials of the logged in user to authenticate (bind) to the directory. ldapsearch does not. Look at the -D and the -W/w options for ldapsearch.


2

With nslcd -d I saw that the address was already taken by the host system. I fixed it by mounting the socket when executing docker run with -v /var/run/nslcd/socket:/var/run/nslcd/socket


1

Here's the link to the AD Schema Documentation: https://msdn.microsoft.com/en-us/library/ms675085(v=vs.85).aspx


1

a while ago while debugging a graphite ldap installation ldap.set_option(ldap.OPT_DEBUG_LEVEL, 65535) which I got from the graphite docs (http://graphite.readthedocs.io/en/latest/config-local-settings.html). It might tell you more about what is going on in your app.


1

Roger's link has since rotted, here is the same on the Internet Archive's WayBack Machine, as of the last date archived before he changed his site: https://web.archive.org/web/20150530064010/http://rogermoffatt.com/2011/08/24/ubuntu-openldap-with-ssltls/ I've also taken the liberty to append his content below as well: The Starting Point I’m going to ...



Only top voted, non community-wiki answers of a minimum length are eligible