Tag Info

New answers tagged

0

A Virtual Directory Server would solve your problem. Definition of Virtual Directory Server from wikipedia: A virtual directory or virtual directory server in this context is a software layer that delivers a single access point for identity management applications and service platforms. A virtual directory operates as a high-performance, lightweight ...


0

LDAP Active Directory does not provide LDAP authentication but kerberos authentication instead. If you retrieve AD LDAP (with ldapsearch for instance) users accounts, you will see the Password field left blank, because this is not the place for authentication. OpenLDAP provide LDAP authentication (which is at some point similar to apache basic auth: ...


0

Windows machines have the capability to delegate (trust) authentication to a single Active Directory (or old-style Windows NT) domain in a process called "joining" the domain. That domain could have trust relationships with other domains or Kerberos realms, but that's a relationship between the Domain Controller computers and the foreign domains or realms. ...


0

I'm not quite sure what you're looking for, but... o=MidlandCollege looks ok so far. To have more fun with the eDirectory, I strongly advise to having a look at Apache DirectoryStudio. It's a GUI, but you'll see the LDAP calls, so you can derive some more knowledge from this.


0

To answer my own question it isn't possible to mix these two types of authentication methods this way with Apache. So I turned to use SCM-Manager which is capable (with a little patch) to handle this situation.


0

If your AD environment uses Kerberos for authentication, then in principle, moving from the AD functions to a combination of a Kerberos server (e.g. MIT's krb5) and an LDAP server would work (running on Linux). Mac OS X clients supports Kerberos authentication and SSO; Safari (and Chrome, Firefox) support SPNEGO extension for handling Kerberos auth over ...


1

By far the most important thing with grails and AD is to use ActiveDirectoryLdapAuthenticationProvider rather than LdapAuthenticationProvider as it will save a world of pain. You can then set up AD authentication in just a few lines: In resources.groovy: // Domain 1 ldapAuthProvider1(ActiveDirectoryLdapAuthenticationProvider, "mydomain.com", ...


0

Do you get the same result with get-adobject (instead of get-aduser)? Or try using the .NET Directory Searcher object $rootDSE = [adsi]"LDAP://RootDSE" $dnDomain = $rootDSE.defaultNamingContext $search = New-Object DirectoryServices.DirectorySearcher([ADSI]"") $search.searchroot = [adsi]"LDAP://$dnDomain" $search.Filter = ...


0

As to the system you're aiming at, it could be worth you going for Free IPA because if, in the future someone implements some Active Directory boxes, it's pretty easy to link in. As to migration.. Well, at least you're talking small scale so "etch-a-sketch end of the network" is an option. Sudo rights, obviously that's vital, with that small amount of ...


1

Requests for learning materials and tutorials are off-topic. Which sequence of actions to follow, what to pay attention to, how to minimise the risks of data loss, how to minimise the down-time for users, etc? Start by deciding on your requirements and scope. Write them down and have them reviewed. Think about setting up Kerberos in addition to LDAP ...


1

First, questions for tutorials etc. are off-topic. Some thoughts: You are right, information regarding this is scattered, often out-of-date and unreliable. As an example, you find lots of informations on how to configure OpenLDAP with config files, but very little about cn=config. My guess is that this is a result of the fact that every migration like ...


0

"groupofnames" objects MUST have a cn attribute and a member attribute (see rfc2256 or look at your schema definition). I'll be interested to hear from others but as far as I can tell your options are one of these: Browse your schema to see if any other group-type objects exist that don't have a member attribute under the 'MUST' qualifier, and use it ...


2

Figured it out. I had to add "cn" to the AuthLDAPURL as well as add in a AuthLDAPRemoteUserAttribute. Now Nagios (well Apache) will see the REMOTE_USER environment variable as the cn AuthLDAPURL "ldap://my.ldap.server:389/dc=my_dc,dc=my_dc,dc=net?sAMAccountName,cn?sub" NONE AuthLDAPRemoteUserAttribute cn


0

Setting the LDAP filter to uid=zimbra... is obviously wrong, as you would limit the search to exactly that user. This filter can be used to limit the search to things like user groups or a sub-ou. Leave it empty. It might be that you need to use the uid=zimbra part (or just zimbra) in the Account field if it needs administrative access to the LDAP ...


0

If you have a test system without a real hostname (like ldap.example.org) and name it just ldap, the default configuration of OpenLDAP on Debian(?)/Ubuntu (which I guess you use) will assume an LDAP tree with the name dc=nodomain and create appropriate ACL rules. Really, your best approach is to set a complete FQDN and let dpkg --reconfigure slapd do it's ...


0

Frankly, your whole schema is a singular mess. To define an objectClass in your schema, you need an olcObjectClasses: line, with the : at the end. The attribute list has to be a list of the NAME entries, not the DESC, so it needs to be MAY ( genderAttr $ dobAttr etc. NAME 'nationalityAttr misses a closing ' Is zipAttr a ZIP code or a PIN? ...


0

$ ldapmodify -D "cn=directory manager" -w secret -p 389 -h server.example.com dn: uid=test2,ou=People,dc=example,dc=com changetype: modify add: nssizelimit nssizelimit: -1 - add: nslookthroughlimit nslookthroughlimit: -1 This solution worked for me in case of non-admin user performing ldapsearch


5

If you don't have LDAP configured on the NFS server you lack the username <--> UID and groupname <--> GID number mappings there. No problem you can simply use the numerical UID and GUID values in chown. Normally though you really should have LDAP and Kerberos enabled on the NFS server, as that not only allows you to use the user and group names in ...


1

Running nslcd in debug mode shows the problem: $ $(which nslcd) -d ... nslcd: [8b4567] <authc="user.name"> DEBUG: myldap_search(base="dc=sub,dc=example,dc=org", filter="(&(objectClass=posixAccount)(uid=user.name))") ... nslcd: [8b4567] <authc="user.name"> DEBUG: ldap_result(): end of results (0 total) nslcd: [8b4567] ...


0

This worked for me perfectly. Install LDAP libraries: apt-get install libldb-dev Create SO linker files: updatedb --prunepaths=/mnt cd /usr/lib if [ ! -L liblber-2.4.so.2 ]; then ln -s "$(locate liblber-2.4.so.2)" fi if [ ! -L liblber-2.4.so.2.8.3 ]; then ln -s "$(locate liblber-2.4.so.2.8.3)" fi if [ ! -L liblber.so ]; then ln -s ...


1

# we decode it, we hex-dump it and store it in an array to # re-order it in the format expected by LDAP BASE64_DECODED=$(echo $OBJECT_ID | base64 -d -i) G=($(echo ${BASE64_DECODED} | hexdump -e '1/1 " %02X"')) OBJECTGUID="${G[3]}${G[2]}${G[1]}${G[0]}-${G[5]}${G[4]}-${G[7]}${G[6]}-${G[8]}${G[9]}-${G[10]}${G[11]}${G[12]}${G[13]}${G[14]}${G[15]}" I used the ...


0

(Assuming you're on Ubuntu) Please try configure --with-ldap-libs=/usr/lib/i386-linux-gnu/. If doesn't help, please extend your answer with details on which Linux distro do you use and which project you're building.


1

For the next user that needs to do this, the correct answer is, if you are using sssd for ldap, then inside the /etc/pam.d/db2 file created as part of the IBM directions, replace "pam_ldap.so" with "pam_sss.so" and it will work.


0

Ok, I was able to solve it. I needed a symlink from /usr/local/etc/openlad/ldap.conf to /etc/ldap/ldap.conf


0

Well after a bit of troubleshooting, I found out that there was a conflicting ldap.config file in /opt/local/etc/openldap/. I guess that was added when I used macports to install php53-ldap. I ended up symlinking /etc/openldap/ldap.conf to the /opt/local/etc/openldap/ldap.conf file and it worked.


2

ldapsearch -x -ZZ -h localhost -D "cn=admin,o=tree" -b o=tree mail |grep mail: will provide you with just email addresses. You can get as detailed as you want.


0

Please do the following. Log in to the iManager if it is installed you will find it at https:///nps Login as Admin or with equivalent rights. Go within the Menu eDirectory Maintenance and run the Import, Convert, Export Agent or ICE to export an leif file. Than you follow this TID https://www.novell.com/support/kb/doc.php?id=7003319 and, after you ...



Top 50 recent answers are included