Tag Info

Hot answers tagged

16

With the versions of Samba found in current versions of common distributions you can certainly have a Linux machine act as an NT-style domain controller (this has been the case for some time). I believe that taking part in an AD based domain is being actively worked on but not yet ready for production use, though it isn't something I've looked at recently ...


11

LDAP cannot provide Single Sign On. There is a big difference between being able to use the same users and having Single Sign On, which means that you login into all systems at once, with a single login form. Otherwise, LDAP is perfectly feasible for using the same login information in all systems. OAuth is just a protocol for doing the Sign On and it can ...


9

First of all - and in case other users happen to visit this page - there are only certain authentication methods that allow you to do promptless SSO. These are NTLM and Kerberos. LDAP - on the other hand - will never give you promptless SSO. NTLM is actually NTLMv1 and NTLMv2. These are very different and NTLMv1 is deprecated because of serious security ...


8

There are a couple things you can do with Google Apps. You can setup a SAML server connected to your AD network and then setup Google to authentication your Google Apps access against the SAML server. We have used a php application called simpleSAMLphp because we already have servers setup to run PHP and we have developers with php skills. The drawback of ...


8

Google has led you down the right track. Ideally you want both LDAP for the central user management and Kerberos for it's added security and SSO. LDAP alone will get you centralized user management but users will still have to re-authenticate with each service they are connecting too. That's where Kerberos comes in which issues the client a ticket which ...


8

Its not hard and it's perfectly practical. We have a few hundred dual boot desktop machines that use AD auth as well as a number of servers which use AD auth to enable windows clients to use their samba shares without explicit auth by the users. There was another article on SF about what you need to do. Basically you need to config kerberos, winbind, nss ...


8

What's the question? The first one is the user logon name. The second one is the pre-Windows 2000 user logon name. The third one is the User Principal Name. All three are valid and exist by default for every user account. All three can be used to log in to the domain. You don't have to assign them at all. Based on your edit, when you created the UPN did ...


7

Yes, it is quite possible to push out certificate trusts to users. This is done through Group Policy. You can find it under Users -> Windows Settings - > Security Settings -> Public Key Policies. From there you can manage which certificates and certificate-authorities are to be trusted. The same hive exists on the Computer side of the GPO as well. You'll ...


7

It is now possible in mod_auth_kerb 5.4 to strip the realm from REMOTE_USER with the following config directive: KrbLocalUserMapping On Of course, no Debian/Ubuntu version seems to ship 5.4 yet (sigh).


6

Authenticating is absolutely simple using Likewise Open. http://www.likewise.com/products/likewise_open/index.php Nearly my entire Linux infrastructure has centralized authentication and user management thanks to Likewise Open. It's stunningly simple to install and implement. I cannot possibly say enough good about it. As a note, UIDs and GIDs are ...


6

My gut says you've got a very large security token, possibly because the user is a member of a large number of groups. The AD Kerberos implementation is going to provide Apache with a Privilege Attribute Certificate (PAC) by default. This structure can be large if the user is a member of a significant number of groups. You can use the tokensz.exe tool to see ...


5

Short answer: No. However, like @Nathan-C described, you can stand up the required services using Azure Iaas (either DC+DirSync+ADFS or DC+Dircync w/pwd sync) in order to achieve single sign-on between your your Office365 apps and your on-prem apps. You would need to deploy a VPN link between Azure and your local network. Azure AD is NOT "regular" Active ...


5

Perhaps "Centralized Authentication".


4

The Official OpenAM Website has a Downloads section. Quoting the page you linked to: If you have not already done so, download and unzip the openam_953.zip file The Client SDK and samples are then available in the zip-root/openam/samples/openam-client.zip (corrected for current version of software, 9.5.3 as opposed to 9.0)


4

I have attempted the exact same thing as you have, specifically attempting to manage Linux and Windows with the same toolset, and have found nothing but pain and frustration. The two are so very different in setup, outlook, and design assumptions that tools that work well on one (SSH, PowerShell) are ugly, fragile hacks on the other platform (yes, there ...


4

I've found the Spinlock guides excellent for this; I've used them to set up an SSO environment with ssh ticket forwarding for a development office of about 30 developers. There are a lot of different components to this and it's somewhat of a bear to manage - you'll want a good LDAP client like Apache's Directory Studio for user maintenance. If there's an ...


4

When I left my last job, they had to go through much the same process. I had managed to get access to pretty much every root-like password we had. There was a mini-project to map out everything I had access to, and I gave them lists of where I knew I had access. My whole last week I had steadily reducing rights as various passwords, ACLs, and ...


4

We decided that the combination of adding "ClearPass" to CAS and modifying the Exchange setup was going to be too hard to maintain, so our final solution is something like the squirrelmail solution that we didn't like. That is, we send HTML like this to the user ($something generally means an already properly escaped variable) from a button they push in our ...


4

Samba4 is going to be able to do that, but it's still in alpha. If you're adventurous you can play with the latest releases.


4

Regarding the first question: I've worked with another LDAP system that allowed 'login' against various user attributes. The solution was to do two connections. The first connection, probably anonymously bound, queries LDAP with the user-supplied information to locate the RDN of their user object. The second connection attempts a bind-with-password with the ...


4

It's the whole point of the authn/authz separation in 2.2 that you can authenticate with one mechanism, and authorize with another. Authentication provides you with a setting of REMOTE_USER, which you then can use authz_ldap against. In addition, authn_ldap searches then for a user (converting the REMOTE_USER to a DN if found, using search criteria you have ...


4

Your pam configuration for passwd usually /etc/pam.d/chpasswd is making a call to pam_krb5.so either directly or as part of an include statement. Kerberos (GSSAPI/SPNEGO) for HTTP SSO is handled outside of pam making the most expedient solution to remove it entirely from your pam config (hopefully using a similar method as to what put it in).


4

When ADFS 2.0 is used as a service provider (i.e. RP STS) it consumes assertions at URLs like https://sts.contoso.com/adfs/ls/ . The assertion consumer service URL is specific to the service provider. If ADFS is the service provider then the metadata URLs publish the assertion consumer URLs as follows. <AssertionConsumerService ...


3

Got this straightened out.. On the Session Hosts.. In Remote Desktop Configuration... RDP-TCP Properties... Log on Settings Tab... I did not have selected "Use client-provided log on information" Once I selected that, on each of the session hosts in the farm. no more double login Hope this helps someone else out


3

The KVNO is the version number of the keytab, each time you generate a new keytab or the password is changed the KVNO gets incremented. The number should match what is inside the Active Directory. This error indicates that the keytab contains an entry that the master considers to be out of date. You can see the KVNO in the directory by using adsiedit.msc. ...


3

I finally managed to do this with the configuration below. splunk.example.com:8000 is the actual site to be accessed, cas.example.com is the CAS server. The proxy is on the same machine and will be defined in a VirtualHost. Apache The VirtualHost which serves the to-be-SSO-ed application (splunk.example.com:8000) <VirtualHost splunk.example.com:80> ...


3

No, Websphere is not required. Domino can use its own SSO (by using Domino LTPA keys). Here's a simple guide: http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Configuring_single_sign-on_with_an_LTPA_token_on_IBM_WebSphere_and_IBM_Lotus_Domino_platforms#Configuring+Lotus+Domino+ Some things to check: Is the hostname specified in the Web SSO config document ...


3

No, this is not going to work, at least not in any reliable form, and it's quite likely these files are needed before NFS shares could be mounted, which would make it impossible. If you have such problems with LDAP, you might have a look into NIS, which is an kind of an (ancient) predecessor of LDAP and is arguably easier to get running. But as I said, ...


3

It may be that the account is both a valid Microsoft Account (formerly Live ID) AND a valid Organisational Account (Azure AD). This can happen (you have a Live ID for years then your company signs up for Office 365) and leads to all sorts of fun and games because 'home realm discovery' defaults to Azure AD. In the first login box provided by Azure try ...


3

My answer is going to be "why would you want to?" You're probably far better off implementing a Windows DC; it won't cost you that much, and you'll be on a supported and more predictable environment. AD isn't difficult - there's a lot in it, but it's not difficult. So long as you don't do bizarre or wacky stuff with it, it's incredibly robust and has low ...



Only top voted, non community-wiki answers of a minimum length are eligible