401 reputation
214
bio website paralint.com
location Montreal, Canada
age
visits member for 3 years, 7 months
seen yesterday

I like smart people who get things done. I do my best everyday to be one of them.

I code mostly in C++, Python, Java and... whatever comes my way. I also like to understand a problem down to its roots, a process also known as debugging.

LinkedIn and Careers profiles.


Jul
19
comment AppFabric vs AD LDS
If your solutions can use AD-LDS, why not use it instead of your SQL cluster? Or else won't you have to somehow switch your authentication protocol (LDAP instead of SQL) in near realtime, when a failure occurs ?
Jun
4
comment Retreive the current Kerberos KVNO from Active Directory
Thanks for you answer. The problem turned out to be irrelevant with the key version. But your answer is "accept" worthy, by large !
Jun
2
comment Retreive the current Kerberos KVNO from Active Directory
I forgot to mention the client is Linux. Active Directory must be holding it, since it increments it each time ktpass is called.
Dec
14
comment Is there a Kerberos testing tool?
That is what I was looking for. It never occurred to me that I could restart the netlogon service. From server_A, I use net view \\server_B I get the trace I need.
Dec
14
comment Is there a Kerberos testing tool?
The exchange with the KDC
Dec
12
comment Active Directory LDS classes: what's the difference?
If a LDAP directory was a file system, organizationalUnit would be folders and users would be files. Groups would be zip files, I guess. Obviously, a directory (LDS) has much more to offer...
Dec
11
comment Issue with a secure login - Why am I being redirected to the insecure login?
What happens if you enter a wrong password on purpose at step 3 ? What is the url at step 4 ?
Dec
11
comment Issue with a secure login - Why am I being redirected to the insecure login?
I doubt it. I understand that the location only changes to http.
Dec
5
comment Replication of lockoutTime attribute is not urgent on AD-LDS
I was reading an old version of MS-ADTS. The latest version does mention urgent replication. Will read and update the question.
Dec
5
comment Replication of lockoutTime attribute is not urgent on AD-LDS
The results are the same with ldifde (which I use most of the time), ldp and Apache Directory Studio. I would prefer urgent notification, but would settle for normal replication.
Dec
4
comment ADSIEdit freezes gettings properties of a group with hundred of thousands members
FYI, Microsoft support looked at it. ADSIEdit does try to allocate memory for all the data when it comes to attributes. Will not fix.
Sep
29
comment ADSIEdit freezes gettings properties of a group with hundred of thousands members
Indeed. LDP can also handle large objects. On an related note : installating LDS with the tools does not require a reboot, but installing the AD and AD-LDS tools requires a reboot
Sep
29
comment ADSIEdit freezes gettings properties of a group with hundred of thousands members
We could bring it down to about 30k, but that's still too much for ADSI. We don't have much control over the third party software requiring such large groups.
Sep
24
comment Does AD LDS support account lockout?
And if you set a policy to be applied locally on a domain machine, it will take over. No need to lower the domain wide policy to accomodate AD-LDS users (which might have other needs).
Aug
30
comment How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site?
If your LDS server is on the same domain as your Active Directory, then make the users proxy users (userProxy or userProxyFull object class). That way, the LDS will be free of passwords. It will not free you from creating the users and assign them to groups, though.
Aug
30
comment How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site?
After you have that discussion with them, update the post and tell us what they're affraid of.
Aug
30
comment How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site?
AD LDS does not sync anything. You must use ADAMSYNC, scripted to run periodicaly.
Jul
4
comment Setting up SSL with 389 Directory Server for LDAP authentication
You can check your ssl configuration with this : openssl s_client -connect fqdn.of.the.ldap.server.or.ip:636. The server should answer back with the certificates. If not, there is a problem with your server's configuration. Update your question with the results.
Jun
28
comment Tomcat session managment - independent session in one host
Are dir1 and dir2 different applications or different path in a single application ?