0

I'm working on a proof of concept that requires me to test authentication against three different Active Directory domains. Each domain controller in each domain will have a different set of users. A web application will be what needs to authenticate a user against each of these domains and if the user successfully authenticates, it should send a reply. Now, I didn't know much about this, but it appears the best option for this is OpenLDAP. I have spent several days trying to get OpenLDAP working properly for this, but I am having no luck and I'm just getting more and more confused.

Here's what I had done:

  • Set up an Oracle Unbreakable Linux VM, with a basic server setup.
  • Followed this article: https://ltb-project.org/documentation/general/sasl_delegation
  • But some of the steps were different and after getting help from another website, I was told that my initial VM already had OpenLDAP installed and that I had to create a second instance that wouldn't conflict with the original OpenLDAP installed. So instead of using port 389 and 636, I had to use 390 and 637.
  • But when testing the secure connection, it failed.
  • I've tried to set up the "meta" connection to all domain controllers, but that also has failed.

I'm not sure what else to do so I'm hoping someone has an easy solution for what I need to do in a relatively small amount of time as I was supposed to have a demo for this last week. I'm somewhat new to Linux, but I've used it for year, just not for something this complicated. Does anyone have a quick solution, tutorial that could help me??? As well, I'm open to any Linux distribution. Is there one that would work best?

Improve this question
5
  • Asking what would work the best is not the best structure. That is asking for opinions, which will typically get questions closed as off topic. You may want to be asking how to make this work. I think Docker has prebuilt OpenLDAP images. They may be a good fit for development needs.
    – Cory Knutson
    Jun 10, 2017 at 3:55
  • Thank you. So should I ask what exactly I am having issues with instead after trying to configure OpenLDAP? I'm up to a point where I trying to set up saslauthd to work with it, but I'm confused about some of it. Can someone help me with that?
    – Christian Palacios
    Jun 12, 2017 at 19:27
  • Direct from the flags for closing questions. Questions seeking installation, configuration or diagnostic help must include the desired end state, the specific problem or error, sufficient information about the configuration and environment to reproduce it, and attempted solutions. Questions without a clear problem statement are not useful to other readers and are unlikely to get good answers. Also see serverfault.com/help/how-to-ask
    – Cory Knutson
    Jun 12, 2017 at 19:34
  • If you are past the point that this question was asked about, you can delete this question and ask another. You can also update the question with new information and refine what you are looking for. The more specifics you can give on your situation AND what you are looking for, the better your answers can be,
    – Cory Knutson
    Jun 12, 2017 at 19:36
  • No problem, can I put down where I'm at in the whole process and start to get help with that? I have A LOT of questions on how this all works.
    – Christian Palacios
    Jun 13, 2017 at 21:32

1 Answer 1

Reset to default
0

Ehh maybe i am reading this wrong, but as Active Directory responds to LDAP, you could just do an ldapsearch on your user you want to authenticate - authenticating as the user self, and check on success - one of your 3 directories at the time. For this you might not need a metadirectory - or i read your description wrong ;-) ldapsearch -Hldap://ServerIP -Dcn=lname,cn=users,dc=domain,dc=xxxx,dc=xxxx,dc=xxxx,dc=com -wpassword -bcn=lname,cn=users,dc=domain,dc=xxxx,dc=xxxx,dc=xxxx,dc=com -sbase cn then you should find a way to read the password from a file so it is harder to see in memory

Improve this answer
1
  • The web application needs to connect to the proxy (OpenLDAP/whatever) in order to authenticate. I'd rather have the application just use the proxy instead of running the ldapsearch command, especially if it's a Windows application.
    – Christian Palacios
    Jun 13, 2017 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .