1

I'm getting the following error when Apache (running on Solaris) tries to authenticate against LDAP for a specic user for SVN server:

auth_ldap authenticate: user abc authentication failed; URI /svn/reponame [User is not unique (search found two or more matches)][No such object]

The root cause is that there are users with the same username in two different domains. Is it possible to specify the domain as part of the user login? I've not been able to get this to work. I've tried domain\username, username@domain, but authentication fails.

Any ideas?

  • Could you show content of the AuthLDAPURL? – ALex_hha Aug 7 '13 at 10:34
  • Sure... ldap://domain.com:3268/DC=com?sAMAccountName?sub – macleojw Aug 7 '13 at 10:37
0

Your search, based on the AuthLDAPURL you added in the comments (edit it into the question please) is looking at the Global Catalog (the port 3268) which shows all users in the Active Directory forest, but searches using the sAMAccountName attribute, which is only globally unique within a single domain.

Therefore change your AuthLDAPURL from:

ldap://domain.com:3268/DC=com?sAMAccountName?sub

to something more like:

ldap://domain.com:3268/DC=com?userPrincipalName?sub

And tell people to login with their UPN, which would be bobSmith@myDomain.domain.com

Now if you want to login with a simpler value, then you have to figure out a way to distinguish users by something truly unique.

Likely email is unique, so you possibly could change it to:

ldap://domain.com:3268/DC=com?mail?sub

Thus they would need to login by specifying their email.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.