I've setup OpenLDAP as AD proxy according to: https://wiki.samba.org/index.php/OpenLDAP_as_proxy_to_AD

Everything's working fine for clients using standard bindDN of full dn: attribute (e.g. cn=jdoe,ou=users,dc=example,dc=com)

Some of the clients are using userPrincipalName as bindDN, which is perfectly ok with AD, but not with the OpenLDAP proxy, which throws an error upon connect:

conn=1002 op=1 do_bind: invalid dn (jdoe@example.com)
send_ldap_result: conn=1002 op=1 p=3
send_ldap_result: err=34 matched="" text="invalid DN"
send_ldap_response: msgid=2 tag=97 err=34
conn=1002 op=1 RESULT tag=97 err=34 text=invalid DN

I tried to rewrite the bindDN of userPrincipalName using rwm-rewriteRule from the rwm overlay. That didn't work, although it works with standard bind dn's (e.g. cn=jdoe,ou=users,dc=example,dc=com)

This doesn't work:

rwm-rewriteRule "(.+,)@example.com$" "cn=$1,ou=users,dc=example,dc=com"  ":"

This works:

rewritin ou=users for ou=employees as a test:

rwm-rewriteRule "(.+,)?ou=users,dc=example,dc=com$" "$1ou=employees,dc=example,dc=com" ":"

Is there a way how to rewrite bindDN of jdoe@example.com to bindDN of cn=jdoe,ou=users,dc=example,dc=com?

Here's my current config:

include                 /etc/openldap/schema/core.schema  
include                 /etc/openldap/schema/cosine.schema  
include                 /etc/openldap/schema/inetorgperson.schema  
include                 /etc/openldap/schema/misc.schema  
include                 /etc/openldap/schema/nis.schema  

modulepath              /usr/lib64/openldap/  
moduleload              back_ldap  
moduleload              rwm  

pidfile                 /var/run/openldap/slapd.pid  
argsfile                /var/run/openldap/slapd.args  

database                ldap  
readonly                yes  
protocol-version        3  
rebind-as-user          yes  
uri                     "ldap://X.X.X.X:389"  
suffix                  "dc=example,dc=com"  
overlay                 rwm  
rwm-rewriteEngine on  
rwm-rewriteRule "(.+,)@example.com$" "cn=$1,ou=users,dc=example,dc=com"  ":"  
logfile                 /var/log/slapd/slapd.log  
loglevel                -1  
TLSCACertificatePath /etc/openldap/certs  
TLSCertificateFile "OpenLDAP Server"  
TLSCertificateKeyFile /etc/openldap/certs/password  
  • your bind user is the user which connects and searches the schema - do you mean user filter? bind user should be a static service account, user filter should search by samaccount or UPN – Sum1sAdmin Jan 18 at 12:40
  • There's no bind user configured at the moment. So the OpenLDAP proxy should be configured to bind to backend AD with a service account to search for the user entry with particular UPN and retrieve the password for the user with that particular UPN? Do you have some example of such configuration? – Majco Jan 18 at 13:02
  • can you print you current configuration? – Sum1sAdmin Jan 18 at 13:04
  • For some reason my registration to serverfault.com failed and I ended up with different account. Will repost this question from that account, as I will probably lose access to this question when I close this browser session. – Majco Jan 18 at 15:13

It's right that you can rewrite bind-DNs with slapo-rwm but those have to be DNs.

So you could rewrite the short DN uid=user@example.com to uid=user,dc=example,dc=com even by searching the entry with filter (attr=user@example.com).

But the short form to be rewritten must be a valid DN string representation as defined in RFC 4514 and not just a user principal name user@example.com as with MS AD.

See examples in slapo-rwm(5).

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.