Re: Possibly slightly O.T.: Why FQDN required to do simple bind with "ldapsearch"?

"Ace Fekay [MVP]" <PleaseAskMe@xxxxxxxxxxxxxx> wrote in message
news:u$3aYrpYGHA.1200@xxxxxxxxxxxxxxxxxxxxxxx
In news:%23njWQ$oYGHA.4836@xxxxxxxxxxxxxxxxxxxx,
ohaya <ohaya@xxxxxxx> stated, which I commented on below:
Hi,

I was doing some testing, using ldapsearch from a Solaris machine, to
access Active Directory. I was trying to use a simple bind, and
initially could not get a successful access, until I started using a
fully-qualified domain name (FQDN) for the hostname parameter.

I'm not sure if this is more of an AD question, or an ldapsearch
question, but I was wondering if anyone might know why I had to use
the FQDN for the ldapsearch hostname parameter in order for the
simple bind to succeed?

Thanks,
Jim

AD is not like NT4 where it works using NetBIOS. Any ldap search is FQDN
based to 'find' the ldap server. AD is DNS based. Server names are tagged
with an SPN (Server Principal Name), which is the machine's FQDN., and how
it finds it to bind to it.

However, since most Windows programs which use DNS
lookups WITH the built-in name resolving would fail over
to NetBIOS lookups if all DNS methods fail.

So one might legitimately wonder why this didn't happen here.
(Notice this is different than apps like IE which might actuall
DO a "NetBIOS resolution" directly under certain conditions.)

Within an LDAP query the DISTINGUISHED name is the
prescribed naming method for the QUERY itself however.
(Not the computer being queried.)

I am curious. Perhaps his machine doesn't have its domain
name set in the System Control panel or it's set to a different
domain than he was querying.

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]


.

Relevant Pages
Loading