Re: ADAM Bind Redirection question

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Dmitri Gavrilov [MSFT] (dmitrig_at_online.microsoft.com)
Date: 07/30/04 

Date: Fri, 30 Jul 2004 15:40:30 -0700

ADAM relies on windows auth mechanisms, it does not keep an ldap connection
to AD. That's the reason why we require that ADAM machine is joined to a
Windows domain in order to enable proxy binds.

Doing it over LDAP is more flexible because you could authenticate proxies
from different forests, and (potentially) from non-windows domains that
support ldap. Although it is unclear where the token will come from.

But the LDAP way is more complex to implement too. We have to cache LDAP
connection(s), perhaps manage creds to connect to the server, invent a more
generic lookup mechanism (mapping proxy to an LDAP user), etc. Maybe we will
do this in the next release. There should be enough demand for this though. 

-- 
Dmitri Gavrilov
SDE, Active Directory Core
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com> wrote
in message news:#v#pBjndEHA.3148@TK2MSFTNGP10.phx.gbl...
> Is that how it works?  For some reason I assumed that ADAM actually tried
to
> do an LDAP bind to its DC using the credentials supplied.  It didn't occur
> to me that you just call LogonUser.
>
> Thanks for the clarification.
>
> Joe K.
>
> "Dmitri Gavrilov [MSFT]" <dmitrig@online.microsoft.com> wrote in message
> news:%2362qFgldEHA.3528@TK2MSFTNGP12.phx.gbl...
> > I think the question was what mechanism is used to authenticate the
proxy,
> > i.e. how ADAM talks to AD when it gets a proxy auth request.
> >
> > ADAM uses standard windows APIs, LogonUser specifically. This results in
a
> > logon request, which is done either Kerberos or NTLM over secure
channel.
> > So, in any case, the password is never exposed in clear text.
> >
> > -- 
> > Dmitri Gavrilov
> > SDE, Active Directory Core
> >
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> > Use of included script samples are subject to the terms specified at
> > http://www.microsoft.com/info/cpyright.htm
> >
> > "Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com>
wrote
> > in message news:OdBR#LfdEHA.2376@tk2msftngp13.phx.gbl...
> > > Generally, the idea here is to use AD secure binding with Active
> Directory
> > > accounts and encrypt the channel with SSL for ADAM user binds, like
you
> > > said.  The trick from my point of view is knowing how to recognize an
> ADAM
> > > user from an AD user by their username so you know when to add the
> Secure
> > > flag.  Having very different UPN suffixes should work here.
> > >
> > > When using secure binding with AD, SASL is used.  Under the hood it is
> the
> > > Negotiate protocol which will end up as NTLM or Kerberos.
> > >
> > > Joe K.
> > >
> > > "Seow" <seowfun@hotmail.com> wrote in message
> > > news:cd21d7dc.0407291603.56fe821@posting.google.com...
> > > > I have a SSL question regarding bind redirection in ADAM.  Since
bind
> > > > redirection only works for simple bind, and simple bind send pw in
> > > > plaintext across the network, we need to setup SSL connection
between
> > > > the client & ADAM for security reason.
> > > >
> > > > What about connection between ADAM & AD?  I don't think we need to
> > > > setup SSL between these two, as the pw should be sent thru secure
> > > > channel, right?  If so, what mechanism does it use?  SASL?
> > > >
> > > > Thanks!
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: is the AD LDAP interface domain trust aware?
    ... This might also be the kind of thing that you could use ADAM and MIIS to ... Essentially, you build the forest you need for your Windows stuff, ... >> can I use LDAP query's on this 2 domain situation on one domain ...
    (microsoft.public.windows.server.active_directory)
  • Re: Keep ADAM proxies up-to-date through LDIFDE
    ... ADAM is AD LDS it's stamped all over it in W2k8 server so we just ... I'm not so sure about the currency of your perf observations; other LDAP ... surprise" does not cut it IMO if we want to win people over to ADAM. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Virtual List View functionality in ADAM and Outlook
    ... point to ADAM from outlook using generic LDAP then I at least have a solution ... As for VLV- ADAM does support it. ... continue to try to manage this volume of information with MIIS? ... but my understanding of VLV's is that the client has to ...
    (microsoft.public.windows.server.active_directory)
  • Re: AD or ADAM as a user database
    ... SQL system. ... ADAM with SSL will ... Learning how to design LDAP schema isn't hard as there isn't too much to it, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Virtual List View functionality in ADAM and Outlook
    ... I guess you can configure multiple LDAP services, pointing to the same ADAM ... If I can somehow do the same thing using Outlook/ADAM, ...
    (microsoft.public.windows.server.active_directory)