Re: ADAM Bind attribute question

From: Dmitri Gavrilov [MSFT] (dmitrig_at_online.microsoft.com)
Date: 03/03/05 

Date: Wed, 2 Mar 2005 17:05:32 -0700

You are mixing things up.

rdnAttId only affects how DNs are built. If a class has attribute X as
rdnAttId, then objects of this class will have DNs starting with
X=object_rdn,CN=container_rdn,...

When you are binding, you only have two options:
1) specify the full user DN as the username
or
2) specify user's userPrincipalName as username.

You cannot bind with CN alone.
You cannot bind with UID alone. 

-- 
Dmitri Gavrilov
SDE, Active Directory Core
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Jims" <biz@neocasa.net> wrote in message
news:eI6iSG3HFHA.2648@TK2MSFTNGP14.phx.gbl...
> By default I'm unable to bind using userPrincipalName.  Is it necessary to
> add userPrincipalName to rDNAttID in the class definitions on a new
instance
> in order to get this to work?  We are well under way using CN as the rdn
for
> binding.  Do you see this as a risk or potential problem?
> Thanks,
> Jim
>
>
> "Dmitri Gavrilov [MSFT]" <dmitrig@online.microsoft.com> wrote in message
> news:%236WG3qeHFHA.908@TK2MSFTNGP12.phx.gbl...
> > You should use userPrincipalName in place of UID. Like Lee said,
> > userPrincipalName is a freeform string that you can use to bind.
> > Unfortunately, ADAM does not support attribute aliasing, so you'll have
to
> > change the client app to use this.
> >
> > -- 
> > Dmitri Gavrilov
> > SDE, Active Directory Core
> >
> > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > Use of included script samples are subject to the terms specified at
> > http://www.microsoft.com/info/cpyright.htm
> >
> > "Jims" <biz@neocasa.net> wrote in message
> > news:#jxQ5BbHFHA.1996@TK2MSFTNGP12.phx.gbl...
> >> thanks lee. Because we are migrating from IPlanet to ADAM, we have had
> >> inquiries from our developers why they can't bind to uid like with
> > Iplanet.
> >> Binding with CN does seem somewhat nonstandard.
> >> Jim
> >>
> >>
> >> "Lee Flight" <lef@le.ac.uk-nospam> wrote in message
> >> news:%231ZCmsfGFHA.3916@TK2MSFTNGP12.phx.gbl...
> >> > Hi Jim
> >> >
> >> > you could have ADAM users bind by uid if you had uid as the
> >> > rDNAttID in the class definitions at the time you created the
classes.
> >> > I have tried it and it does work but I do not have it in production
> >> > so I could not guarantee it as a totally safe thing to do.
> >> >
> >> > If you have existing instances, you would pretty much have to tear
> >> > down your existing instance and rebuild.
> >> >
> >> > If you do try a test scenario you would need to be aware of the
> >> > exiting uid attribute definition in the MS-User.ldf, if you use that
> >> > class. That attribute is multivalued and not indexed, whereas you
would
> >> > probably want it single-valued and indexed.
> >> >
> >> > One other thing, in ADAM you can bind by userPrincipalName, which is
> >> > just a (2.5.5.12) unicode string, so if you are not using that
> >> > attribute
> >> > already
> >> > you could populate with the uid string
> >> >
> >> > smithj
> >> >
> >> > or even a string (note this just a string not a DN)
> >> >
> >> > uid=smithj,ou=users,dc=domain,dc=org
> >> >
> >> > and a simple bind to either of those should work.  The string that
> >> > looks
> >> > like a DN might get you out of a hole if the client application was
> >> > hard
> >> > coded for a DN of that form, but I'm not seriously recommending it,
> >> > consider it a curiousity...
> >> >
> >> > HTH
> >> > Lee Flight
> >> >
> >> >
> >> > "Jims" <biz@neocasa.net> wrote in message
> >> > news:OLGFUReGFHA.3916@TK2MSFTNGP12.phx.gbl...
> >> >> Is it possible to change the bind dn attribute in ADAM?  For
instance,
> >> >> our userprox y and user objects currently have to bind with
> >> >> cn=smithj,ou=users,dc=domain=dc=org.  Can we change this so they
would
> >> >> bind with uid=smithj,ou=users,dc=domain,dc=org?
> >> >> Thanks,
> >> >> Jim
> >> >>
> >> >
> >> >
> >>
> >>
> >
> >
>
>

Relevant Pages

  • Re: ADAM Bind attribute question
    ... You should use userPrincipalName in place of UID. ... userPrincipalName is a freeform string that you can use to bind. ... Unfortunately, ADAM does not support attribute aliasing, so you'll have to ...
    (microsoft.public.windows.server.active_directory)
  • Re: ADAM Bind attribute question
    ... Because we are migrating from IPlanet to ADAM, ... inquiries from our developers why they can't bind to uid like with Iplanet. ... > just a unicode string, so if you are not using that attribute ...
    (microsoft.public.windows.server.active_directory)
  • Duplicate UPNs and "default UPN"
    ... I've been continuing to try to figure out what was going on with a situation that I described in an earlier thread where an LDAP authentication was failing when using the user's name in UPN format: ... As mentioned at the end of the last thread, I was able to create a situation where attempting to authenticate using the user's UPN, as contained in the "userPrincipalName" attribute, would fail, by creating two different users, in two different containers, with both users having their userPrincipalName attribute set to the same value. ... ldifde with a simple bind with that UPN formatted username would then fail, but using a full DN, I could authenticate. ...
    (microsoft.public.windows.server.active_directory)
  • Re: ADAM Bind attribute question
    ... you could have ADAM users bind by uid if you had uid as the ... One other thing, in ADAM you can bind by userPrincipalName, which is ... just a unicode string, so if you are not using that attribute ...
    (microsoft.public.windows.server.active_directory)
  • Re: form authetication?
    ... userPrincipalName or the sAMAccountName. ... > There are 4 possible username formats for an AD bind with DirectoryEntry ... > plain username (whatever is in the sAMAccountName attribute) ... >> impersonation be used with form authentication? ...
    (microsoft.public.dotnet.framework.aspnet.security)