Re: LDAP query failing

Thanks, I'll try those suggestions.

All the users and groups are in the default Users container in the one
domain in the forest.

Any suggestions for options other than sAMAccountName to allow users to use
the one word user name they are accustomed to using to logon = "user logon
name."

KevinL



"Lee Flight" wrote:

> Hi
>
> you need to speak to your AD admins and find a good search base
> to be using in your LDAP URL; you need to find where the user accounts
> are rooted.
>
> Also your search base format
>
> cn=users,dc=adsdnsname
>
> needs to be a distinguishedName so the leading part of the URL is:
>
> ldap://myaddomain.com:389/cn=user,dc=myaddomain,dc=com
>
> With mod_auth_ldap you will need an AD account that you can use to run
> the search. You will also need some discipline on how the user accounts
> are searched for if sAMAccountName is what the user will be entering that's
> fine but if variations in the input e.g. userPrincipalName are likely you
> will
> probably need to parse those into sAMAccountNames or vice versa, this
> could be tricky in a multi-domain environment and might need a global
> catalog
> search (your AD admins should be able to advise).
>
> A further thing that you will want to do is to run the LDAP connection over
> SSL so that the usernames and passwords that are presented for binding
> do not pass over the network in cleartext. In the auth_ldap conf file you
> can have a pointer to certificate store IIRC.
>
> If you google you should find plenty of mod_auth_ldap examples for running
> against
> AD (and ADAM), it's quite widely used.
>
> Lee Flight
>
> "kevinL" <kevinL@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:DE9FFEE4-C12B-4E27-8C3E-E604C854CAFC@xxxxxxxxxxxxxxxx
> > My organization is really beginning to see the value of AD as an
> > enterprise
> > directory and I want to encourage that.
> >
> > We make good use of IIS for a variety of applications but our intranet
> > runs
> > on Apache, v 2.0.52. Users provide user names and passwords to access
> > various pages on the intranet. I'd like to have Apache
> > authenticate/authorize against our 2003 functional level domain ldap for
> > user
> > name and pw hash as well as group membership authorization. We already
> > have
> > our Unix servers authenticating against our AD for logins.
> >
> > I am attempting to use an Apache module called mod_auth_ldap for our
> > intranet auth/auth.
> >
> > The question:
> >
> > An ldap query to:
> >
> > ldap://addnsname:389/cn=users,dc=adsdnsname,?sAMAccoutName?sub?(objectClass=user)
> >
> > returns:
> >
> > "dap_search_ext_s() for user failed"
> >
> > Perhaps, the query is not landing at the right place in the LDAP
> > structure?
> > I'd like to query against their logon name, userprincipalname or
> > samaccountname.
> >
> > 1)Any suggestions would be appreciated.
> >
> > 2)Does anyone know where I could fine a graphical representation of the
> > default LDAP structure of a 2003 AD? Trying to extrapolate from the
> > detailed
> > tools like ldp or dsquery is daunting?
> >
>
>
>
.

Relevant Pages

  • Re: Looks right but... Error 80040E37 - Table does not exist
    ... The LDAP query looks correct and I've tried several options... ... For user, group, and computer objects the RDN ... expect the values of the cn and sAMAccountName attributes to be the same ...
    (microsoft.public.scripting.vbscript)
  • Re: Active Directory
    ... AD has a ton of naming attributes (CN, userPrincipalName, sAMAccountName, ... CN, OU and DC, although LDAP in general can be much more ... server name is optional and can be the DNS name of the DC, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Retrieve attributes from Active Directory
    ... First, I don't advise people with asp code, because the authentication ... If using the WinNT provider works, but the LDAP ... so sAMAccountName is called Name. ...
    (microsoft.public.windows.server.scripting)
  • Re: LDAP query failing
    ... following ports and the apache server. ... Does LDAP try to communicate over these ports? ... >> Any suggestions for options other than sAMAccountName to allow users to ...
    (microsoft.public.windows.server.active_directory)
  • Re: How to bind to user object without knowing the path
    ... than using ADO. ... Below is a function that will take a samaccountname as input ... and return the distinguishedname that you then can bind with LDAP. ... I want to bind to a user object using ...
    (microsoft.public.windows.server.scripting)
Loading