Re: Using ldapsearch to find things in the active directory

I'd ask them for the errors they are getting. I'm guessing OpenSSL is in
the mix on the client end and there should be some sort of log somewhere (or
something you can turn on) that will say why it is failing.

You could also look for schannel errors in the system event log on your DC,
but the error is probably on their side.

Make sure they trust the certificates you are using. That is a common cause
of SSL server auth failure.

Best of luck!

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Sabo, Eric" <sabo_e@xxxxxxx> wrote in message
news:C2ED8F6F-9232-42E9-8F19-BB0899003D2F@xxxxxxxxxxxxxxxx
Joe,

I have installed the SSL certificates on my server, the only I have put
two
names in the certificate (DC name and an DNS name), Microsoft helped me
with
this. We can use ldp.exe to connect to both names correctly.

but the vendor is saying that it does not work. Through our firewall we
enabled SSL (port 636) and they are hitting the hole correctly.

At this point, it is a blaming game. I just want to make sure that my
active directory is setup correctly. Is there anything else I might
have
missed?

"Joe Kaplan" wrote:

I generally agree with this (using Kerb where possible), but in some
cases
LDAP auth must be accomodated. In that case, make sure you are using
SSL/LDAP exclusively with these apps as there is a very high likelihood
they
will be using LDAP simple bind for authentication and that is not secure.
It must be secured at the protocol level with SSL (or IPSEC).

In my experience, LDAP auth against AD is pretty common, especially in IT
scenarios that must accomodate a wide variety of platforms.

Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Tomasz Onyszko" <T.onyszko_nospam_@xxxxxx> wrote in message
news:eaoarOpOHHA.4604@xxxxxxxxxxxxxxxxxxxxxxx
Sabo wrote:
I forgot to mention we are using an SSL connection to our LDAP server.

This is good practice - however if You want to use AD to authenticate
users on linux \ unix You should take a look at Kerberos modules
available
for these platforms

--
Tomasz Onyszko
http://www.w2k.pl/ - (PL)
http://blogs.dirteam.com/blogs/tomek/ - (EN)





.

Relevant Pages

  • Re: Integrated Windows Authentication Timeout?
    ... For the second search, if the user account has an SPN of HTTP/webserver, ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... You might consider enabling protocol transition authentication ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Integrated Windows Authentication Timeout?
    ... is the username of the user account that runs the service. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... You might consider enabling protocol transition authentication since ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Integrated Windows Authentication Timeout?
    ... is the username of the user account that runs the service. ... You should then be able to see the SPNs that are on that account. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: How do I convert sid retrieved from the AD to SDDL string form
    ... LDAP doesn't support joins. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... objectSid property to a SecurityIdentifier class. ...
    (microsoft.public.dotnet.security)
  • Re: Security blues
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... running it, this is because of Windows security, not Code Access ... Doesn't sound like it should need admin rights. ...
    (microsoft.public.dotnet.security)