Re: LDAP Authentication from Linux

Hi Dana,

I think you're right about the Query privileges. What I would like is a user specifically used for the binding, so restricted in other things. I'm not sure how to set those privileges though. I know that if I change the apache config below to use a Domain Admin account, then all works well.

Heres the Apache config:

<Directory "/var/www/html/wiki">
AuthBasicProvider ldap
AuthType Basic
AuthzLDAPAuthoritative off
AuthName "test server"

AuthLDAPURL "ldap://ubiq-serv1.companyname.local:389/DC=companyname,DC=local?sAMAccountName?sub?(objectClass=*)" NONE
AuthLDAPBindDN "CN=ldap45457,CN=Users,DC=companyname,DC=local"
AuthLDAPBindPassword *********
require valid-user
</Directory>

heres the error when I tried to login as me, note the bind failure.

[Mon Mar 24 12:32:38 2008] [notice] Apache/2.2.3 (Red Hat) configured -- resuming normal operations
[Mon Mar 24 12:32:41 2008] [warn] [client 192.168.117.1] [16839] auth_ldap authenticate: user marsh authentication failed; URI /wiki/index.php [LDAP: ldap_simple_bind_s() failed][Invalid credentials]
[Mon Mar 24 12:32:41 2008] [error] [client 192.168.117.1] user marsh: authentication failure for "/wiki/index.php": Password Mismatch
[Mon Mar 24 12:32:43 2008] [warn] [client 192.168.117.1] [16836] auth_ldap authenticate: user marsh authentication failed; URI /wiki/index.php [LDAP: ldap_simple_bind_s() failed][Invalid credentials]
[Mon Mar 24 12:32:43 2008] [error] [client 192.168.117.1] user marsh: authentication failure for "/wiki/index.php": Password Mismatch


Dana Epp [Security MVP] wrote:
You can start by looking in /var/log to see what the bind failure error is. On the apache side, it might be as easy as /var/log/apache/error.log.

Depending how you have LDAP set up, remember that the user you configure must have privileges to query AD. But before we try to tackle the permission problems, lets see what the error is. If you don't see it in the error.log, check /var/log/syslog and /var/log/messages. Paste what you see in reference to your LDAP query, and we can go from there.

Regards,
Dana Epp [Microsoft Security MVP]


"Adrian Marsh (NNTP)" <adrian.marsh@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:u8JguRXlIHA.3512@xxxxxxxxxxxxxxxxxxxxxxx
Hi All,

I'm trying to implement a secure authentication from an apache2 server across to my SBS2003 server.

I've configured LDAP in apache, and if I bind using a Domain Admin account then all is well and I can login.

However, I don't really want to use a domain admin account for this. So I setup a new user account, and have tried using that but the bind fails. I'm guessing its a permissions issue, but am not sure where to start to look.

Second, am I using the right mechanism here? Isn't LDAP for directory lookups and Kerberos for authentication??

Adrian

.

Relevant Pages

  • Simple LDAP query
    ... I'm using ruby-1.8.6 and trying to query my Windows Active Directory ... LDAP server. ... LDAP authentication is working. ...
    (comp.lang.ruby)
  • Re: Directory Services, LDAP or similar
    ... In other projects, we managed the user authentication by creating tables that define all users and its allowed capacities, then the application queryies that data to verify if a user has access to some feature or not. ... The above ID and password are sent to the service at login time. ... They are using Novell eDirectory at the enterprise level; yes it's LDAP. ... We already do that for three different DB servers; ...
    (borland.public.delphi.non-technical)
  • Re: noob on slapd with sasl errors
    ... If I may share advice based on my own trials & tribulations with LDAP ... people who need network authentication and the current state of ... context of network authentication, LDAP really is just a protocol used ... I have no idea how sasl works and why it is needed here, or even more, ...
    (Ubuntu)
  • Re: Directory Services, LDAP or similar
    ... we managed the user authentication by creating tables ... The above ID and password are sent to the service at login ... Novell eDirectory at the enterprise level; yes it's LDAP. ... servers; ...
    (borland.public.delphi.non-technical)
  • S/Key keyinit(1) authentication (lack thereof) + sudo(1)
    ... S/Key keyinitauthentication + sudo ... Disable S/Key in favor of OPIE ... higher system privileges (i.e., root). ...
    (Bugtraq)