One IdP serving separate security (LDAP) domains

[Mosior, Benjamin]

Sent: Friday, April 05, 2013 3:51 PM From: Mosior, Benjamin

> Our AD magicians might have some wisdom to share. I'll see what they say and report back if there's anything worth noting.



Hopefully this can supplement our collective knowledge. According to the O'Reilly "Active Directory" textbook (ISBN 978-0-596-52059-5), the Global Catalog is a read-only interface for "forest-wide searches". Accessible attributes are defined in the "partial attribute set" (PAS), which is configurable. Normal LDAP connections limit explicitly to the search base and, at least in this scenario, it seems the search is not recursive.



It's starting to make sense. I remember testing the following scenarios, where hypothetical users "testfaculty" and "teststaff" were located under "CN=FACULTY,DC=EXAMPLE,DC=EDU" and "CN=STAFF,DC=TEST,DC=EDU", respectively.



# Search above containers

User:                     testfaculty

Connection:       LDAP(389)

Search Base:      DC=EXAMPLE,DC=EDU

Result:                  FAIL



# testfaculty account in Faculty container

User:                     testfaculty

Connection:       LDAP(389)

Search Base:      CN=FACULTY,DC=EXAMPLE,DC=EDU

Result:                  SUCCEED



# teststaff account in Faculty container

User:                     teststaff

Connection:       LDAP(389)

Search Base:      CN=FACULTY,DC=EXAMPLE,DC=EDU

Result:                  FAIL



# testfaculty in Global Catalog

User:                     testfaculty

Connection:       Global Catalog (3268)

Search Base:      DC=EXAMPLE,DC=EDU

Result:                  SUCCEED



# teststaff in Global Catalog

User:                     teststaff

Connection:       Global Catalog (3268)

Search Base:      DC=EXAMPLE,DC=EDU

Result:                  SUCCEED





I'd like to do some more testing before declaring the above to be true. Any Active Directory admins on the list who could confirm?





Benjamin Mosior
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130405/651a96ff/attachment-0001.html