One IdP serving separate security (LDAP) domains

[Michael A Grady]

I'm not an AD admin, but we've (Unicon) worked with institutions that use AD, and the behavior has been as you describe below. Using the GC can remove the problem of referrals and recursive searches, but, as you suggest, you need to make sure the attributes that you need are available in the GC. It is my understanding that it isn't difficult to add attributes to that "partial attribute set" (PAS), but then one also needs to take into account any impact on the performance/size of the GC:

  http://support.microsoft.com/kb/248717

On Apr 5, 2013, at 3:40 PM, Mosior, Benjamin wrote:

> Sent: Friday, April 05, 2013 3:51 PM From: Mosior, Benjamin
> > Our AD magicians might have some wisdom to share. I'll see what they say and report back if there's anything worth noting.
>  
> Hopefully this can supplement our collective knowledge. According to the O'Reilly "Active Directory" textbook (ISBN 978-0-596-52059-5), the Global Catalog is a read-only interface for "forest-wide searches". Accessible attributes are defined in the "partial attribute set" (PAS), which is configurable. Normal LDAP connections limit explicitly to the search base and, at least in this scenario, it seems the search is not recursive.
>  
> It's starting to make sense. I remember testing the following scenarios, where hypothetical users "testfaculty" and "teststaff" were located under "CN=FACULTY,DC=EXAMPLE,DC=EDU" and "CN=STAFF,DC=TEST,DC=EDU", respectively.
>  
> # Search above containers
> User:                     testfaculty
> Connection:       LDAP(389)
> Search Base:      DC=EXAMPLE,DC=EDU
> Result:                  FAIL
>  
> # testfaculty account in Faculty container
> User:                     testfaculty
> Connection:       LDAP(389)
> Search Base:      CN=FACULTY,DC=EXAMPLE,DC=EDU
> Result:                  SUCCEED
>  
> # teststaff account in Faculty container
> User:                     teststaff
> Connection:       LDAP(389)
> Search Base:      CN=FACULTY,DC=EXAMPLE,DC=EDU
> Result:                  FAIL
>  
> # testfaculty in Global Catalog
> User:                     testfaculty
> Connection:       Global Catalog (3268)
> Search Base:      DC=EXAMPLE,DC=EDU
> Result:                  SUCCEED
>  
> # teststaff in Global Catalog
> User:                     teststaff
> Connection:       Global Catalog (3268)
> Search Base:      DC=EXAMPLE,DC=EDU
> Result:                  SUCCEED
>  
>  
> I'd like to do some more testing before declaring the above to be true. Any Active Directory admins on the list who could confirm?
>  
>  
> Benjamin Mosior
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130405/21cce6ac/attachment.html