Active Directory as Authentication Source

[Michael Dahlberg]

On Wed, Mar 4, 2015 at 1:02 PM, Rod Widdowson <rdw at steadingsoftware.com>
wrote:

> > (1) Any suggestions on why the authentication phase is not completed?
>
>
> What are you setting "base" to in login.config? As I recall it needs to be
> something like
>
> nase="CN=Users, DC=toplevel, DC=edu"
>
> For a domain called toplevel.edu
>
>
This is my BaseDN line:

baseDN="cn=Users,dc=bucknell,dc=edu"




> If you haven't found it already
> https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues has
> a wealth of useful info.
>
>
>
Yes, I found that page.  Completely disabled encryption and tried both
types of BindDN as listed in this article.  Also, I tried using the Global
Catalog port, but our Windows Admins keep that port closed.  And because
we've always distributed attributes from the AD server, the referrals have
always been set to follow.  (Not sure about the objectSid and objectGUID
params).

Also, a final note: I've tried using ldapsearch with the given BaseDN and
the BindDN as "serviceuser at bucknell.edu" and am able to successfully query
the AD database.

I might give Kerberos a try anyway, since I've hit a wall with LDAP.

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150304/f2691459/attachment-0001.html