Active Directory as Authentication Source

[Michael Dahlberg]

On Wed, Mar 4, 2015 at 4:09 PM, Daniel Fisher <dfisher at vt.edu> wrote:

> On Wed, Mar 4, 2015 at 3:13 PM, Michael Dahlberg <olgamirth at gmail.com>
> wrote:
>
>>
>>
>> On Wed, Mar 4, 2015 at 2:27 PM, Daniel Fisher <dfisher at vt.edu> wrote:
>>
>>> On Wed, Mar 4, 2015 at 1:23 PM, Michael Dahlberg <olgamirth at gmail.com>
>>> wrote:
>>>
>>>> Also, a final note: I've tried using ldapsearch with the given BaseDN
>>>> and the BindDN as "serviceuser at bucknell.edu" and am able to
>>>> successfully query the AD database.
>>>>
>>>
>>> When you use ldapsearch, do you see 'ref:' values in the output? It
>>> could be that the err=32 that you're seeing is caused by a referral that
>>> the IDP is following when it performs DN resolution.
>>>
>>>
>> I ran the following command (removed some of the info that the Windows
>> Admins rather I not put on a public list)
>>
>> ldapsearch -x -D "servicename at bucknell.edu" -b "" -s base -H ldap://
>> XXXXX.bucknell.edu -W
>>
>>
> Perform the search that you expect the IDP to perform to find one of your
> users.
>
>
I was just doing the ldapsearch to confirm that I could bind to AD server,
authenticate as the service user, and then get something back.  My
understanding of the way authentication takes place using LDAP against an
AD server is that in step 1, a user with the permissions to query the
database binds to the database and then queries it to see if the user who
wants to authenticate is a valid user. If so, step 2, the user binds to the
database, authenticates, and if successful retrieves his/her available
attributes.  I'm not sure how to craft that particular set of steps using
ldapsearch.  Can you suggest such a query?

Also, wouldn't the referrals occur while retrieving attributes, not while
doing the authentication?

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150304/b73ebe5c/attachment.html