Active Directory as Authentication Source

[Daniel Fisher]

On Wed, Mar 4, 2015 at 4:38 PM, Michael Dahlberg <olgamirth at gmail.com>
wrote:

> I was just doing the ldapsearch to confirm that I could bind to AD server,
> authenticate as the service user, and then get something back.  My
> understanding of the way authentication takes place using LDAP against an
> AD server is that in step 1, a user with the permissions to query the
> database binds to the database and then queries it to see if the user who
> wants to authenticate is a valid user. If so, step 2, the user binds to the
> database, authenticates, and if successful retrieves his/her available
> attributes.  I'm not sure how to craft that particular set of steps using
> ldapsearch.  Can you suggest such a query?
>
>
An important detail in step 1 is that the user's LDAP DN is retrieved as
part of that query. That is what is used to perform the bind in step 2.
Try this query:
ldapsearch -x -D "servicename at bucknell.edu" -b "cn=Users,dc=bucknell,dc=edu"
-s one -H ldap://XXXXX.bucknell.edu <http://xxxxx.bucknell.edu/> -W
'(sAMAccountName=USERNAME)' 1.1


> Also, wouldn't the referrals occur while retrieving attributes, not while
> doing the authentication?
>

I'm assuming the referrals occur during DN resolution.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150305/0f454554/attachment.html