Active Directory as Authentication Source

[Michael Dahlberg]

On Thu, Mar 5, 2015 at 11:33 AM, Daniel Fisher <dfisher at vt.edu> wrote:
>
>
> An important detail in step 1 is that the user's LDAP DN is retrieved as
> part of that query. That is what is used to perform the bind in step 2.
> Try this query:
> ldapsearch -x -D "servicename at bucknell.edu" -b "cn=Users,dc=bucknell,
> dc=edu" -s one -H ldap://XXXXX.bucknell.edu <http://xxxxx.bucknell.edu/> -W
> '(sAMAccountName=USERNAME)' 1.1
>
>

I tried that query and received the following results (I used my account as
USERNAME):

# extended LDIF
#
# LDAPv3
# base <cn=Users,dc=bucknell,dc=edu> with scope oneLevel
# filter: (sAMAccountName=dahlberg)
# requesting: 1.1
#

# dahlberg, Users, bucknell.edu
dn: CN=dahlberg,CN=Users,DC=bucknell,DC=edu

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1


As you can see, I didn't receive any referrals.

I believe I'm going to have to use Kerberos anyway to utilize the SSO
capabilities of Shibboleth.  I can currently query AD for the various
attributes that I pass to the SPs, but to maintain an SSO environment,
wouldn't I need the ticketing capabilities of Kerberos?

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150305/12a7f956/attachment.html