Active Directory as Authentication Source

[David Gersic]

Is baseDN="cn=Users,dc=bucknell,dc=edu" actually correct, and all of your users are in cn=Users?



________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Michael Dahlberg <olgamirth at gmail.com>
Sent: Wednesday, March 04, 2015 12:23 PM
To: Shib Users
Subject: Re: Active Directory as Authentication Source


On Wed, Mar 4, 2015 at 1:02 PM, Rod Widdowson <rdw at steadingsoftware.com<mailto:rdw at steadingsoftware.com>> wrote:
> (1) Any suggestions on why the authentication phase is not completed?


What are you setting "base" to in login.config? As I recall it needs to be something like

nase="CN=Users, DC=toplevel, DC=edu"

For a domain called toplevel.edu<http://toplevel.edu>


This is my BaseDN line:

baseDN="cn=Users,dc=bucknell,dc=edu"



If you haven't found it already https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues has a wealth of useful info.



Yes, I found that page.  Completely disabled encryption and tried both types of BindDN as listed in this article.  Also, I tried using the Global Catalog port, but our Windows Admins keep that port closed.  And because we've always distributed attributes from the AD server, the referrals have always been set to follow.  (Not sure about the objectSid and objectGUID params).

Also, a final note: I've tried using ldapsearch with the given BaseDN and the BindDN as "serviceuser at bucknell.edu<mailto:serviceuser at bucknell.edu>" and am able to successfully query the AD database.

I might give Kerberos a try anyway, since I've hit a wall with LDAP.

Thanks,
Mike

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150305/2a1043ad/attachment.html