Active Directory as Authentication Source

[David Gersic]

I'm guessing, but I think the test you want to try is:


ldapsearch -x -D "servicename at bucknell.edu<mailto:servicename at bucknell.edu>" -b "cn=Users,dc=bucknell,dc=edu" -s sub -H ldap://XXXXX.bucknell.edu<http://XXXXX.bucknell.edu> -W "cn=bob"


Assuming your user objects are named by CN, and that that is what you want to search against. You could also use "mail=bob at bucknell.edu" for the email address, or "userPrincipalName=bob at bucknell.edu" for UPN.


It might help to post the actual configuration file you're using. Mask out the sensitive bits before posting, of course.



________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Michael Dahlberg <olgamirth at gmail.com>
Sent: Wednesday, March 04, 2015 3:38 PM
To: Shib Users
Subject: Re: Active Directory as Authentication Source



On Wed, Mar 4, 2015 at 4:09 PM, Daniel Fisher <dfisher at vt.edu<mailto:dfisher at vt.edu>> wrote:
On Wed, Mar 4, 2015 at 3:13 PM, Michael Dahlberg <olgamirth at gmail.com<mailto:olgamirth at gmail.com>> wrote:


On Wed, Mar 4, 2015 at 2:27 PM, Daniel Fisher <dfisher at vt.edu<mailto:dfisher at vt.edu>> wrote:
On Wed, Mar 4, 2015 at 1:23 PM, Michael Dahlberg <olgamirth at gmail.com<mailto:olgamirth at gmail.com>> wrote:
Also, a final note: I've tried using ldapsearch with the given BaseDN and the BindDN as "serviceuser at bucknell.edu<mailto:serviceuser at bucknell.edu>" and am able to successfully query the AD database.

When you use ldapsearch, do you see 'ref:' values in the output? It could be that the err=32 that you're seeing is caused by a referral that the IDP is following when it performs DN resolution.


I ran the following command (removed some of the info that the Windows Admins rather I not put on a public list)

ldapsearch -x -D "servicename at bucknell.edu<mailto:servicename at bucknell.edu>" -b "" -s base -H ldap://XXXXX.bucknell.edu<http://XXXXX.bucknell.edu> -W


Perform the search that you expect the IDP to perform to find one of your users.


I was just doing the ldapsearch to confirm that I could bind to AD server, authenticate as the service user, and then get something back.  My understanding of the way authentication takes place using LDAP against an AD server is that in step 1, a user with the permissions to query the database binds to the database and then queries it to see if the user who wants to authenticate is a valid user. If so, step 2, the user binds to the database, authenticates, and if successful retrieves his/her available attributes.  I'm not sure how to craft that particular set of steps using ldapsearch.  Can you suggest such a query?

Also, wouldn't the referrals occur while retrieving attributes, not while doing the authentication?

Thanks,
Mike

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150305/cdda3ec7/attachment.html