<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>I'm guessing, but I think the test you want to try is:</p>
<p><br>
</p>
<p><span class="">ldapsearch -x -D "<a href="mailto:servicename@bucknell.edu" target="_blank">servicename@bucknell.edu</a>" -b "cn=Users,dc=bucknell,dc=edu" -s sub -H ldap://<a href="http://XXXXX.bucknell.edu" target="_blank">XXXXX.bucknell.edu</a> -W "cn=bob"
<br>
</span></p>
<p><br>
<span class=""></span></p>
<p><span class="">Assuming your user objects are named by CN, and that that is what you want to search against. You could also use "mail=bob@bucknell.edu" for the email address, or "userPrincipalName=bob@bucknell.edu" for UPN.</span></p>
<p><br>
</p>
<p>It might help to post the actual configuration file you're using. Mask out the sensitive bits before posting, of course.<br>
<span class=""></span></p>
<p><span class=""><br>
</span></p>
<p><br>
</p>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users-bounces@shibboleth.net <users-bounces@shibboleth.net> on behalf of Michael Dahlberg <olgamirth@gmail.com><br>
<b>Sent:</b> Wednesday, March 04, 2015 3:38 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Active Directory as Authentication Source</font>
<div> </div>
</div>
<div>
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, Mar 4, 2015 at 4:09 PM, Daniel Fisher <span dir="ltr">
<<a href="mailto:dfisher@vt.edu" target="_blank">dfisher@vt.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote"><span class="">On Wed, Mar 4, 2015 at 3:13 PM, Michael Dahlberg
<span dir="ltr"><<a href="mailto:olgamirth@gmail.com" target="_blank">olgamirth@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">
<div>
<div>On Wed, Mar 4, 2015 at 2:27 PM, Daniel Fisher <span dir="ltr"><<a href="mailto:dfisher@vt.edu" target="_blank">dfisher@vt.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-color:rgb(204,204,204); border-left-style:solid; padding-left:1ex">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote"><span>On Wed, Mar 4, 2015 at 1:23 PM, Michael Dahlberg <span dir="ltr">
<<a href="mailto:olgamirth@gmail.com" target="_blank">olgamirth@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-color:rgb(204,204,204); border-left-style:solid; padding-left:1ex">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">
<div>Also, a final note: I've tried using ldapsearch with the given BaseDN and the BindDN as "<a href="mailto:serviceuser@bucknell.edu" target="_blank">serviceuser@bucknell.edu</a>" and am able to successfully query the AD database.</div>
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
</span>
<div>When you use ldapsearch, do you see 'ref:' values in the output? It could be that the err=32 that you're seeing is caused by a referral that the IDP is following when it performs DN resolution.</div>
<span><font color="#888888">
<div><br>
</div>
</font></span></div>
</div>
</div>
</blockquote>
<div><br>
</div>
</div>
</div>
<div>I ran the following command (removed some of the info that the Windows Admins rather I not put on a public list)</div>
<div><br>
</div>
<div>ldapsearch -x -D "<a href="mailto:servicename@bucknell.edu" target="_blank">servicename@bucknell.edu</a>" -b "" -s base -H ldap://<a href="http://XXXXX.bucknell.edu" target="_blank">XXXXX.bucknell.edu</a> -W <br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
</span>
<div>Perform the search that you expect the IDP to perform to find one of your users.</div>
<span class="HOEnZb"><font color="#888888">
<div><br>
</div>
</font></span></div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>I was just doing the ldapsearch to confirm that I could bind to AD server, authenticate as the service user, and then get something back. My understanding of the way authentication takes place using LDAP against an AD server is that in step 1, a user
with the permissions to query the database binds to the database and then queries it to see if the user who wants to authenticate is a valid user. If so, step 2, the user binds to the database, authenticates, and if successful retrieves his/her available attributes.
I'm not sure how to craft that particular set of steps using ldapsearch. Can you suggest such a query?</div>
<div><br>
</div>
<div>Also, wouldn't the referrals occur while retrieving attributes, not while doing the authentication?</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Mike</div>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</body>
</html>