I'm trying search my company's AD with
ldapsearch. However I always get the error:
ldap_bind: Strong(er) authentication required (8) additional info: BindSimple: Transport encryption required.
I tried to use LDAPS in every combination possible, but I can't seem to be able to connect to the server in any other way than just LDAP on the default port.
Weirdly enough I have no issues whatsoever using Active Directory Explorer.
I was thinking that it could be that the firewall isn't configured correctly and blocking the LDAPS (636) Port, but that wouldn't explain Active Directory Explorer working...
Also GitLab seems to be able to connect to it just fine too. Except that it won't authenticate. But that's what I'm trying to debug with
That's the command I'm using:
ldapsearch -D "cn=myuser,cn=Users,dc=company,dc=local" -w "<password>" \ -p 389 -h 10.128.1.254 \ -b "cn=Users,dc=company,dc=local"
The server is correct, so is the bind_dn (according to Active Directory Explorer) and the corresponding password, I tried using upper an lowercase for the stuff like
cn, I tried all possible configurations of using LDAPS (like
-H ldaps://10.128.1.254:636) and the flag
-x, so I'm really running out of ideas.
If it's relevant, the AD server is the Active Directory Server on Synology/DSM, which is a linux SAMBA server under the hood.
Any help is greatly apprechiated.
Looks like adding
-Y NTLM gets me further.
Now I get:
SASL/NTLM authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL:[NTLM]: NT_STATUS_OBJECT_NAME_NOT_FOUND
which is weird, as I know the password is correct.
-Y GSSAPI creates this rather nothing saying error:
SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Local error (-2) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials available (default cache: FILE:/tmp/krb5cc_0))
-Z too) ends with this error:
ldap_start_tls: Connect error (-11) additional info: The TLS connection was non-properly terminated.