Hot answers tagged

11

These guys have set up a public, read-only LDAP for testing purposes: http://www.forumsys.com/tutorials/integration-how-to/ldap/online-ldap-test-server


10

I'm not sure if this is the proper solution but noticed in the SSSD FAQ this point: When should I enable enumeration in SSSD? or Why is enumeration disabled by default? "Enumeration" is SSSD's term for "reading in and displaying all the values of a particular map (users, groups, etc.)". We disable this by default in the SSSD in order to minimize ...


8

You should be able to list the LDAP users using getent passwd. However, in order for the system libraries to use LDAP you need to set up /etc/nsswitch.conf and the nscd and nslcd daemons. This was discussed in chat, and the following config worked for the questioner: /etc/nslcd.conf: uid nslcd gid ldap # This comment prevents repeated auto-migration of ...


3

In the end I used an account and a simpleSecurityObject. These are the minimum object classes that have everything a service account needs.


3

Your base DN is simply o=Directory. It is not a good practice to have such a base DN, but it is nevertheless valid. Historically, Base DNs used to be in X.500 format, like o=<organization>,c=<countrycode>. Some existing directories still use it; for example, o=New York University,st=New York,c=US. Nowadays, the recommended way is to use DNS ...


3

Thunderbird already looks at your local address book first. You can perhaps have it add the e-mail addresses found in the directory to the local address book so they would be found first (and faster)? Tools -> Options -> Composition -> Addressing -> (Check) Local Address Books + (Check) Directory Server + (Check) Automatically add outgoing e-...


3

As it turns out, attempting to use slaptest to generate your slapd.d directory when it is already full of stuff doesn't generate a new one. My example slapd.conf posted above wasn't actually being converted into slapd.d. Once I deleted slapd.d and ran everything again, things were hunky dory.


3

Had a similar issue i.e. same error: ldap_bind: Invalid credentials (49) and the only way to solve it was to delete the ldapscripts.passwd and use # echo -n "mypassword" > /etc/ldapscripts/ldapscripts.passwd (before I edited the file directly with vi entering the password). HTH.


3

As a workaround, I found I could just run on linux, inside docker! I found dperson/samba which contains the compiled smbpasswd command. No need to try to setup samba on MacOS anymore ;) docker run --rm -it dperson/samba \ bash -c "smbpasswd -U my_activedirectory_username -r 10.x.y.z" Or if you like doing things on your own like I did, here's a debian ...


3

Active Directory uses Kerberos for all authentication and supports the password-change protocol, so you should be able to directly use kpasswd user@REALM instead.


3

Ok I had to add some core schemas to be able to convert the postfix schema include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/nis.schema include /tmp/ldif/ldap-mail-schema-master/postfix-book.schema then slaptest did the job


3

Configure IPv4 settings manually, You can do this using the ip tool for one-time configurations. ip addr add X.X.X.X/Y dev eth0 ip route add default via X.X.X.Z Don't forget to configure a DNS resolver: echo nameserver X.X.X.Z > /etc/resolv.conf Have to open an url in browser and sign in there with proper credentials The Arch install USB comes ...


2

sAMAccountName is the username in Active Directory. If you search ldap for users with a samaccountname that matches your username, you can get the DN that way.


2

Cached domain logon only works if the user has logged on once with a valid password. Windows will then store the MD5 (see comments below) hash of this password on the local disk. If the PC has no connection to an Active Directory domain controller the next time the same user logs on, Windows will authenticate the user locally using the locally stored ...


2

Preface Using SVNPath instead of SVNParentPath for a big set of repositories and, thus, separated administration and management isn't good idea (from my POV). With SVNParentPath you can have unified Apache configuration for any amount (dynamically changing) of repositories per server and single (easier manageable) authz file. In case of LDAP-backend I can ...


2

Oh, it's been a long time. Let's see what I can remember. Yes, it can definitely be confusing because you can use Kerberos to authenticate for LDAP, and you can also have Kerberos use LDAP as a backend. Although they are not the same thing, it's often hard to differentiate which one is being talked about when you try to search for it. I can only talk ...


2

OpenLDAP needs to know the base DN so that it could choose which database to read from. I couldn't find any support for "global" searching across all databases. However, you can add a new database with an empty base DN. With the relay backend it can forward all queries to your main database. See slapd-relay(5) for more elaborate examples (including ...


2

For simple bind – as far as I know, no. For SASL PLAIN bind, that should work by default, as long as saslauthd is running and understands the exact username format you're trying to use – and as long as your authz-regexp settings translate it to a correct DN afterwards.


2

I'm attempting to add users on the sonicwall from my windows AD. I want the windows logon password to be the VPN password. Users>Local users> import from ldap > I pick the user and they are created. I think you want to Select LDAP + Local Users and not just Local Users if you want to Integrate LDAP/Active Directory with Sonicwall UTM Appliance. I'...


2

The basics what I see is a mysterious error like the following: ldap_add: Undefined attribute type (17) additional info: add: attribute type undefined I don't understand this error, the attribute type is not defined, I'm trying to add it! It's not talking about your attribute. It's talking about the line add: attributetypes – it doesn't know an attribute ...


2

I found the problem. Here is the fix: Change olcDatabase={2}bdb to olcDatabase={2}hdb Make sure run these beforehand: ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif Reference: https://www....


2

I think you're mixing up authentication and authorization. As you can see from the logs, the authentication phase succeeds (meaning that the credentials were successfully verified)... Jul 19 14:30:39 virtualBox gdm-password]: pam_sss(gdm-password:auth): authentication success; logname= uid=0 euid=0 tty=/dev/tty1 ruser= rhost= user=alice ...but the ...


2

Yes, can deploy CA certificates via Group Policy – under Windows settings → Security settings → Public key policies → Trusted root certification authorities. But since you already have Active Directory, I'd strongly recommend installing the Certificate Services component and creating an actual CA from which you'll issue individual server certificates – so ...


2

My usual approach would be slightly different: the best is to inspect requests and responses with Wireshark (based on a tcpdump captured pcap file if you need to trace on a remote system). This way you see the precise error, the LDAP filters used, the base DN etc, i.e. this way you can be quite sure to identify the source of the issue. Now you might face an ...


1

There isn't, of course, a way of doing what you ask since it would be a massive security flaw. You either have to be authenticated as the user you need to reset or be an administrator with password change permissions. The only work around I can think of would be to rearrange your AD to put all of your accounts in their own OU and make you administrator of ...


1

First, I suggest looking at your directory using a 'plain' LDAP client like adsiedit.msc, or AD Explorer, or Apache Directory Studio. You will see the "full" structure that the "Users & Computers" tool simplifies. In LDAP, an entry consists of attributes, one of which is used as the entry's name ("relative distinguished name", RDN). The "Users" folder ...


1

Microsoft makes a program named err.exe that you can download and use to look up error codes. More officially named the Microsoft Error Lookup Tool: Use the Error Code Lookup tool to determine error values from decimal and hexadecimal error codes in Microsoft Windows® operating systems. The tool can look up one or more values at a time. All values on the ...


1

Hope this helps: PS C:> ipmo activedirectory PS C:> New-PSDrive -Name charlotte -PSProvider activedirectory -Root "AD:\ou=charlotte,dc=iammred,dc=net" PS charlotte:> get-item -Path "cn=ed wilson" -Properties * This will give all properties of a user. If you are looking at a list of users, I guess you could save the list of users in a variable and loop ...


1

I want to know what's going on, and whats wrong. How to enable debug, how to make saslauthd talk to me what is going on? Recent MIT Kerberos 5 versions (1.9 and above) support the KRB5_TRACE environment variable for detailed Krb5 and GSSAPI logs. Export KRB5_TRACE="/dev/stderr" before starting saslauthd, and it'll show the server status. (Note: Heimdal ...


Only top voted, non community-wiki answers of a minimum length are eligible