Hi Adam,<br><br>If the ldapsearch -D "" -w "" runs successfully, what do we suppose to get from the output? I just got all of the user information in that group. Does that means my password and username got authenticated successfully against AD?<br>
<br>This thing drives me crazy. I need solve it through this week before the holiday...<br><br>Thanks a lot for the help.<br><br>Lou <br><br><div class="gmail_quote">On Fri, Nov 20, 2009 at 7:26 AM, Hailu Meng <span dir="ltr"><<a href="mailto:hailumeng@gmail.com">hailumeng@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Still no clue how to turn on the log. binding seems good. See my findings below. Thanks a lot.<br>
<br><div class="gmail_quote"><div class="im">On Thu, Nov 19, 2009 at 9:26 PM, adam <span dir="ltr"><<a href="mailto:prozaconstilts@gmail.com" target="_blank">prozaconstilts@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div>Hailu Meng wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Adam,<br>
<br>
I tried the su - "userid" in my tacacs+ server but I don't have that userid in CentOS. So the CentOS just don't want me log in. I think this will not ask tacacs server to authenticate against AD.<br>
</blockquote>
<br></div>
You shouldn't need to have to define the user in CentOS, that's the point of using ldap for authentication. The user is defined in ldap, not in CentOS. Now that I think about it, su - <user> probably wouldn't work anyway, as AD doesn't by default have the data needed by a linux box to allow login...but see below for more options.<div>
<br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>
Is there any other way to test ldap authentication against AD with the userid in AD? I tried ldapsearch. It did find my user id without problem. But I haven't found any option to try with password and authenticate against AD.<br>
</blockquote>
<br></div>
Try using -D:<br>
<br>
from `man ldapsearch`:<br>
<br>
-D binddn<br>
Use the Distinguished Name binddn to bind to the LDAP directory.<br>
<br>
so -D cn=username,ou=my_ou,dc=my_dc should let you try to authenticate using whatever user you want to define. Just check and double check you get the right path in that dn.<div><br>
<br></div></blockquote></div><div>I tried -D " cn=username,ou=my_ou,dc=my_dc " but it just returned lots of users' information. It means successful?<br> </div><div class="im"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Do you have ldap server setup or only the openldap library and openldap client? I don't understand why the log is not turned on. There must be some debugging info in the log which can help solve this issue.<br>
</blockquote>
<br></div>
only the libs and client. You should not need the server. In the ldapsearch, you can use -d <integer> to get debugging info for that search. As before, higher number = more debug<div><br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
If the user can authenticate, does ethereal capture some packets about password verification? Right now I only see the packets when ldap search for my user id and gets results back from AD.<br>
</blockquote>
<br></div>
Ethereal should catch all data flowing between the client and server. If you can search out the user in your AD right now, then one of two things is happening:<br>
<br>
1. You are performing anonymous searches. In this case, no username and pw is provided, and your AD is happy to hand over info to anyone who asks for it. If this is the case, you will _not_ see authentication information. The following MS KB article should probably help you determine on your AD if anonymous queries are allowed:<br>
<br>
<a href="http://support.microsoft.com/kb/320528" target="_blank">http://support.microsoft.com/kb/320528</a><br>
<br>
It has exact instructions for how to get it going, but you can follow along with it to check your current settings without making any changes.<br></blockquote></div><div><br>I checked our setting. Permission type for normal user is "Read & Execute". I click edit to check the detail about permission. I think it only allow the user to read the attributes, permission something and can't modify the AD.There is "Everyone" setting is also set as "Read & Execute". By the way, the AD is Win2003 R2. <br>
<br></div><div class="im"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>
2. Authentication is happening. It will be the _very_ first thing the client and server perform, after basic connection establishment. Look for it at the very beginning of a dump.<br>
<br>
<br>
<br>
Also, it's a bit overkill, but the following article is extremely informative about all the different ways you can plug linux into AD for authentication. It might offer some hints...<div><div></div><div><br>
<br>
<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>
Maybe I need dig into ldap.conf more. If you have any idea, let me know.<br>
<br>
Thank you very much.<br>
<br>
Lou<br>
</blockquote>
<br>
<br>
</div></div></blockquote></div></div><br>
</blockquote></div><br>