Re: Openldap for proxy AD

2013-11-26 Thread Willy Ramos
escreveu: On Wed, Nov 20, 2013 at 02:55:43PM -0200, Willy Ramos wrote: Subject: Re: Openldap for proxy AD Have you tried following the examples in the Admin Guide? http://www.openldap.org/doc/admin24/security.html#Pass-Through%20authentication There is a detailed setup and diagnosic guide

Re: Openldap for proxy AD

2013-11-25 Thread Peter Gietz
via AD? Cheers, Peter Am 22.11.2013 15:05, schrieb Willy Ramos: Em 22/11/2013 09:21, Andrew Findlay escreveu: On Wed, Nov 20, 2013 at 02:55:43PM -0200, Willy Ramos wrote: Subject: Re: Openldap for proxy AD Have you tried following the examples in the Admin Guide? http://www.openldap.org

Re: Openldap for proxy AD

2013-11-22 Thread Andrew Findlay
On Wed, Nov 20, 2013 at 02:55:43PM -0200, Willy Ramos wrote: Subject: Re: Openldap for proxy AD Have you tried following the examples in the Admin Guide? http://www.openldap.org/doc/admin24/security.html#Pass-Through%20authentication There is a detailed setup and diagnosic guide there which

Re: Openldap for proxy AD

2013-11-22 Thread Willy Ramos
Em 22/11/2013 09:21, Andrew Findlay escreveu: On Wed, Nov 20, 2013 at 02:55:43PM -0200, Willy Ramos wrote: Subject: Re: Openldap for proxy AD Have you tried following the examples in the Admin Guide? http://www.openldap.org/doc/admin24/security.html#Pass-Through%20authentication

Re: Openldap for proxy AD

2013-11-20 Thread Clément OUDOT
2013/11/19 Jason Brandt jbra...@fsmail.bradley.edu: You are trying to authenticate through the credentials stored in your active directory servers, not the passwords stored in LDAP, correct? If that is the case, then the easiest means to accomplish that are to use SASL for authentication.

Re: Openldap for proxy AD

2013-11-20 Thread Howard Chu
Clément OUDOT wrote: 2013/11/19 Jason Brandt jbra...@fsmail.bradley.edu: You are trying to authenticate through the credentials stored in your active directory servers, not the passwords stored in LDAP, correct? If that is the case, then the easiest means to accomplish that are to use SASL for

Re: Openldap for proxy AD

2013-11-20 Thread Clément OUDOT
2013/11/20 Howard Chu h...@symas.com: Clément OUDOT wrote: 2013/11/19 Jason Brandt jbra...@fsmail.bradley.edu: You are trying to authenticate through the credentials stored in your active directory servers, not the passwords stored in LDAP, correct? If that is the case, then the easiest

Re: Openldap for proxy AD

2013-11-20 Thread wrm
Thank you. Yes, the credentials are stored in AD. I saw this documentation, http://ltb-project.org/wiki/documentation/general/sasl_delegation Helped me very much, but I think there are some wrong in my saslauth.conf, because when I put the AD server and ldap_filter = (sAMAccountName=%u is Ok

Re: Openldap for proxy AD

2013-11-20 Thread Clément OUDOT
2013/11/20 w...@cdtn.br: Thank you. Yes, the credentials are stored in AD. I saw this documentation, http://ltb-project.org/wiki/documentation/general/sasl_delegation Helped me very much, but I think there are some wrong in my saslauth.conf, because when I put the AD server and

Re: Openldap for proxy AD

2013-11-20 Thread Jason Brandt
I can get you my SASL config from my test environment when I get to the office. One thing to keep in mind, is that you MUST do an authenticated bind to AD, you cannot do anonymous bind, so you have to have a service account setup to allow SASL to authenticate to AD. It can be the most basic user

Re: Openldap for proxy AD

2013-11-20 Thread Jason Brandt
This is all that's contained in my saslauthd.conf: ldap_servers: ldaps://server2 ldaps://server1 ldap_search_base: OU=usersOU,DC=foo,DC=bar ldap_filter: sAMAccountName=%u ldap_bind_dn: cn=saslauthd,cn=users,dc=foo,dc=bar ldap_password: password The obvious thing that jumps out at me is that

Re: Openldap for proxy AD

2013-11-20 Thread Clément OUDOT
2013/11/20 Willy Ramos w...@cdtn.br: Em 20/11/2013 10:26, Clément OUDOT escreveu: 2013/11/20 w...@cdtn.br: Thank you. Yes, the credentials are stored in AD. I saw this documentation, http://ltb-project.org/wiki/documentation/general/sasl_delegation Helped me very much, but I think

Re: Openldap for proxy AD

2013-11-20 Thread Willy Ramos
Em 20/11/2013 10:26, Clément OUDOT escreveu: 2013/11/20 w...@cdtn.br: Thank you. Yes, the credentials are stored in AD. I saw this documentation, http://ltb-project.org/wiki/documentation/general/sasl_delegation Helped me very much, but I think there are some wrong in my saslauth.conf,

Re: Openldap for proxy AD

2013-11-20 Thread Jason Brandt
Well, if you're going to use SASL, then you need to configure your saslauth.conf like my example, making sure your ldap servers point to your Active Directory servers. Otherwise if you're going to use some method besides SASL, then I won't be much help. On Wed, Nov 20, 2013 at 10:55 AM, Willy

Re: Openldap for proxy AD

2013-11-20 Thread Willy Ramos
Em 20/11/2013 14:33, Clément OUDOT escreveu: 2013/11/20 Willy Ramos w...@cdtn.br: Em 20/11/2013 10:26, Clément OUDOT escreveu: 2013/11/20 w...@cdtn.br: Thank you. Yes, the credentials are stored in AD. I saw this documentation,

Re: Openldap for proxy AD

2013-11-20 Thread Jason Brandt
No problem, if you need more config info on the SASL setup, let me know. I have used with domain controller versions 2003 and up and worked great. On Wed, Nov 20, 2013 at 11:24 AM, Willy Ramos w...@cdtn.br wrote: Em 20/11/2013 14:33, Clément OUDOT escreveu: 2013/11/20 Willy Ramos

Openldap for proxy AD

2013-11-19 Thread wrm
Hi, I´m with some troubles to do authentication in AD trough of Openldap. Somebody managed to authenticate with AD password in Openldap Server? I´m trying everything but don´t auth. I see all users but the password don´t pass. My slapd.conf like this : # include

Re: Openldap for proxy AD

2013-11-19 Thread Jason Brandt
You are trying to authenticate through the credentials stored in your active directory servers, not the passwords stored in LDAP, correct? If that is the case, then the easiest means to accomplish that are to use SASL for authentication. On Tue, Nov 19, 2013 at 12:59 PM, w...@cdtn.br wrote: