Hi Martin,

If you have users in multiple containers that need to authenticate to Fedora, then you typically need to have a user that has read access bind to the directory, then search the directory for the user with the correct DN based on the userid entered. Then You need to bind to the directory again, using the found DN and the password that was entered to authenticate the user...

This way you can have all users in a subtree of the directory able to authenticate to fedora

Unfortuneately the default FilterLdap.java class that ships with fedora does not support this so we've made some changes to it.

You can view these at:
https://drama.ramp.org.au/cgi-bin/trac.cgi/wiki/LdapFilterBSB

Thanks,
Nish


Nishen Naidoo
ARCS Authorisation Services
Macquarie E-Learning Centre of Excellence (MELCOE)
MACQUARIE UNIVERSITY NSW 2109

E-Mail: [EMAIL PROTECTED]
Phone (W): +61 2 98506531
Phone (M): +61 4 30006783
Phone (F): +61 2 98506527
http://www.arcs.org.au/
http://www.melcoe.mq.edu.au/

CRICOS Provider No 00002J

This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of MELCOE or Macquarie University.



[EMAIL PROTECTED] wrote:
Hi All
 
I'm trying to find out if there's a way to find the fully qualified identification of a user in LDAP, via Fedora ie:
The fully qualified user is:
CN=pie044,OU=Some Department,OU=SOME SECTION,DC=EXAMPLE,DC=COM,DC=AU
However, the user only types in
pie044
 
In web.xml for Fedora, the bind-filter cannot be set to CN={0},OU=Some Department,DC=example,DC=com,DC=au because the "Some Department" is dynamic.
In other words, we want to authenticate all of our users regardless of what department they are in.
 
This doesn't seem to work with my Fedora configuration because the OU is coded into the web.xml, so not dynamic.
Is there a way to search for a user based on the identifier, and then get their fully qualified user name to inject into the RDN?
All I can think of is maybe writing my own filter to do this if Fedora cannot support this out of the box.
 
Thanks in advance,
 
Martin

------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url="">

_______________________________________________ Fedora-commons-users mailing list
[email protected] https://lists.sourceforge.net/lists/listinfo/fedora-commons-users


Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Fedora-commons-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fedora-commons-users

Reply via email to