<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
On 08/03/2011 23:34, Craig Chambers wrote:
<blockquote cite="mid:C99BFD05.10B6C%25craig@craigchambers.net"
type="cite">
<div>
<div>Hello,</div>
<div><br>
</div>
<div>I am having issues getting LDAP?AD authentication to work.
I have read the archives and they all mention using ldapsearch
to test your settings but I am not sure exactly how the
ldapsearch strings match the fields in the preferences.php
file.</div>
<div><br>
</div>
<div>If I run the following ldapsearch, which seems to be the
shortest string that will return the expected results, (items
in brackets are of course substituted with valid information)
:</div>
<div><br>
</div>
<div>
<blockquote style="margin: 0px 0px 0px 40px; border-style:
none; padding: 0px;">
<div><i>~$ ldapsearch -w <mypassword> -D
LDAP@<domain>.local -H <a class="moz-txt-link-freetext" href="ldap://">ldap://</a><server ip> -b
"ou=AllowedUsers,ou=Users,ou=MyBusiness,dc=<domain>,dc=local"
sAMAccountName</i></div>
</blockquote>
<div><br>
</div>
<div> I get a list of the users in the AllowedUsers OU so it
looks like I can query the LDAP server. However when I try
and translate this to the preferences.php file I get:</div>
<div><br>
</div>
<blockquote style="margin: 0px 0px 0px 40px; border-style:
none; padding: 0px;">
<div><span class="Apple-tab-span" style="white-space: pre;"></span><i>LDAP
Error: Unable to connect to any of the LDAP servers;
could not authenticate user.</i></div>
<div><i>Authentication Error: The username or password was
incorrect.</i></div>
</blockquote>
</div>
</div>
</blockquote>
The "-D" you are passing in with the "-w" doesn't authenticate
correctly. Why do you need to specify the @<domain>.local,
surely just "LDAP" should work as the rest should be taken by
default.<br>
<blockquote cite="mid:C99BFD05.10B6C%25craig@craigchambers.net"
type="cite">
<div>
<blockquote style="margin: 0px 0px 0px 40px; border-style: none;
padding: 0px;">
<div><br>
</div>
</blockquote>
<div>I currently have both LDAP and AD active in the
preference.php file to see if I could get either to work which
is why I assume I am getting two error messages. <br>
</div>
</div>
</blockquote>
That will definitely break it. You must only have 1 "authenticator =
....." line uncommented, otherwise the first one will probably get
over-ridden by the later ones.<br>
<br>
Leave all the settings in the LDAP section commented out, for
starters.<br>
<br>
Try this set for the AD ones:<br>
<br>
'authenticator' => 'AD',<br>
'authLDAPBaseDN1' =>
'ou=AllowedUsers,ou=Users,ou=MyBusiness,dc=<domain>,dc=local',<br>
'authLDAPServers1' => array('<server ip>'),<br>
'authLDAPAccountSuffix1' => '',<br>
'authLDAPUseSSL1' => false,<br>
'authLDAPBindUser1' => 'LDAP@<domain>.local',<br>
'authLDAPBindPass1' => '<mypassword>',<br>
'authLDAPOrganization1' => '<your organisation name>',<br>
'authLDAPBaseDN2' => '',<br>
'authLDAPServers2' => array(),<br>
'authLDAPAccountSuffix2' => '',<br>
'authLDAPUseSSL2' => false,<br>
'authLDAPBindUser2' => '',<br>
'authLDAPBindPass2' => '',<br>
'authLDAPOrganization2' => '',<br>
<br>
If you want to restrict it to certain "allowed users", then instead
of putting it in the authLDAPBaseDN1, use the settings immediately
below it like this:<br>
<br>
// If both of these are set, then only users who are members of
the given<br>
// role/group can log in to ZendTo.<br>
'authLDAPMemberKey' => 'memberOf',<br>
'authLDAPMemberRole' =>
'cn=AllowedUsers,OU=Users,OU=MyBusiness,dc=<domain>,dc=local',<br>
<br>
and hence just add your users to the group "Allowed Users" within
the OU=Users subtree. So let any user authenticate, just only allow
the users in that you want. They should get a more sensible error
message then too.<br>
<pre class="moz-signature" cols="72">Jules
--
Julian Field MEng CITP CEng
<a class="moz-txt-link-abbreviated" href="http://www.Zend.To">www.Zend.To</a>
Follow me at twitter.com/JulesFM
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
'All programs have a desire to be useful' - Tron, 1982
</pre>
</body>
</html>