RE: [Fedora-directory-users] Binding using attribute other than C N

[Bowie Bailey]

Richard Gibson wrote:
>  Hello there.
>  
>  I've been using the Fedora Directory Server for very small scale
>  testing at work, but actually know rather little about LDAP
>  unfortunately. Hopefully you won't mind. Anyway, is it possible to
>  bind with an entry other than CN? I have the following user (LDIF
>  format):   
>  
>  dn: uid=RSmith,ou=People, dc=fedora,dc=test,dc=com
>  mail: blablabla(a)test.com
>  uid: RSmith
>  givenName: Richard
>  objectClass: top
>  objectClass: person
>  objectClass: organizationalPerson
>  objectClass: inetorgperson
>  objectClass: ntuser
>  objectClass: posixAccount
>  sn: Smith
>  cn: RSmith
>  creatorsName:
>  uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot 
>  modifiersName:
>  uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot 
>  createTimestamp: 20050905103419Z
>  modifyTimestamp: 20050916131603Z
>  nsUniqueId: 86b5b081-1dd211b2-806ddcd6-e1700000
>  ntUserDomainId: smithr
>  uidNumber: 1
>  gidNumber: 2
>  homeDirectory: /home/smithr
>  
>  
>  When attempting to bind using the following (as taken from the access
>  log): 
>  BIND dn="ntUserDomainId=Richard Smith,ou=People,dc=fedora,dc=test,dc=com"
method=128 version=3 
>  
>  ...I get "No such object". This user does exist though. Is binding
>  using the ntUserDomainId out of the question?  
Take a closer look.  The ntUserDomainId is "smithr" for this user, not
"Richard Smith".

Try this:
dn="ntUserDomainId=smithr,ou=People,dc=fedora,dc=test,dc=com"

Disclaimer: I'm an LDAP beginner myself.  This is just a suggestion
based on the fact that your bind doesn't match the user information you
provided.

-- 
Bowie

[Fedora-directory-users] Binding using attribute other than C N

[Rich Megginson]

I don't think this will work either.  The DN for the entry is 
uid=RSmith,ou=People, dc=fedora,dc=test,dc=com - If you want to bind as 
this same user but with a different DN, you will have to rename the 
entry to use ntUserDomainId=smithr as the RDN instead of uid=RSmith.  If 
AD allows you to request an entry by DN other than the actual DN of the 
entry, then it is non-standard LDAP behavior.

Of course, if your client program allows it (like PAM), you can use a 
different search filter to look up your entry.  I think PAM by default 
uses (uid=%s) where %s is filled in with your login name.  I suppose you 
could change it to (ntUserDomainId=%s), then you should be able to use 
your existing entry for PAM login without having to rename it.  However, 
if your client application expects ntUserDomainId=foo in the DN, then 
you have no choice but to rename your entry.

Bowie Bailey wrote:

> Richard Gibson wrote:
>   
>
> >Hello there.
> >
> >I've been using the Fedora Directory Server for very small scale
> >testing at work, but actually know rather little about LDAP
> >unfortunately. Hopefully you won't mind. Anyway, is it possible to
> >bind with an entry other than CN? I have the following user (LDIF
> >format):   
> >
> >dn: uid=RSmith,ou=People, dc=fedora,dc=test,dc=com
> >mail: blablabla(a)test.com
> >uid: RSmith
> >givenName: Richard
> >objectClass: top
> >objectClass: person
> >objectClass: organizationalPerson
> >objectClass: inetorgperson
> >objectClass: ntuser
> >objectClass: posixAccount
> >sn: Smith
> >cn: RSmith
> >creatorsName:
> >uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot 
> >modifiersName:
> >uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot 
> >createTimestamp: 20050905103419Z
> >modifyTimestamp: 20050916131603Z
> >nsUniqueId: 86b5b081-1dd211b2-806ddcd6-e1700000
> >ntUserDomainId: smithr
> >uidNumber: 1
> >gidNumber: 2
> >homeDirectory: /home/smithr
> >
> >
> >When attempting to bind using the following (as taken from the access
> >log): 
> >BIND dn="ntUserDomainId=Richard Smith,ou=People,dc=fedora,dc=test,dc=com"
> >    
> >
> method=128 version=3 
>   
>
> >...I get "No such object". This user does exist though. Is binding
> >using the ntUserDomainId out of the question? 
> >    
> >
>
> Take a closer look.  The ntUserDomainId is "smithr" for this user, not
> "Richard Smith".
>
> Try this:
> dn="ntUserDomainId=smithr,ou=People,dc=fedora,dc=test,dc=com"
>
> Disclaimer: I'm an LDAP beginner myself.  This is just a suggestion
> based on the fact that your bind doesn't match the user information you
> provided.
>
>   
>

[Fedora-directory-users] Binding using attribute other than C N

[Richard Gibson]

My apologies - I put the wrong bind example in. Attempting to bind as
dn="ntUserDomainId=smithr,ou=People,dc=fedora,dc=test,dc=com"
also fails.
Richard, regarding the alternative search filter, is it possible to perform
a search where you match against a password?

I'm using this to currently perform a silent login after having binded (is
that a word?) was the directory admin.
SRCH base="ou=People,dc=fedora,dc=test,dc=com" scope=2
filter="(&(objectClass=*)(ntUserDomainId=SmithR))"
attrs="memberOf"

I imagine it would be fairly easy to extract the password too. Do you think
so? Would I use the userPassword field for this? Do you think that this is
what most directories will store the user's password in?

Many thanks again
Rich

On 12/01/06, Richard Megginson <rmeggins(a)redhat.com&gt; wrote:
>  I don't think this will work either.  The DN for the entry is
>  uid=RSmith,ou=People, dc=fedora,dc=test,dc=com - If you want to bind as
>  this same user but with a different DN, you will have to rename the
>  entry to use ntUserDomainId=smithr as the RDN instead of uid=RSmith.  If
>  AD allows you to request an entry by DN other than the actual DN of the
>  entry, then it is non-standard LDAP behavior.
>
>  Of course, if your client program allows it (like PAM), you can use a
>  different search filter to look up your entry.  I think PAM by default
>  uses (uid=%s) where %s is filled in with your login name.  I suppose you
>  could change it to (ntUserDomainId=%s), then you should be able to use
>  your existing entry for PAM login without having to rename it.  However,
>  if your client application expects ntUserDomainId=foo in the DN, then
>  you have no choice but to rename your entry.
>
>  Bowie Bailey wrote:
>
>  >Richard Gibson wrote:
>  >
>  >
>  >>Hello there.
>  >>
>  >>I've been using the Fedora Directory Server for very small scale
>  >>testing at work, but actually know rather little about LDAP
>  >>unfortunately. Hopefully you won't mind. Anyway, is it possible to
>  >>bind with an entry other than CN? I have the following user (LDIF
>  >>format):
>  >>
>  >>dn: uid=RSmith,ou=People, dc=fedora,dc=test,dc=com
>  >>mail: blablabla(a)test.com
>  >>uid: RSmith
>  >>givenName: Richard
>  >>objectClass: top
>  >>objectClass: person
>  >>objectClass: organizationalPerson
>  >>objectClass: inetorgperson
>  >>objectClass: ntuser
>  >>objectClass: posixAccount
>  >>sn: Smith
>  >>cn: RSmith
>  >>creatorsName:
>  >>uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
>  >>modifiersName:
>  >>uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
>  >>createTimestamp: 20050905103419Z
>  >>modifyTimestamp: 20050916131603Z
>  >>nsUniqueId: 86b5b081-1dd211b2-806ddcd6-e1700000
>  >>ntUserDomainId: smithr
>  >>uidNumber: 1
>  >>gidNumber: 2
>  >>homeDirectory: /home/smithr
>  >>
>  >>
>  >>When attempting to bind using the following (as taken from the access
>  >>log):
>  >>BIND dn="ntUserDomainId=Richard
>  Smith,ou=People,dc=fedora,dc=test,dc=com"
>  >>
>  >>
>  >method=128 version=3
>  >
>  >
>  >>...I get "No such object". This user does exist though. Is binding
>  >>using the ntUserDomainId out of the question?
>  >>
>  >>
>  >
>  >Take a closer look.  The ntUserDomainId is "smithr" for this user, not
>  >"Richard Smith".
>  >
>  >Try this:
>  >dn="ntUserDomainId=smithr,ou=People,dc=fedora,dc=test,dc=com"
>  >
>  >Disclaimer: I'm an LDAP beginner myself.  This is just a suggestion
>  >based on the fact that your bind doesn't match the user information you
>  >provided.
>  >
>  >
>  >
>
>
>  --
>  Fedora-directory-users mailing list
>  Fedora-directory-users(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
>
>
>

[Fedora-directory-users] Binding using attribute other than C N

[Rich Megginson]

Richard Gibson wrote:

>  My apologies - I put the wrong bind example in. Attempting to bind as
>
>  dn="ntUserDomainId=smithr,ou=People,dc=fedora,dc=test,dc=com" also fails.
Yes, because the DN of the entry is uid=RSmith,ou=People, 
dc=fedora,dc=test,dc=com not 
ntUserDomainId=smithr,ou=People,dc=fedora,dc=test,dc=com

>  Richard, regarding the alternative search filter, is it possible to 
>  perform a search where you match against a password? 
What exactly are you trying to do?  When you perform an LDAP BIND 
operation, you pass the credentials (i.e. the password) to the directory 
server, and it does the password comparison.  LDAP BIND using other 
mechanism (SASL, TLS) allow you to pass credentials other than 
passwords.  The client should never attempt to read the password from 
the directory server and do the password comparison itself.

>  I'm using this to currently perform a silent login after having binded 
>  (is that a word?) was the directory admin.
>  SRCH base="ou=People,dc=fedora,dc=test,dc=com" scope=2 
>  filter="(&(objectClass=*)(ntUserDomainId=SmithR))"
> attrs="memberOf" 
You don't need (objectclass=*) - it is redundant in this context.  You 
can just use filter="(ntUserDomainId=SmithR)"

Fedora DS does not support the memberOf attribute - you would have to 
add additional schema to support it.

>  I imagine it would be fairly easy to extract the password too. Do you 
>  think so? Would I use the userPassword field for this? Do you think 
>  that this is what most directories will store the user's password in?
>
>  Many thanks again
>  Rich
>
>  On 12/01/06, *Richard Megginson* <rmeggins(a)redhat.com 
>  <mailto:[e-mail]>> wrote:
>
>      I don't think this will work either.  The DN for the entry is
>      uid=RSmith,ou=People, dc=fedora,dc=test,dc=com - If you want to
>      bind as
>      this same user but with a different DN, you will have to rename the
>      entry to use ntUserDomainId=smithr as the RDN instead of
>      uid=RSmith.  If
>      AD allows you to request an entry by DN other than the actual DN
>      of the
>      entry, then it is non-standard LDAP behavior.
>
>      Of course, if your client program allows it (like PAM), you can use a
>      different search filter to look up your entry.  I think PAM by
>      default
>      uses (uid=%s) where %s is filled in with your login name.  I
>      suppose you
>      could change it to (ntUserDomainId=%s), then you should be able to use
>      your existing entry for PAM login without having to rename
>      it.  However,
>      if your client application expects ntUserDomainId=foo in the DN, then
>      you have no choice but to rename your entry.
>
>      Bowie Bailey wrote:
>
>      >Richard Gibson wrote:
>      >
>      >
>      >>Hello there.
>      >>
>      >>I've been using the Fedora Directory Server for very small scale
>      >>testing at work, but actually know rather little about LDAP
>      >>unfortunately. Hopefully you won't mind. Anyway, is it possible to
>      >>bind with an entry other than CN? I have the following user (LDIF
>      >>format):
>      >>
>      >>dn: uid=RSmith,ou=People, dc=fedora,dc=test,dc=com
>      >>mail: blablabla(a)test.com <mailto:[e-mail]>
>      >>uid: RSmith
>      >>givenName: Richard
>      >>objectClass: top
>      >>objectClass: person
>      >>objectClass: organizationalPerson
>      >>objectClass: inetorgperson
>      >>objectClass: ntuser
>      >>objectClass: posixAccount
>      >>sn: Smith
>      >>cn: RSmith
>      >>creatorsName:
>      >>uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
>      >>modifiersName:
>      >>uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
>      >>createTimestamp: 20050905103419Z
>      >>modifyTimestamp: 20050916131603Z
>      >>nsUniqueId: 86b5b081-1dd211b2-806ddcd6-e1700000
>      >>ntUserDomainId: smithr
>      >>uidNumber: 1
>      >>gidNumber: 2
>      >>homeDirectory: /home/smithr
>      >>
>      >>
>      >>When attempting to bind using the following (as taken from the
>      access
>      >>log):
>      >>BIND dn="ntUserDomainId=Richard
>      Smith,ou=People,dc=fedora,dc=test,dc=com"
>      >>
>      >>
>      >method=128 version=3
>      >
>      >
>      >>...I get "No such object". This user does exist though. Is binding
>      >>using the ntUserDomainId out of the question?
>      >>
>      >>
>      >
>      >Take a closer look.  The ntUserDomainId is "smithr" for this
>      user, not
>      >"Richard Smith".
>      >
>      >Try this:
>      >dn="ntUserDomainId=smithr,ou=People,dc=fedora,dc=test,dc=com"
>      >
>      >Disclaimer: I'm an LDAP beginner myself.  This is just a suggestion
>      >based on the fact that your bind doesn't match the user
>      information you
>      >provided.
>      >
>      >
>      >
>
>
>      --
>      Fedora-directory-users mailing list
>      Fedora-directory-users(a)redhat.com
>      <mailto:[e-mail]>
>      https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
>
>
>
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   
>