Authentication against External LDAP

hcl-bot · July 26, 2005, 11:55pm

Hi,

I am trying to authenticate our web users with our external LDAP server which runs on Windows Active Directory. The reason for this is so that user does not have to remember the domino password, they could just use their windows password to login to the domino system on the web.

I have managed to connect to ldap but I cannot authenticate the users at all.

I am running domino 6.5.3.

I’d set the authentication type of SSO.

I’d created the LDAP entry in Directory Assistance database (da.nsf).

I’d enabled the LDAP port (389).

I have created a test database with default settings as manager and force the login to the database. for eg: http://hostname/test/testldap.nsf?login.

on the logon screen, i type in as follow for the username → cn=test user/dc=mydomain/dc=com.

i’d tried with uid=tuser/dc=mydomain/dc=com, or tuser. All this does not work at all.

I’d also tried ldapsearch.

The syntax which I used was:

ldapsearch -h mydomain.com -b “cn=test user,dc=mydomain,dc=com” -w

“password” “objectClass=*”

It returns ldap bind error.

Anyone has any idea out there? I’d been trying these for the last few …

Thanks.

hcl-bot · July 27, 2005, 10:34am

Subject: Authentication against External LDAP

I’d also tried ldapsearch.The syntax which I used was:

ldapsearch -h mydomain.com -b “cn=test user,dc=mydomain,dc=com” -w

“password” “objectClass=*”

It returns ldap bind error.

First of all, it’s great that you tried ldapsearch, isolating it to an LDAP usage problem (and taking DA out of the picture).

I don’t remember if you need to authenticate to AD. In any case use the -D and -w switches to supply the userdn and password. I don’t know if your -b was a typo when you meant to use -D. For help on the options, run ldapsearch without any arguments.

Normal Active Directory naming likes to place users in a hierarchy like “cn=test user,cn=users,cn=mymachine,dc=mydomain,dc=com”. Make sure you’ve got the naming correct.

hcl-bot · July 27, 2005, 3:17pm

Subject: RE: Authentication against External LDAP

It was typo error. I did tried with -D.

I tried this on the cmd prompt and that was what it returned.

C:\Program Files\Lotus\notes>ldapsearch -h mydomain.com -d “cn=test user,cn=users,cn=location,dc=mydomain,dc=com” -w password “objectclass=*”

ldap_bind_s( dn=cn=test user,cn=users,cn=location,dc=mydomain,dc=com pw=password, method=128 ) failed, error

: resultCode 49 (Invalid credentials)

ldap_bind_s( dn=cn=test user,cn=users,cn=location,dc=mydomain,dc=com, pw=password, method=128 ) failed, error

: errorMessage: 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext

error, data 525, v893

Is there any settings in the microsoft AD which does not permit all this? Or what have I place wrong? According to my system engineer, he mentioned that our AD does not allow anonymous query.

hcl-bot · July 28, 2005, 8:07am

Subject: RE: Authentication against External LDAP

It was typo error. I did tried with -D.

I tried this on the cmd prompt and that was what it returned.

C:\Program Files\Lotus\notes>ldapsearch -h mydomain.com -d “cn=test user,cn=users,cn=location,dc=mydomain,dc=com” -w password “objectclass=*”

ldap_bind_s( dn=cn=test user,cn=users,cn=location,dc=mydomain,dc=com pw=password, method=128 ) failed, error

: resultCode 49 (Invalid credentials)

ldap_bind_s( dn=cn=test user,cn=users,cn=location,dc=mydomain,dc=com, pw=password, method=128 ) failed, error

: errorMessage: 80090308: LdapErr: DSID-0C09030B, comment: AcceptSecurityContext

error, data 525, v893

Is there any settings in the microsoft AD which does not permit all this? Or what have I place wrong? According to my system engineer, he mentioned that our AD does not allow anonymous query.

Your ldapsearch above is issuing an anonymous query because you need to use -D to specify the distinguished name you are authenticating as rather than -d which is a diagnostic switch specifing the debug level.

Again, type ldapsearch without any arguments to see the parameters it recognizes.

Historical aside: ldapsearch is part of U Michigan’s / Netscape’s LDAP C toolkit. The use of -D therefore follows the original implementation. Many LDAP products besides Lotus Notes/Domino also deliver their implementation of the ldapsearch tool.

hcl-bot · July 28, 2005, 7:00pm

Subject: RE: Authentication against External LDAP

Hi Ken,

I’d managed to get the ldap search working. It was because of my base DN. The format which I used was wrong.

Now I have managed to authenticate my users on the Microsoft AD. But I have to use the Full Name instead of the User Name to logon. Is there any settings in the LDAP entry in DA.nsf which I need to set?

My AD format was:

CN=xxx,OU=Users,OU=organisation,DC=mydomian, DC=com.

Thanks.

hcl-bot · August 2, 2005, 10:54pm

Subject: RE: Authentication against External LDAP

Hi,I did successfull configure my Note Client connect to LDAP entry by ldapsearch. But I would like to open my Directory in Domino (names.nsf) by web using account in LDAP. How can I get that? (Although, I put the LDAP account in ACL of names.nsf)

Please help

hcl-bot · July 31, 2009, 11:46am

Subject: Authentication against External LDAP

Hi Micki Ng, we just installed a test domino server and would like to authenciate our web users with external LDAP server. Could you please help me to do this?

Rajesh