LDAP and Active Directory Authentication

HCL Domino Domino Forum
1

I am connecting to a remote Active Directory with LDAP config set up in DA. Currently we are testing. I can authenticate all 10 test users with the CN attribute. We are running 6.5.4 FP2. Business wants to search on CN and sAMAccountName, so I have selected Custom for type of search filter to use. And I have the Mail Filter blank the Authorization filter as blank and the authentication filter as follows

(|(sAMAccountName=%)(cn=%))

Since I have made this filter I can only get one of the ten 10 users to authenticate using sAMAccountName, all users can still authenticate using cn name.

I can see the console finding a match, it will just not authenticate the user.

Any help would be appreciated.

I have mucked around with the filter and added mailnickname in too

(|(sAMAccountName=%)(mailNickname=%)(cn=%*))

Again it is not working for all when entering mailnickname

2

Subject: LDAP and Active Directory Authentication

(|(sAMAccountName=%)(cn=%))

Since I have made this filter I can only get one of the ten 10 users to authenticate using sAMAccountName, all users can still authenticate using cn name.

I can see the console finding a match, it will just not authenticate the user.

Two comments, using ID107: Getting Started With Active Directory Integration as a reference:

When you set ttype of search = Active Directory, versions 7.0.1 and the future 6.5.6 versions of Domino directory assistance will include sAMAccountName (see slide 30). Unfortunately 6.5.5 or earlier does not incorporate sAMAccountName as you’ve found out.

When you see “the console finding a match”, I will assume you are using WebAuth_Verbose_Trace=1. So in your trace you see the successful name resolution sequence (bullet 1 in slide 36)? Make sure the

NAMELookup:: ldap_search returned matched DN = ‘CN=blah/CN=users/DC=…’

matches the unique user. If it does not, it won’t proceed to the success authentication sequence (bullet 2 in slide 36)

NAMELookup:: BIND LDAP host=‘[xxx.com]:389’ w/ user=‘CN=blah/CN=users/DC=…’

3

Subject: RE: LDAP and Active Directory Authentication

Ken, here is the console log, it returns the exact same DN for both, it just does not authenticate

WHEN ENTERING CN

11/10/2006 11:46:54.73 AM [0440:0004-0B88] NAMELookup:: ldap_search returned matched DN=‘CN=Nicol, Andrew/OU=WBT Users/OU=Engineering Test/OU=Business Technology Services/OU=Accounts/DC=btfin/DC=com’

11/10/2006 11:46:54.84 AM [0440:000D-0AD8] WebAuth> BIND LDAP host=‘XX.XX.XX.XX:389’ w/ user=‘CN=Nicol, Andrew,OU=WBT Users,OU=Engineering Test,OU=Business Technology Services,OU=Accounts,DC=btfin,DC=com’

11/10/2006 11:46:54.84 AM [0440:000D-0AD8] WebAuth> VERIFY password

11/10/2006 11:46:54.84 AM [0440:000D-0AD8] WebAuth> Adding ‘CN=Nicol, Andrew/OU=WBT Users/OU=Engineering Test/OU=Business Technology Services/OU=Accounts/DC=btfin/DC=com’ to user cache.

11/10/2006 11:46:54.84 AM [0440:000D-0AD8] HTTP Sessions> Logging in user (CN=Nicol, Andrew/OU=WBT Users/OU=Engineering Test/OU=Business Technology Services/OU=Accounts/DC=btfin/DC=com)

11/10/2006 11:46:54.84 AM [0440:000D-0AD8] HTTP Sessions> Generating session cookie (DomAuthSessId)

11/10/2006 11:46:54.84 AM [0440:000D-0AD8] HTTP Sessions> Generated session cookie (DomAuthSessId)

11/10/2006 11:46:54.84 AM [0440:000D-0AD8] HTTP Sessions> Setting cookie (Set-Cookie: DomAuthSessId=4533FB8A2A59C06BF12CEF156179DAB2; path=/)

WHEN ENTERING sAMAccountName

11/10/2006 11:46:32.77 AM [0440:0004-0B88] NAMELookup:: ldap_search returned matched DN=‘CN=Nicol, Andrew/OU=WBT Users/OU=Engineering Test/OU=Business Technology Services/OU=Accounts/DC=btfin/DC=com’

11/10/2006 11:46:33.99 AM [0440:000B-09E0] WebAuth> BIND LDAP host=‘XX.XX.XX.XX:389’ w/ user=‘CN=Nicol, Andrew,OU=WBT Users,OU=Engineering Test,OU=Business Technology Services,OU=Accounts,DC=btfin,DC=com’

11/10/2006 11:46:33.99 AM [0440:000B-09E0] WebAuth> VERIFY password

11/10/2006 11:46:33.99 AM [0440:000B-09E0] WebAuth> No unambiguous match for user=‘nicola’ org=‘’

11/10/2006 11:46:33.99 AM [0440:000B-09E0] WebAuth> User Anonymous found in group Cache!

I know this password is correct, as it comes up verify password, if I type in an incorrect password is shows as follows

06/10/2006 04:09:47.12 PM [1358:0019-1194] WebAuth> BIND LDAP host=‘10.29.113.49:389’ failed!, rc=‘49’

It gets to Verify Password for samaccountname and then NO UNAMBIGUOUS MATCH

4

Subject: RE: LDAP and Active Directory Authentication

It gets to Verify Password for samaccountname and then NO UNAMBIGUOUS MATCH

I think this is because there there is one AD object that matches the criteria

(cn=Nicola, Andrew)

but more than one DN found via this filter

(sAMAccountName=nicola)

Can you these two independently via an ldapsearch? Slide 34 from ID107: Getting Started With Active Directory Integration will help you determine your arguments based upon your DA doc. For the last argument, substitute your filters.

5

Subject: RE: LDAP and Active Directory Authentication

I have done this a number of times using different filters and everytime I get the right record returned, I have tried again searching with samaccountname and it works

C:\Program Files\lotus\notes>ldapsearch.exe -h xx.xx.xx.xx -p 389 -D "CN=Srvc_t

est_NotesDS,OU=WBT Users,OU=Engineering Test,OU=Business Technology Services,OU=

Accounts,DC=btfin,DC=com" -w “xxxxxxxx” -b "OU=WBT Users,OU=Engineering Test,O

U=Business Technology Services,OU=Accounts,DC=btfin,DC=com" (samaccountname=nico

la)

CN=Nicol, Andrew,OU=WBT Users,OU=Engineering Test,OU=Business Technology Servic

es,OU=Accounts,DC=btfin,DC=com

objectClass=top

objectClass=person

objectClass=organizationalPerson

objectClass=user

cn=Nicol, Andrew

sn=Nicol

description=Test account for LDAP Notes with Westpac

givenName=Andrew

distinguishedName=CN=Nicol, Andrew,OU=WBT Users,OU=Engineering Test,OU=Business

Technology Services,OU=Accounts,DC=btfin,DC=com

instanceType=4

whenCreated=20061006043114.0Z

whenChanged=20061012043614.0Z

displayName=Nicol, Andrew

uSNCreated=113543504

uSNChanged=115098468

homeMTA=CN=Microsoft MTA,CN=AUPOZA408,CN=Servers,CN=BTAL,CN=Administrative Group

s,CN=BT Financial Group,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=bt

fin,DC=com

proxyAddresses=X400:c=US;a= Telemail;p=BankersTrust;o=BTAL;s=Nicol2;g=Andrew;

proxyAddresses=SMTP:Andrew.Nicol@BTFinancialgroup.com

proxyAddresses=NOTES:Andrew Nicol/BTFG@BTFG

homeMDB=CN=408 SG1 Mailbox Store1,CN=Aupoza408 SG1,CN=InformationStore,CN=AUPOZA

408,CN=Servers,CN=BTAL,CN=Administrative Groups,CN=BT Financial Group,CN=Microso

ft Exchange,CN=Services,CN=Configuration,DC=btfin,DC=com

mDBUseDefaults=TRUE

extensionAttribute5=nicola

mailNickname=nicolaa

name=Nicol, Andrew

objectGUID=NOT ASCII

userAccountControl=512

badPwdCount=0

codePage=0

countryCode=0

badPasswordTime=128051008737575237

lastLogoff=0

lastLogon=128051021215210691

pwdLastSet=128049162050753269

primaryGroupID=513

objectSid=NOT ASCII

accountExpires=9223372036854775807

logonCount=0

sAMAccountName=nicola

sAMAccountType=805306368

showInAddressBook=CN=Default Global Address List,CN=All Global Address Lists,CN=

Address Lists Container,CN=BT Financial Group,CN=Microsoft Exchange,CN=Services,

CN=Configuration,DC=btfin,DC=com

showInAddressBook=CN=All Users,CN=All Address Lists,CN=Address Lists Container,C

N=BT Financial Group,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=btfin

,DC=com

legacyExchangeDN=/O=BankersTrust/OU=BTAL/cn=Recipients/cn=nicola

userPrincipalName=nicola@btfin.com

objectCategory=CN=Person,CN=Schema,CN=Configuration,DC=btfin,DC=com

lastLogonTimestamp=128050854011803143

textEncodedORAddress=c=US;a= Telemail;p=BankersTrust;o=BTAL;s=Nicol2;g=Andrew;

mail=Andrew.Nicol@BTFinancialgroup.com

msExchHomeServerName=/O=BankersTrust/OU=BTAL/cn=Configuration/cn=Servers/cn=AUPO

ZA408

msExchALObjectVersion=49

msExchMailboxSecurityDescriptor=NOT ASCII

msExchUserAccountControl=0

msExchMailboxGuid=NOT ASCII

msExchPoliciesIncluded={519F6D82-C3AE-4CE9-91EA-72F215BB7761},{3B6813EC-CE89-42B

A-9442-D87D4AA30DBC}

msExchPoliciesIncluded={C9F0AC83-CDE3-46FE-B050-D13BDA1B954C},{26491CFC-9E50-485

7-861B-0CB8DF22B5D7}

6

Subject: RE: LDAP and Active Directory Authentication

Got it working sort of, it was looking up all directories and finding duplicates. I turned off the other 2 listed in DA and it works, but now I want to stop DA looking up all directories

https://www-10.lotus.com/ldd/nd6forum.nsf/DateAllThreadedweb/dd9feffc60475be08525721b001f03c4?OpenDocument