Web authentication using LDAP

I want to enable a web authentication using LDAP from Microsoft Active Directory.I created at Directory Assistance a Domain to this LDAP AD Server. This is working fine because I can search users from AD at Inotes, but the authentication haven’t work.

I haven’t enable “Trusted for Credentials”. Is it mandatory ? I don’t have SSL enabled at Domino and AD.

Domain configuration - Directory Assistance

============================================

Basics Tab

==========

Domain type: LDAP

Domain name: NET

Company name: ACME

Search order: 1

Make this domain available to: Notes Clients & Internet Authentication/ Authorization; LDAP Clients

Group Authorization: Yes

Nested group expansion: Yes

Enabled: Yes

Rules Tab

=========

OrgUnit4: */

OrgUnit3: */

OrgUnit2: */

OrgUnit1: */

Organization: */

Country: *

Enabled: Yes

Trusted for Credentials: No

LDAP Tab

========

Hostname: 10.1.1.1

Optional Authentication Credential:

Username: admin@acme.com

Password: xxxxx

Base DN for search: DC=acme, DC=com

Channel encryption: None

Port: 370

Advanced Options

Timeout: 60 seconds

Maximum number of entries returned: 200

Dereference alias on search: Always

Preferred mail format: Internet Mail Address

Attribute to be used as Notes Distinguished Name:

Type of search filter to use: Custom

Customized Filters

Mail Filter: (sAMAccountName=%*)

Authentication Filter: (sAMAccountName=%*)

Authorization Filter: (sAMAccountName=%*)

Logs

======

The user that is trying to authenticate doesn’t match with any Domain. I can’t find out what I did wrong.

24/03/2004 10:35:14,36 [0A5C:0018-0970] WebAuth> LOOKUP in view $Users (user=‘admin/acme.com’ org=‘’)

24/03/2004 10:35:14,36 [0A5C:0004-06B0] DA> Trying to resolve domain for name admin/acme.com

24/03/2004 10:35:14,36 [0A5C:0004-06B0] DA> No matching rule found for Name admin/acme.com

24/03/2004 10:35:14,36 [0A5C:0018-0970] WebAuth> No unambiguous match for user=‘admin/acme.com’ org=‘’

24/03/2004 10:35:14,37 [0A5C:0004-06B0] DA> Trying to resolve domain for name *

24/03/2004 10:35:14,37 [0A5C:0004-06B0] DA> DirAssist: Name * matches Rule ///// for Domain=NET!

24/03/2004 10:35:14,37 [0A5C:0004-06B0] DA> Trying to resolve domain for name *

24/03/2004 10:35:14,37 [0A5C:0004-06B0] DA> DirAssist: Name * matches Rule ///// for Domain=NET!

24/03/2004 10:35:14,37 [0A5C:0004-06B0] DA> Trying to resolve domain for name *

24/03/2004 10:35:14,37 [0A5C:0004-06B0] DA> DirAssist: Name * matches Rule ///// for Domain=NET!

24/03/2004 10:35:14,37 [0A5C:0004-06B0] WebAuth> GroupCache: WildCard Name=‘*’

24/03/2004 10:35:14,38 [0A5C:0004-06B0] DA> Trying to resolve domain for name Anonymous

24/03/2004 10:35:14,38 [0A5C:0004-06B0] DA> DirAssist: Name Anonymous matches Rule ///// for Domain=NET!

24/03/2004 10:35:14,38 [0A5C:0004-06B0] NAMELookup:: Searching for name=‘Anonymous’ in LDAP server=‘10.1.1.1’

24/03/2004 10:35:14,38 [0A5C:0004-06B0] NAMELookup:: Attr:‘ListName’

24/03/2004 10:35:14,38 [0A5C:0004-06B0] NAMELookup:: Attr:‘$$DBIndex’

24/03/2004 10:35:14,38 [0A5C:0004-06B0] NAMELookup:: Attr:‘$$Domaint]]tType’

24/03/2004 10:35:14,38 [0A5C:0004-06B0] NAMELookup:: Attr:‘CN’

24/03/2004 10:35:14,38 [0A5C:0004-06B0] NAMELookup:: Attr:‘objectClass’

24/03/2004 10:35:14,38 [0A5C:0004-06B0] NAMELookup:: Base=

24/03/2004 10:35:14,38 [0A5C:0004-06B0] NAMELookup:: Scope=2

24/03/2004 10:35:14,38 [0A5C:0004-06B0] NAMELookup:: Filter=(|(&(objectclass=group)(Member=cn=ANONYMOUS))(&(objectclass=groupOfUniqueNames)(UniqueMember=uid=ANONYMOUS))(&(objectclass=groupOfNames)(Member=cn=ANONYMOUS)))

24/03/2004 10:35:14,39 [0A5C:0004-06B0] NAMELookup:: Timeout=60 secs

24/03/2004 10:35:14,49 [0A5C:0004-06B0] NAMELookup:: ldap_search returned nothing!

Subject: You are correct you have to Allow Trusted for Credentials to use that Directory to Login.

Subject: Web authentication using LDAP

Hi Amanda!

The short answer is “Yes.” You must have “Trusted for credentials” set to yes. It doesn’t matter that you don’t have SSL turned on, as long as you don’t care about the security of the usernames and passwords going across your network.

There’s a blurb on doing exactly what you asked in the Administration help docs called “Authenticating Internet name-and-password clients in secondary Domino and LDAP directories.”

Good luck!

-josh