What is my Domino LDAP DN / info

[hcl-bot]

Hi,

I’m trying to get my IronPort (Antispam device) to make valid LDAP queries to my Domino Mail Server.

I’m unsure what my Base DN and Query string should be; how can I work this information out?

I’m using Softerra Ldap Browser 2.6 to test the LDAP connection to my Domino server and have been unsuccessfull so far when using O=DOMAINDOMAIN

I need to perform LDAP queries against my Domino server so my users can use the IronPort login to view spam specfiic only to them so authentication is important.

** Note LDAP is setup on my Domino 7.0.2 server but LDAP users do not have write access at the moment only read.

Any thoughts/suggestions welcome.

Thanks

p.s. I’m not yet looking to integrate AD with Domino LDAP, little hesitant on this so I’d prefer to query Domino LDAP direct from IronPort rather then utilise the AD option.

[hcl-bot]

Subject: What is my Domino LDAP DN / info

I’m using Softerra 2.5 and have had no trouble. Try leaving the base setting as high as you can (start off blank to see what the schema is)

[hcl-bot]

Subject: What is my Domino LDAP DN / info

I’m trying to get my IronPort (Antispam device) to make valid LDAP queries to my Domino Mail Server.

I’m unsure what my Base DN and Query string should be; how can I work this information out?

I’m using Softerra Ldap Browser 2.6 to test the LDAP connection to my Domino server and have been unsuccessfull so far when using O=DOMAINDOMAIN

When you use a base of O=YourDomain, you will be unable to find any of the flat names in your directory since they do not live under the O=YourDomain naming subtree. While most customers implement hierarchical user names, their Domino Group documents usually have flat ListName values. So for many LDAP searches to Domino, you’ll want to leave the base blank, so the entire hierarchy, including flat names, are searched. (Note: There are some products)

Your search may be unsuccessful because your Domino LDAP server may be set to prevent anonymous queries. If so, you’ll need to supply “bind” (LDAP’s term for authenticate) credentials to the LDAP server using the LDAP form of a user who is allowed read access to your Domino directory(s). Simplistically, you convert your Notes distinguished name’s slashes to commas to arrive at their LDAP distinguished name. e.g., My Notes name “cn=Ken Lin/ou=Westford/o=IBM” has this equivalent LDAP DN “cn=Ken Lin,ou=Westford,o=IBM”. To handle character escapement, see the table in the “Domino Directory FAQ” (google it).

As for query strings, if you want to search Person docs, use “(objectclass=person)”. If you want to search Group docs, use “(objectclass=groupOfNames)”. LDAP filter strings are defined by RFC 4515 (LDAP Search Filters) .

This example of how to configure Mozilla Thunderbird to use the Domino LDAP server may be useful …

http://www-10.lotus.com/ldd/nd6forum.nsf/DateAllWithExcerptweb/85aecdd1ebd4b10b8525720b004b7b87?OpenDocument

p.s. I’m not yet looking to integrate AD with Domino LDAP, little hesitant on this so I’d prefer to query Domino LDAP direct from IronPort rather then utilise the AD option.

If you use Directory Assistance to configure AD as a secondary LDAP directory, searches to the Domino LDAP server that result in “hits” to AD are returned to the LDAP client as LDAP referrals. Your LDAP app, in this case IronPort (I am not familiar with it), must be able to “chase” LDAP referrals. This situation is diagrammed in slide 19 in ID107: Getting Started With Active Directory Integration,

[hcl-bot]

Subject: RE: What is my Domino LDAP DN / info

Hi Ken,

Thanks for the information.

I’ve got it connecting anonymously no problems now.

I now have a problem where when I try and put in my credentials to athenticate against it fails in Softerra with an Error 49 invalid credentials.

I enter my email address: john.anderson@mydomainname.com for my UserDN and then I put my password in.

I also entered another accounts credentials to make sure 100% that I had a correct set of credentials but to no avail.

Please help!

Thanks

[hcl-bot]

Subject: RE: What is my Domino LDAP DN / info

now have a problem where when I try and put in my credentials to athenticate against it fails in Softerra with an Error 49 invalid credentials.

I enter my email address: john.anderson@mydomainname.com for my UserDN and then I put my password in.

I also entered another accounts credentials to make sure 100% that I had a correct set of credentials but to no avail.

email addresses are not LDAP distinguished names! Please re-read my earlier post and supply your LDAP distinguished name …

If so, you’ll need to supply “bind” (LDAP’s term for authenticate) credentials to the LDAP server using the LDAP form of a user who is allowed read access to your Domino directory(s). Simplistically, you convert your Notes distinguished name’s slashes to commas to arrive at their LDAP distinguished name. e.g., My Notes name “cn=Ken Lin/ou=Westford/o=IBM” has this equivalent LDAP DN “cn=Ken Lin,ou=Westford,o=IBM”. To handle character escapement, see the table in the “Domino Directory FAQ” (google it).

And of course, your password is your HTTPPassword.

Many applications that use LDAP for authentication will not require that you enter your lengthy LDAP DN. Instead it might allow you to use your common name, email address, telephone number, etc. The application will perform a search using your supplied identification to determine your LDAP distinguished name (known as name resolution), and then perform the bind using the returned LDAP DN if it is unique.

Since you have no such higher level software performing name resolution - you are communicating directly via LDAP, you must directly supply the LDAP DN for authentication, which is passed directly to the bind operation.

For the nuts and bolts of what actually happens, you can follow the example in “Collaborative Cuisine’s 1 Hour JNDI Cookbook” referenced in the FAQ above.