ILRI Research Computing

User Tools

Site Tools

You are here: start » ldap_integration
ldap_integration

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
Next revisionBoth sides next revision
ldap_integration [2009/08/18 11:49] – alanldap_integration [2009/08/20 09:19] – 172.26.0.166
Line 2: Line 2:
  
 ILRI uses an Active Directory server for user authentication, which is primarily used for Exchange e-mail services.  Active Directory is Microsoft's proprietary version of LDAP with a little extra special sauce.  Currently users have an Active Directory username and password for their Windows-centric single sign on and e-mail, and then they have a separate account for use with the HPC.  There exists functionality in Linux to look at Active Directory for user authentication. ILRI uses an Active Directory server for user authentication, which is primarily used for Exchange e-mail services.  Active Directory is Microsoft's proprietary version of LDAP with a little extra special sauce.  Currently users have an Active Directory username and password for their Windows-centric single sign on and e-mail, and then they have a separate account for use with the HPC.  There exists functionality in Linux to look at Active Directory for user authentication.
 +
 +==== Notes ====
 +Try to search from a Linux machine which can talk to the AD server (HPC is behind firewall):
 +<code>[aorth@shamba: ~]$ ldapsearch -x -H ldap://172.26.0.218:3268 -b "dc=ilri,dc=cgiard,dc=org" -D "cn=bioinfohpc,cn=users,dc=ilri,dc=cgiard,dc=org" -W ""
 +Enter LDAP Password: 
 +ldap_bind: Invalid credentials (49)
 +        additional info: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece</code>
 +According to the web this error means the user does not exist.  Either I've specified the user's distinguished name incorrectly, or the account is not configured with the proper permissions to bind:
 +<file>HEX: 0×525 – user not found
 +DEC: 1317 – ERROR_NO_SUCH_USER (The specified account does not exist.)
 +NOTE: Returns when username is invalid.</file>
 +Note from [[http://lists.samba.org/archive/samba/2007-April/131385.html|samba mailing list]]:
 +<file>AD domain controllers listen on the standard LDAPS port (636) and will 
 +only accept binds on that port.  You cannot bind as a user on port 389.  I 
 +don't think they support TLS on port 389, but I have no tried in a long 
 +time.</file>
  
 ==== pam_cgiar_ldap.c ==== ==== pam_cgiar_ldap.c ====
ldap_integration.txt · Last modified: 2012/02/06 08:43 by aorth