Differences

This shows you the differences between two versions of the page.

--- ldap_integration [2009/08/20 09:23] – 172.26.0.166
+++ ldap_integration [2009/10/21 07:00] – 172.26.0.166
@@ Line 4: / Line 4: @@
 ===== Notes =====
+==== Likewise-Open ====
+Open source standalone implementation of Samba, OpenLDAP, Kerberos, etc for Active Directory integration: http://www.likewise.com/
+  * open ports in Firewall (Active Directory, NTP, Kerberos)
+  * make sure time is in sync with the server!  NTP must be configured correctly before installing AD integration
+  * Likewise-Open has their own CIFS server but can also work with existing Samba installs I think
+==== Using ldapsearch on Linux ====
 Try to search from a Linux machine which can talk to the AD server (HPC is behind firewall):
+<code>ldapsearch -x -H ldap://172.26.0.218 -b "dc=ilri,dc=cgiarad,dc=org" -D "cn=bioinfohpc,cn=users,dc=ilri,dc=cgiarad,dc=org" -W "(sAMAccountName=bioinfohpc)"</code>
 <code>[aorth@shamba: ~]$ ldapsearch -x -H ldap://172.26.0.218:3268 -b "dc=ilri,dc=cgiard,dc=org" -D "cn=bioinfohpc,cn=users,dc=ilri,dc=cgiard,dc=org" -W ""
 Enter LDAP Password:
@@ Line 13: / Line 24: @@
 DEC: 1317 – ERROR_NO_SUCH_USER (The specified account does not exist.)
 NOTE: Returns when username is invalid.</file>
+==== binddn ====
 A note of possible interest regarding binding on Linux (from the [[http://lists.samba.org/archive/samba/2007-April/131385.html|samba mailing list]]):
-<file>AD domain controllers listen on the standard LDAPS port (636) and will
+<file>AD domain controllers listen on the standard LDAPS port (636) and will only accept binds on that port.
-only accept binds on that port.  You cannot bind as a user on port 389.  I
+You cannot bind as a user on port 389.  I don't think they support TLS on port 389, but I have no tried in a
-don't think they support TLS on port 389, but I have no tried in a long
+ long time.</file>
-time.</file>
+==== Domain controller vs. Global catalog ====
+As ILRI has many AD domains and our users could be coming from anywhere, we need to query a server running the global catalog service instead of a normal domain controller.  This note is of help:
+<file>All Windows 2000/2003 AD domain controllers (including Global Catalog Servers) listen for LDAP requests
+ on the standard LDAP port 389. However, domain controllers (including Global Catalog Servers) respond to LDAP
+ queries on port 389 with AD information from within its own AD domain only. Again, this works fine in a single
+ domain configuration but not in a multi-domain setup. Global Catalog Servers additionally listen for LDAP
+requests on port 3268, Microsoft's AD LDAP port. Global Catalog Servers respond to LDAP queries on port 3268
+ with AD information from the entire AD forest. In multi-domain AD environments, it is best to use port 3268.</file>
+ILRI Kenya has three Active Directory servers, and from what I can tell two of them run a global catalog:
+  * 172.26.0.218 <- running a global catalog (port 3268)
+  * 172.26.0.219
+  * 172.26.0.220 <- running a global catalog (port 3268)
 ===== pam_cgiar_ldap.c =====