-----Messaggio originale----- Da: Jonathan Clarke [mailto:jonathan@phillipoux.net] Inviato: martedì, 3. aprile 2012 18:12 A: Induni, Marco Cc: openldap-technical@openldap.org Oggetto: Re: openldap proxy to AD
On 03/04/12 16:47, Induni, Marco wrote:
Hi all, I'm building an openldap proxy to an AD server and adding a little of "intelligence" based on the client request.
Unfortunately the client/program asking information about an account, need to be setup with user and password. There is a way to let the proxy "ignore" this user and password and instead just use the ones specified on the slapd.conf file ? Or setup fake credential somewhere ?
In detail, query are something like:
ldapsearch -x -h openldap-proxy -w "secret" -D "CN=MGRADREAD05,CN=MGR,DC=example,DC=com" -b "dc=pmm,dc=int" userPrincipalName=TST-USER10
but I need that the proxy exclude the "-w "secret" -D "CN=MGRADREAD05,CN=MGR,DC=example,DC=com" part, and use the one on the conf file. In fact if I do a query like:
ldapsearch -x -h openldap-proxy -w "secret" -D "CN=MGRADREAD05,CN=MGR,DC=example,DC=com" -b "dc=pmm,dc=int" userPrincipalName=TST-USER10 it works.
Here the slapd.conf
database meta suffix "dc=pmm,dc=int"
uri "ldap://10.10.10.1/dc=pmm,dc=int" suffixmassage "dc=pmm,dc=int" "dc=media,dc=int"
rewriteContext searchFilter rewriteRule "userPrincipalName=(.*)@rtsi.ch" "userPrincipalName=%1@rsi.ch" ":" rewriteRule "sAMAccountName=([:alnum:])" "userPrincipalName=%1@rtr.ch" ":"
idassert-bind bindmethod=simple
binddn="CN=svc-adread05,CN=AdminAccounts,OU=RSI,OU=Units,DC=media,DC=int " credentials="Comano2012" mode=self idassert-authzFrom "dn.regex:.*"
Any idea ?
You can configure the ldap and meta backends to use a different authentication for the outgoing connection to the proxied server by setting mode=none in the idassert-bind directive. For example:
idassert-bind bindmethod=simple binddn="cn=proxyuser,dc=ad,dc=com" credentials=secret mode=none
Will cause all connections to the proxied LDAP server to use those credentials. Is this what you're trying to achieve?
What I want to achieve is that when I do a query like this one to the proxy ldap server:
ldapsearch -x -h openldap -w "secret2" -D "CN=MGRADREAD05,DC=rtsi,DC=ch" -b "dc=pmm,dc=int" userPrincipalName=TST-USER10
the credential used (binddn and password) will be the ones I specify on the conf file, and not the one from the command line.
The problem is that I want to put the proxy in front of a couple of system, where I can't set any blank binddn and password (I get a failure with empty parameter).
I've tried with mode=none but, in that case:
ldapsearch -x -h openldap -w "secret2" -D "CN=MGRADREAD05,CN=MGR,rtsi,DC=ch" -b "dc=pmm,dc=int" userPrincipalName=TST-RSIUSER10 cn
I receive this error:
ldap_bind: Invalid credentials (49)
In case of empty binddn and password, it work's either with mode=none and mode=self
ldapsearch -x -h 146.159.112.124 -b "dc=pmm,dc=int" userPrincipalName=TST-RSIUSER10* cn
# extended LDIF # # LDAPv3 # base <dc=pmm,dc=int> with scope subtree # filter: userPrincipalName=TST-RSIUSER10* # requesting: cn #
# TST-RSIUSER10, Users, RSI, Units, pmm.int dn: cn=TST-RSIUSER10,ou=Users,ou=RSI,ou=Units,dc=pmm,dc=int cn: TST-RSIUSER10
# search reference ref: ldap://media.int/CN=Configuration,DC=media,DC=int
# search result search: 2 result: 0 Success
# numResponses: 3 # numEntries: 1 # numReferences: 1
Many thank's Marco
******************************************************
Visit: http://www.rsi.ch
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify postmaster@rsi.ch