Re: OpenLDAP proxy to Active Directory

[Jonathan van der Wat <jonathan.vanderwatt@inet.co.za>]

   Michael,

Thanks for your response. When starting the OpenLDAP server I can see 
the following in the log file:

May 28 06:35:30 localhost slapd-ldap[2804]: @(#) $OpenLDAP: slapd 2.4.23 
(Dec 7 2011 21:35:18) 
$#012#011mockbuild@c6b18n3.bsys.dev.centos.org:/builddir/build/BUILD/openldap-2.4.23/openldap-2.4.23/build-servers/servers/slapd
May 28 06:35:30 localhost slapd-ldap[2804]: /etc/openldap/slapd.conf: 
line 150: warning, destination attributeType 'sAMAccountName' is not 
defined in schema
May 28 06:35:30 localhost slapd-ldap[2804]: PROXIED attributeDescription 
"SAMACCOUNTNAME" inserted.
May 28 06:35:30 localhost slapd-ldap[2804]: /etc/openldap/slapd.conf: 
line 159: warning, destination attributeType 'UnixHomeDirectory' is not 
defined in schema
May 28 06:35:30 localhost slapd-ldap[2804]: PROXIED attributeDescription 
"UNIXHOMEDIRECTORY" inserted.
May 28 06:35:30 localhost slapd-ldap[2804]: /etc/openldap/slapd.conf: 
line 162: warning, destination objectClass 'user' is not defined in schema
May 28 06:35:30 localhost slapd-ldap[2805]: slapd starting

Should I add that info into the schema? If so, how do I go about doing this?

Greetings,

Jonathan

On 05/28/2012 10:31 AM, � wrote:
> Jonathan van der Wat wrote:
>> I'm new to OpenLDAP and am trying to implement the following:
>>
>> User authentication (PAM + SSSD) on CentOS Linux servers via OpenLDAP proxy to
>> Active Directory. I am able to perform the following search from the OpenLDAP
>> proxy without any apparent issues:
>> *
>> [root@openldap ~]# ldapsearch -x -h /mydomaincontroller/ -LLL -b
>> dc=msad,dc=inet,dc=com -D cn=ldap,cn=users,dc=msad,dc=inet,dc=com -W
>> '(sAMAccountName=jonathanv)' cn sAMAccountName
>>
>> Enter LDAP Password:
>> dn: CN=jonathan,CN=Users,DC=msad,DC=inet,DC=com
>> cn: jonathan
>> sAMAccountName: jonathanv
>>
>> # refldap://ForestDnsZones.msad.inet.com/DC=ForestDnsZones,DC=msad,DC=inet,DC=com
>>
>> # refldap://DomainDnsZones.msad.inet.com/DC=DomainDnsZones,DC=msad,DC=inet,DC=com
>>
>> # refldap://msad.inet.com/CN=Configuration,DC=msad,DC=inet,DC=com*
>>
>> However, when asking the OpenLDAP proxy:
>>
>> *[root@openldap ~]# ldapsearch -x -h /localhost/ -LLL -b
>> dc=msad,dc=inet,dc=com -D cn=ldap,cn=users,dc=msad,dc=inet,dc=com -W
>> '(sAMAccountName=jonathanv)' cn sAMAccountName
>>
>> Enter LDAP Password:
>> # refldap://ForestDnsZones.msad.inet.com/DC=ForestDnsZones,DC=msad,DC=inet,DC=com
>>
>> # refldap://DomainDnsZones.msad.inet.com/DC=DomainDnsZones,DC=msad,DC=inet,DC=com
>>
>> # refldap://msad.inet.com/CN=Configuration,DC=msad,DC=inet,DC=com*
> Have a look in the proxy log. I guess you did not add the attribute type
> description for sAMAccountName to the proxy's schema.
>
> Ciao, Michael.
>

Disclaimer

The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.

This email has been scanned for viruses and malware, and automatically archived by Mimecast SA (Pty) Ltd, an innovator in Software as a Service (SaaS) for business. Mimecast Unified Email Management â (UEM) offers email continuity, security, archiving and compliance with all current legislation. To find out more, contact Mimecast. itevomcid