LDAP-UX using AD container for CN

[Richard I Curtis]

I am trying to configure LDAP-UX to authenticate to our 2003r2 AD servers, but I have hit a stumbling block.

Our Active directory looks like:
Domain.Com
Built-In
Computers
...
DC-Users
Admins
3rdParty

So, our admins are all in the container named DC-Users, then a sub-container again called Admins. Our suppliers are in the container DC-Users, then the sub-container 3rdParty.

Is it possible to configure the LDAP-UX lookups to use a CN of DC-Users, and then allow users from all sub-containers to login? - in this case, anyone from 3rdParty and Admins should be able to login.

Unfortunately, moving all the users into the same container (without sub-containers) is not an option for security reasons.

[Court Campbell]

I don't have an answer, but I will say that my past (experimental) experiences I ran into issues with usernames that were more than 8 characters. If I remember correctly they couldn't logon and had some other issues. But that was awhile back. Good luck!

[Richard I Curtis]

Thankfully, all of the actual usernames are 8 characters or less...

As long as I can authorise all users from the sub-containers (sub-container names *may* have to contain space - I will have to look further into this), I should be OK.

Hopefully someone out there has a similar working setup so fingers crossed :)

[kevin_m]

Yes you can setup multiple containers for login access. Run /opt/ldapux/config and at some point you'll be prompted for the base DN where LDAP-UX clients should look for user and group information. Use "CN=dc-users,DC=domain,DC=com" but don't include any subcontainers. If you're using PAM then user access can be controlled by adding groups to /etc/opt/ldapux/pam_authz.policy. If you want to restrict login access to admins, for example, only add the line 'allow:ldap_group:CN=admins,CN=dc-users,DC=domain,DC=com' and exclude the other groups.

There's a lot more to the configuration but let me know if this helps.

Kevin

[Richard I Curtis]

Excellent -that looks exactly what I need. I am unable to test it at this time as I am having other problems getting LDAP-UX to extend the schema. Once thats resolved, I will post back on this thread to confirm that the above works.