04-07-2009 10:20 AM - edited 03-10-2019 04:25 PM
I am trying to finalize testing on using LDAP to authenticate as opposed to using the Cisco ACS agent.
I am obvioulsy not an LDAP guru so some of the attributes make no sense.
How does one determine what goes in these fields: Is it an actual name or a predefined field such as "cn" or "memberof"
User Directory Subtree
Group Directory Subtree
UserObjectType
UserObjectClass
GroupObjectType
GroupObjectClass
Group Attribute Name
my second issue is, we have certain personnel assigned to certain groups. If I am assigned to ACSauth and someone else is assigned to otherAuth group, do I need two different entries in the LDAP for this? How do I make sure that both have authentication privileges?
Thanks
Dwane
04-08-2009 06:58 AM
One good tool that will help you out with these attributes is "Softerra LDAP browser" which is a freeware, however if you are using AD as the server some are already well known, for instance you would need to go ahead and connect to your AD and run the following command:
"dsquery user -name 'username'" (no quotes)
That will give you the whole path in ldap syntax to where the user lies and you can use the whole chain up to the username as the user directory subtree, it should through something like"
"CN=Administrator,CN=Users,DC=LATAM,DC=SEC"
From this you can use
CN=Users,DC=LATAM,DC=SEC
the other option Group directory are where your groups are and should be similar to the above:
UserObjectType
Most of the times is "cn"
UserObjectClass
Most of the times is "person"
GroupObjectType
Most of the times is "cn"
GroupObjectClass
Most of the times is "group"
Group Attribute Name
"member"
Mhh.. I believe since ACS does not have the query type option you would need to define an ldap context for group.. (ldap query type one level or sub tree)
05-28-2009 06:54 AM
I have LDAP working via ACS using the OU function. So it is user Subtree OU=accounting,DC=win,DC=mydomain,DC=com. The issue is that I need for all authenticated users to be able to use LDAP. Is there a way to make a wildcard such as OU=* ?
Any ideas?
Dwane
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: