Solved: CUPS 6 LDAP profile configuration Parameter

fabio.muller · ‎05-13-2009

Hi folks , We're installing a CUPS integrated with user LDAP (MS-AD) to be used by CUPC 7. In the config and maintenance guide at the LDAP profile configuration section in the Bind Distinguished Name (DN) field it's said: "[Optional] Specifies the administrator-level account information limited to 128 characters, and in the form useraccount@domain.com. This is the distinguished name with which you bind for authenticated bind".

And just after ,at the Anonymous bind check box : "Note: If you check Anonymous Bind, users can sign in anonymously to the LDAP server with read-only access. Anonymous access might be possible on your directory server, but it is not recommended. Instead, create a user with read-only privileges on the same container where the users to be searched are located. Specify the directory number and password in Cisco Unified Presence for Cisco Unified Personal Communicator to use".

Sorry but this is a little bit confusing. First, we are not going to use anonymous bind. So what type of account we will need ? An Admin-level account or a user with read-only privilges ? Where we should specify the read-only account ? How to correct configure this field so CUPC can be authenticated to search for the people at the LDAP directory ?

Tks...

htluo · ‎05-14-2009

A regular account means no special permission required. Use ADUC (Active Directory Users and Computers) create a user. Enter the firstname, lastname, password. Set password to never expire and cannot be changed by user.

That's it.

Hope this helps.

Michael

View solution in original post

htluo · ‎05-13-2009

1) Do not use "anonymous bind". Anonymous bind is disabled on most of the LDAP server by default.

2) Create a regular user.

3) If it's active directory, use the command below to find out the fully qualified DN (run the command on a domain controller):

dsquery user -samid cupcldap

Where 'cupcldap' is the account you created on step 2.

Michael

http://htluo.blogspot.com

fabio.muller · ‎05-14-2009

Many Thanks Michael , but regarding the regular user, what type of account do you generally create ? A read-only with admin rights ?

PS : Congrats for you book and the blog , we were aware of your book this week only and we'll be buying a copy. But, probably it will arrive by the end of June only and we could not wait till there to finish this implementation . If we had known about it earlier we wouldn't get these doubts now. Everybody here agreed that is a must for any professional working with Unified communications.

htluo · ‎05-14-2009

A regular account means no special permission required. Use ADUC (Active Directory Users and Computers) create a user. Enter the firstname, lastname, password. Set password to never expire and cannot be changed by user.

That's it.

Hope this helps.

Michael

fabio.muller · ‎05-14-2009

A lot Michael. Tks.