AD Authentication

[bensode]

Following the example of LDAP+Authentication from the documentation site for Active Directory authentication leads to a failed login.

I am able to import and query correctly from the Import Contacts feature via LDAP but haven't been able to figure out where I'm faling to configure the system.

The AD is set up with users located in nested OUs. The primary OU has office location OUs nested below it, like:

Foo.com
-> OU Offices
---> OU Office 1
------> User
---> OU Office 2
------> User2
---> OU Office 3
------> User3

(That looks messy in preview but I can't seem to get blank spaces or tabs in this post)

Dotproject "System Configuration" options I've tried:

LDAP Host -- server.foo.com
LDAP Port -- 389 (default)
LDAP Version -- 2 (I've tried 3 also)
LDAP Base DN -- ou=Offices,dc=avatcorp,dc=com (I've also tried the cn=Users,dc=foo,dc=com with a few accounts in there)
LDAP User Filter -- (sAMAccountName=NaV)

User Authentication Method -- LDAP
Postnuke login also allows Standard Login -- Checked

LDAP Search User -- user@foo.com (tried valid user in the cn=Users and also from the same Base DN above)
LDAP Search User Password -- (password for user@foo.com)
LDAP also allows standard login -- Checked



I have 200 users in the AD that I'd rather not have to manually input people to use this system. Besides the manual labor, it defeats the single signon so keeping passwords matched to accounts would also be a nightmare. Is there something I'm doing wrong? I've spent about 6 hours on the wiki site and Google and Experts Exchange without any luck to get the AD authentication to work outside of the contact import.

Regards,

Bensode

[mandrake]

Hi Bensode,

I'm no LDAP expert, but I believe you need minor modifications to your parameters. First, if your Active Directory accounts are laid out as above (inside OU's), you'd probably want your base dn to be:

ou=Offices,dc=foo,dc=com

Your LDAP search user requires a full DN, and the user must be an admin in Active Directory (I believe that's right - I have no Active Directory system to reference, so I'm just going on what I remember of it here). So if you have an admin that you'd want to use for searches, set it up with the full dn - such as:

cn=adminuser1,ou=Office1,ou=Offices,dc=foo,dc=com

And finally, your search filter will probably need to look something like this:

(sAMAccountName=%USERNAME%)

Hopefully that'll get you a little closer to finding a solution for this.