Richard Gibson wrote: > When attempting to bind using the following (as taken from the access > log): > BIND dn="ntUserDomainId=Richard > Smith,ou=People,dc=fedora,dc=test,dc=com" method=128 version=3 > > ...I get "No such object". This user does exist though. Is binding > using the ntUserDomainId out of the question? > When you bind you are not binding with an attribute, you specify the whole dn of the entry to bind with (and there is only one DN per entry) - that is the protocol specification for simple bind. Usually a client will allow "login" by requesting a username or some such and then searching the directory for that value in one or more attributes that it is configured or coded for, retrieving the dn of the entry returned and then binding with that. So end users need never see a DN in the normal course of events (and in fact DNs are not /supposed/ to be seen by end users). > I notice from the following discussion that the same sort of thing is > possible in Active Directory, although I have not tried it myself: > http://groups.google.co.uk/group/microsoft.public.adsi.general/browse_thread/thread/b5fc22bfdd9079fe/f1caf3c9cf6c8188?lnk=st&q=ldap+bind+only+via+CN%3F&rnum=1&hl=en#f1caf3c9cf6c8188 > <http://groups.google.co.uk/group/microsoft.public.adsi.general/browse_thread/thread/b5fc22bfdd9079fe/f1caf3c9cf6c8188?lnk=st&q=ldap+bind+only+via+CN%3F&rnum=1&hl=en#f1caf3c9cf6c8188> Specifically, no, this mechanism is not supported. We support SASL, but not SPNEGO. We definitely do not support bind based on attribute value where the protocol documents say a DN should be. -- Pete -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3241 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20060112/20148c61/attachment.bin
