Richard Gibson wrote:
When attempting to bind using the following (as taken from the access log): BIND dn="ntUserDomainId=Richard Smith,ou=People,dc=fedora,dc=test,dc=com" method=128 version=3When you bind you are not binding with an attribute, you specify the whole dn of the entry to bind with (and there is only one DN per entry) - that is the protocol specification for simple bind. Usually a client will allow "login" by requesting a username or some such and then searching the directory for that value in one or more attributes that it is configured or coded for, retrieving the dn of the entry returned and then binding with that. So end users need never see a DN in the normal course of events (and in fact DNs are not /supposed/ to be seen by end users)....I get "No such object". This user does exist though. Is binding using the ntUserDomainId out of the question?
I notice from the following discussion that the same sort of thing is possible in Active Directory, although I have not tried it myself: http://groups.google.co.uk/group/microsoft.public.adsi.general/browse_thread/thread/b5fc22bfdd9079fe/f1caf3c9cf6c8188?lnk=st&q=ldap+bind+only+via+CN%3F&rnum=1&hl=en#f1caf3c9cf6c8188 <http://groups.google.co.uk/group/microsoft.public.adsi.general/browse_thread/thread/b5fc22bfdd9079fe/f1caf3c9cf6c8188?lnk=st&q=ldap+bind+only+via+CN%3F&rnum=1&hl=en#f1caf3c9cf6c8188>
Specifically, no, this mechanism is not supported. We support SASL, but not SPNEGO. We definitely do not support bind based on attribute value where the protocol documents say a DN should be.
-- Pete
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
