9:57 a.m.
Hello,
Thanks for your response on this.
you can bind as AD user with the DN of the AD user object from the
compat tree
To confirm, are you suggesting that I simply create the service account inside of Active
Directory, but still have Mediawiki talk to the IdM server?
Mediawiki takes a json file.
The following works perfectly fine when I use an IdM service account. In the below config,
`idm.example.com` is a specific node in the IdM cluster.
{
"LDAP": {
"connection": {
"server": "idm.example.com",
"user":
"uid=admin,cn=users,cn=compat,dc=example,dc=com",
"pass": "REDACTED",
"port":"389",
"enctype":"clear",
"basedn": "dc=example,dc=com",
"groupbasedn": "dc=example,dc=com",
"userbasedn": "dc=example,dc=com",
"searchattribute": "uid",
"searchstring":
"uid=USER-NAME,cn=users,cn=compat,dc=example,dc=com",
"usernameattribute": "uid",
"realnameattribute": "cn",
"emailattribute": "mail"
}
}
}
When I update this config to talk to AD, I use the same server address, but I change the
values as appropriate to match AD's requirements for searchattribute, searchstring,
usernameattribute, etc....
I'm still unable to get this to work, but I'm also still troubleshooting, and not
giving up.
As I continue to troubleshoot, I wanted to respond to this and make sure I'm clear on
what you're suggesting.
Thanks again,
David
From: Sumit Bose via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
Reply-To: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>
Date: Monday, January 6, 2020 at 12:10 PM
To: "freeipa-users(a)lists.fedorahosted.org"
<freeipa-users(a)lists.fedorahosted.org>
Cc: Sumit Bose <sbose(a)redhat.com>
Subject: [Freeipa-users] Re: Proxy LDAP queries to Active Directory
On Mon, Jan 06, 2020 at 05:01:05PM +0000, White, David via FreeIPA-users wrote: > Is
there a way to proxy client LDAP requests to the upstream Active Directory that FreeIPA is
configured to trust? > > I have AD, where users live. > I have FreeIPA / RedHat
IdM.
&
On Mon, Jan 06, 2020 at 05:01:05PM +0000, White, David via FreeIPA-users wrote:
Is there a way to proxy client LDAP requests to the upstream Active
Directory that FreeIPA is configured to trust?
I have AD, where users live.
I have FreeIPA / RedHat IdM.
And I have servers that are registered to FreeIPA.
But I also have applications (such as Mediawiki, or Red Hat Satellite to name a few) that
support LDAP authentication.
I want to be able to use my AD credentials to login to Mediawiki or Satellite, but have
the application bind to FreeIPA, instead of binding it to AD.
Is this possible?
Hi,
you can bind as AD user with the DN of the AD user object from the
compat tree, see e.g.
https://www.freeipa.org/page/V3/Serving_legacy_clients_for_trusts for
details.
HTH
bye,
Sumit
I currently:
Have successfully bound Mediawiki to FreeIPA, and I can login to Mediawiki using an
account that is built locally instead of FreeIPA, but I cannot login to Mediawiki using my
AD credentials.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...