Beefy Boxes and Bandwidth Generously Provided by pair Networks
P is for Practical

Re: Authenticate Active Directory

by strat (Canon)
on Jul 20, 2006 at 08:42 UTC ( #562524=note: print w/replies, xml ) Need Help??

in reply to Authenticate Active Directory

What is your webserver and OS? Maybe you could use the webserver's authentication to log on, then create an ActiveDirectory group of users who are allowed to log on.

If not, I'd recommend ADSI over LDAP (only works with Windows servers). If the AD consists of only one domain, LDAP will work fine; but if there are several domains, with LDAP you'll need to know to use one server for each domain. But with ADSI, you can first search the Global Catalog for the samAccountName or userPrincipalName, and then use the user's ADsPath to bind to the AD and authenticate the user.

If you have to use Net::LDAP, it is safer to use Version2 for writing and searching because AD normally doesn't use utf8 but iso-latin-1 as encoding; and if you want to search or write non-ascii-chars like umlauts, you will get problems with Ldap-Version3)

Update: with ADSI and some AD configurations, there exists a security feature/problem that the explicit logon to the AD doesn't work and is silently converted to the user which runs the script on the webserver. I don't know the name of this option, but usually find it out by trying to log on as a different user and then manually check the event-security log of the AD-Domaincontroller once to see if I can do such a log on. But there must be a better solution to find out which user is currently logged on on the AD via ADSI

Best regards,
perl -e "s>>*F>e=>y)\*martinF)stronat)=>print,print v8."

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://562524]
[Discipulus]: Corion are you would able to realize such thing? O_O
[Corion]: In the same vein I have a script that automates Firefox to enter some data into another system. It's not faster than the people using the script if they were to do it manually, but they prefer not having to check the data and not having typos when ...
[Corion]: ... entering the data
[Corion]: Discipulus: I don't know whether I could really do that, but the init process itself mostly launches other processes, and the whole startup is just following a path of dependencies and making sure they are all running. Which basically is what ...
[Discipulus]: when at work my time is (temporarly) owned by the firm, so i do not care (coworkers whatch movies.. I code Perl)
[Corion]: ... make already does, except for files instead of programs. But maybe with some /proc hackery, that could be eliminated and one could use plain make :-D
[choroba]: systemd just makes is asynchronous
[choroba]: so, make -j
[Corion]: Discipulus: Yeah - but when writing Perl to save time (instead of having fun), it helps to look whether you're actually saving time ;) Why spend 5 minutes doing manually what you can spend three years automating? ;)
[Corion]: choroba: Oh, yeah :-D

How do I use this? | Other CB clients
Other Users?
Others lurking in the Monastery: (7)
As of 2017-07-27 09:32 GMT
Find Nodes?
    Voting Booth?
    I came, I saw, I ...

    Results (408 votes). Check out past polls.