Isilon NAS and eDirectory

Question

Hello,
I'm trying to get an Isilon NAS to authenticate via LDAP to eDirectory. It binding correctly with a user name and password and can look up users but won't allow those users to authenticate over CIFS. I think it might not be able to find the correct password attribute. All users have a Universal password policy assigned and the user that the Isilon binds as has rights to look up user passwords in that policy.
Any ideas? Or has someone done something like this before?
Thanks
James

Answer 1

> I'm trying to get an Isilon NAS to authenticate via LDAP to eDirectory.
> It binding correctly with a user name and password and can look up users
An eDirectory username and password? How does this happen if not via CIFS?
> but won't allow those users to authenticate over CIFS. I think it might
Right... so this sentence and the previous sentence seem to be at odds.
Could you help me understand what is different about "binding correctly
with a username and password" and "won't allow those user to authenticate
over CIFS"?
> not be able to find the correct password attribute. All users have a
LDAP binds all work one of two ways unless they are really poorly-written:
1. Direct LDAP bind; there is no looking-up the password.
2. LDAP Compare: Sends an LDAP Compare request with the current password
by passing in an attribute for comparison ('userPassword') and the
password value itself (whatever that is) and then the LDAP server
(eDirectory) returns true or false. There isn't much flexibility here,
really...
> Universal password policy assigned and the user that the Isilon binds as
> has rights to look up user passwords in that policy.
This is, if implemented, the scenario I was referring to when I said some
were "really poorly-written." Actually retrieving the password and
comparing elsewhere is not the way this should ever be implemented;
there's no reason to implement it this way (see other options above) and
it's pretty unlikely that retrieving the password is not how the
application works since it wouldn't work with many LDAP vendors. In the
case of eDirectory it could work with UP, but only if the application uses
a special NMAS control to retrieve the password via LDAP, and that is also
pretty unlikely.
> Any ideas? Or has someone done something like this before?
Find out more about the differences in what works and what doesn't. Also,
you may want to do some tracing of LDAP using ndstrace. Enable all of the
tracing/screen options in iManager or ConsoleOne and then run ndstrace and
post the output that you see here, both of a successful and failed LDAP
test (pointing out which was which from the trace):
ndstrace
set dstrace=nodebug
dstrace +time +tags +ldap
dstrace file on
set dstrace=*r
#perform test here
dstrace file off
quit
The ndstrace.log file will have the output from your tests.
Good luck.