Ldap auth specification about password

Hi
I try to search for the differences between iPlanet4.1 and Sun One 5.x about the specification of password when trying to authenticate each user. because this password is integrated into the web server. if there is any outstanding differences for each version. could you tell me abou that ?
regards

hi, thank you for your comment
if there is the customer which use iPlanet4.1 and try to think about version up to Sun One 5.1 directory server. is there any not configuration change for ladp client ? the client use http-authentication ...??
Is there any differences in between iPlanet4.1 and Sun One5.1 about the user authentication mehanism ?
I would like to know about this point
regards
shigeru

Similar Messages

LDAP auth & limit logins per host

I'm using LDAP auth. using ldapclient init to setup the ldap auth. Have a SunOne LDAP server.
I'm interested in doing auth filters - like what Linux does with PAM. I've got PAM_LDAP to work, but since Sun does not use the OpenLDAP convention of /etc/ldap.conf - I can't setup the nss_user filters in there or nss_base_passwd dc=....
does anyone know how to do this in Solaris? Can I enter something into the ldap_cred file? I tried to do a serviceSearchDescriptor and put passwd:dc=x,dc=y?one?(|(uid=x)(uid=y)) in the ldapCredFile but that gave me a search filter error
I really do not want to use NetGroups.
Thanks in advance. I have seem a few posts for this questions but no real answers.
I can't believe that there is no way to do this...

I actually was able to solve my problem. What I did was the following
in my profile setup in the LDAP server I set
servieSearchDescriptor: passwd:dc=x,dc=y,dc=x?sub?|(attribute1=value)(attribute2=value)
This makes the password lookup look for the user only if a subsearch (sub) matches the attributes above.
For example - I could limit logins to only the people who have a shell=/bin/bash by saying ...sub?|(loginShell=/bin/bash)(loginShell=/usr/bin/bash)
I would also want to make a similar serviceSearchDescriptor line for shadow. So I would have two of these in my Profile on the LDAP server , one with passwd: and one with shadow:

Notification about password expiry on VPN Client

Hello everyone.
Our VPN users are connected to VPN with VPN Client. We're using VPN3000 to terminate VPN and ACS 5.1 to authenticate users from its internal identity store. VPN3000 gets info from ACS via RADIUS.
Now I want users to be notified about password expiration at their VPN client and be able to change their password.
I've configured:
- "RADIUS with expiry" at VPN3000
- "Disable user account after X days if password was not changed" and "Display reminder after Y days" at ACS
Now user is blocked when his password is expired after X days and he can't connect. But the reminder is not displayed after Y days and users have not chance to change his own password.
If I check "Change password on next login" user can change his password in VPN Client.
Should this feature (password expiry notification) work with ACS5.1 internal identity store and RADIUS?
I found in ACS5.1 release notes the following:
- Internal identity store enhancements include support for Password expiry
but:
- Expiry of any user (admin or internal) after certain number of days is not supported.
I'm confused with these two phrases.
And one more question. What RADIUS attributes say about password expiration and password notification to check them with radlogin?
Thanks in advance for any help.
Pavel

For what it's worth, I've followed that procedure to successfully reset the administrator password on a VPN 3000 concentrator without any loss of the active configuration.

LDAP Auth Error ccmuser web access

Hi,
I have a CUCM v9.1 with an issue for access to the ccmuser web page using the AD Credentials, I've configured the LDAP Auth in the CUCM with no error messages and also the web access for my users like this:
When I access the site http://cucm_ip_add/ccmuser first I get this message:
After that I try to log into to the web page but I get this error:
I have no issues importing the users, the problem is with the authentication.
I've checked the ldap port and I'm not using global catalog so the correct one is 389 (tried 3268 and I got an error message from the cucm ldap authentication config page).
Any ideas guys??
Thanks in advance.

One commone one is that CUCM treats the username field as case sensitive. Does it have any upper case characters? You can see this within /ccmadmin under End User Configuration.
If that's not it, either a Wireshark of the LDAP bind or a stare/compare between your sync agreement and the auth config to see why one can get the user object but the other cannot bind as that person.
Please remember to rate helpful responses and identify helpful or correct answers.

LDAP Auth Rewrite Rule in Mapping file

Hi,
We are trying to set LDAP Auth Rewrite rule in mapping file to get users First Name & Last Name or Display name & Mail Address from LDAP Server instead of users individual client settings.
In Messaging 5.2 we had the follwoing setting, but it does not work any more for Messaging 6.2:
LDAP Auth Rewrite Entry in mapping file:
AUTH_REWRITE
*|*|*|*@* $]ldap:///dir1.domain.com:389/o=domain.com?cn?sub?(uid=$3)[$ <$]ldap:///dir1.domain.com:389/o=domain.com?mail?sub?(uid=$3)[>$Z
We are running:
Sun Java(tm) System Messaging Server 6.2-3.04 (built Jul 15 2005)
libimta.so 6.2-3.04 (built 01:43:03, Jul 15 2005)
SunOS mta 5.10 Generic_118833-03 sun4u sparc SUNW,Sun-Fire-V240
ll appreciate for any help or clue
Thanks

Thanks Jay,
Well, here is what we want to achieve.
We are looking for re-writing the FROM address of Sender against the LDAP Entry as cn <[email protected]>. This should solve problem of where users have entered wrong FROM information on their clients or trying to spoof FROM address to other users.
Currently, The system delivers e-mail with FROM headers as per client entry instead of re-writing it against AUTHENTICATED userid.
Following is the IMTA.CNF and MAPPINGS lines:
IMTA.CNF
! ims-ms
ims-ms defragment subdirs 20 notices 1 3 backoff "pt5m" "pt10m" "pt30m" "pt1h" "pt2h" "pt4h" maxjobs 2 pool IMS_POOL fileinto
$U+$S@$D
! tcp_local
tcp_local smtp mx single_sys remotehost inner switchchannel identnonenumeric subdirs 20 maxjobs 7 pool SMTP_POOL maytlsserver
maysaslserver saslswitchchannel tcp_auth missingrecipientpolicy 0 mailfromdnsverify dropblank vrfyhide
! tcp_intranet
tcp_intranet smtp mx single_sys subdirs 20 dequeue_removeroute maxjobs 7 pool SMTP_POOL maytlsserver allowswitchchannel sasls
witchchannel tcp_auth missingrecipientpolicy 4 mailfromdnsverify dropblank vrfyhide
! tcp_extranet
tcp_extranet smtp mx single_sys subdirs 20 noreverse maxjobs 7 pool SMTP_POOL mustsaslserver allowswitchchannel saslswitchcha
nnel tcp_auth vrfyhide dropblank mailfromdnsverify dropblank missingrecipientpolicy 4
! tcp_submit
tcp_submit submit smtp mx single_sys mustsaslserver maytlsserver missingrecipientpolicy 4
! tcp_auth
tcp_auth smtp mx single_sys mustsaslserver missingrecipientpolicy 4 authrewrite 3
MAPPINGS file
AUTH_REWRITE
*|*|*|*@* $]ldap:///dir.domain.edu:389/o=domain.edu,dc=domain,dc=edu?cn?sub?(uid=$3)[$ <$]ldap:///dir.domain.edu:389
/o=domain.edu,dc=domain,dc=edu?mail?sub?(uid=$3)[>$Z
Thanks for your help

Specification about the package oracle.cle.process or oracle.clex

Where can i find specification about the package oracle.cle.process or oracle.clex?, particularly the class oracle.cle.process.ProcessInfo. I have not could find this specification anywhere, please help me to find it!
i wait for your help

This class is part of the MVC Framework. The homepage of this framework on OTN is http://otn.oracle.com/products/ias/9ias_utilities.html#mvc. You can download the user guide and javadoc there. The source code is not publicly available.
Steven Davelaar,
JHeadstart Team.

How to use DS 5.2 to create LDAP user ID and password to Login to Sun ONE I

Hi all,
I have just install Sun One Web server 6.1, Sun One Directory 5.2 and Sun One Instant Messaging 6.1 together on Win2K advance server. And I have successful launch Sun� ONE Instant Messenger.
But I can not know, how to create LDAP user ID and password to Login to Sun ONE Instant Messenger???
Could anyone help me to solve this problem?
I'm looking forward to receive your reply soon.
Thanks

Hi Tuo,
I think you better ask this in the forum where the ACS experts are, since this does not seem to be a problem on the ASA side.
hth
Herbert

Continuing asked about password for old Apple id on iphone5

I have changed Apple id, but I still been asked about password for the old one on my iPhone 5. How do i solve this probleme?

Are you saying you don't know the password for your old Apple ID?
To update any apps, on your phone, obtained with your old ID, you will have to: Settings>Store...tap the ID shown...sign out...then sign back in with your old ID...update the apps, then sign out again & sign back in with your new ID. Is this what you're doing?
There are only two ways to fix this: 1. Delete any content obtained with your old ID, then re-purchase with your new ID, or 2:
Go here:
https://expresslane.apple.com/Issues.action
Ask for assistance, and ask that the content obtained with your old ID be transfered to your new ID. If iTunes support agrees to do this, they will add the content to your download queue.

HT201320 I am having trouble with password. Forgetting password,as I have many mail IDs like yahoo,gmail,hotmail,apple, I cloud etc.,thus confusing about password and restating through procedures. The altered password is not accepted I Safari

I am having trouble with password. Forgetting password,as I have many mail IDs like yahoo,gmail,hotmail,apple, I cloud etc.,thus confusing about password and restating through procedures. The altered password is not accepted I Safari. When I want to open my mail but window appears as incorrect password though the mail appears on the left. however whe I go to my mail separately opening my mail, without mail icon in my pad.

I'm having the same problem, what did you do?

Native LDAP Auth in PT 5.0.3

I am attempting to use Native LDAP Authentication with version 5.0.3. In 5.0.2 it worked just fine, but with 5.03., log in fails. The LDAP settings are correct as confirmed by the provider validation. What do these errors mean and how do I fix them? Thanks.
Validate ProviderSuccessfully connected to the Authentication Source.
Here are the errors from PTSpy:
Error Auth Source Providers LDAPProviderAuth.cpp(285) *** ERROR *** CLDAPAuthSourceProvider::LDAPGetHandle: ldap_bind_s failed with error 0x31.
Warn Auth Source Providers LDAPProviderAuth.cpp(1030) LDAP error 0x31 (#49) description: Invalid credentials
Warn Plumtree.dll PTSession.cpp(378) *** COM exception caught *** Error info: IDispatch error #16898 (0x80044402): [Invalid password.] (378,PTSession.cpp)
Warn Portal UI - Infrastructure com.plumtree.uiinfrastructure.login.LoginHelper.InternalAttemptLogin() Unable to log in user Intranet/bottt: The user name, password, or authentication source entered is not recognized. Re-enter your login information below. Passwords are case sensitive._com.plumtree.openfoundation.util.XPException_ at com.plumtree.server.CIPTSession.Connect(String UserNameOrID, String Password, Object SecurityProviderInfo) at com.plumtree.portaluiinfrastructure.login.PTLoginHelper.internalLogin(String sUserName, String sPassword, String sLoginToken, Object token, Boolean bUseNumericConnect, Boolean bGuestLogin, ISessionManager subSession, IApplication application, String sRequestURL) at System.Environment.GetStackTrace(Exception e) at System.Environment.GetStackTrace(Exception e) at System.Environment.get_StackTrace() at com.plumtree.openfoundation.util.XPException.GetInstance(Exception e) at com.plumtree.portaluiinfrastructure.login.PTLoginHelper.internalLogin(String sUserName, String sPassword, String sLoginToken, Object token, Boolean bUseNumericConnect, Boolean bGuestLogin, ISessionManager subSession, IApplication application, String sRequestURL) at com.plumtree.portaluiinfrastructure.login.PTLoginHelper.AttemptLogin(String sUserName, String sPassword, Object token, Boolean bUseNumericConnect, ISessionManager subSession, IApplication application, String sRequestURL) at com.plumtree.uiinfrastructure.login.LoginHelper.InternalAttemptLogin(String strUserName, String strPassword, Object token, Boolean bUseNumericConnect, Boolean bGuestLogin, ISessionManager subSession, IApplication application, String strRequestURL, IXPRequest request, IWebData webData) at com.plumtree.uiinfrastructure.login.LoginHelper.AttemptLogin(String strUserName, String strPassword, Object token, Boolean bUseNumericConnect, ISessionManager subSession, IApplication application, String strRequestURL, IXPRequest request, IWebData webData) at com.plumtree.uiinfrastructure.login.LoginHelper.AttemptLogin(String strUserName, String strPassword, Object token, Boolean bUseNumericConnect, AActivitySpace asOwner, IXPRequest request, IWebData webData) at com.plumtree.portalpages.browsing.login.LoginModel.attemptLogin(IXPRequest request, IWebData webData) at com.plumtree.portalpages.browsing.login.LoginControl.CheckActionSecurityAndExecute(XPHashtable arguments) at com.plumtree.uiinfrastructure.activityspace.Interpreter.HandleRequest(IXPRequest request, IXPResponse response, ISessionManager session, IApplication application) at com.plumtree.uiinfrastructure.activityspace.Interpreter.DoService(IXPRequest request, IXPResponse response, ISessionManager session, IApplication application) at com.plumtree.uiinfrastructure.web.XPPage.Service(HttpRequest httpRequest, HttpResponse httpResponse, HttpSessionState httpSession, HttpApplicationState httpApplication) at com.plumtree.portaluiinfrastructure.activityspace.PlumHandler.ProcessRequest(HttpContext context) at System.Web.CallHandlerExecutionStep.System.Web.HttpApplication+IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) at System.Web.HttpApplication.ResumeSteps(Exception error) at System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(HttpContext context, AsyncCallback cb, Object extraData) at System.Web.HttpRuntime.ProcessRequestInternal(HttpWorkerRequest wr) at System.Web.HttpRuntime.ProcessRequest(HttpWorkerRequest wr) at System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr ecb, Int32 iWRType)

Hey Jennifer,To clarify - there are two different security modes settings being discussed:
Portal Security Mode - set in x_config.xml in your portal home directory, looks like this:<Security> <SecurityMode value="0"/></Security>This setting allows you to put your portal into HTTP, HTTPS, or SSL Accelerator modes.LDAP Authentication Source security mode - set in the LDAP Authentication Source Editor in the administrative hierarchy. This setting defines how the portal talks to your remote LDAP Server. If it is set to mode 1, we use the LDAP protocol. If set to 2, we use the LDAPS protocol, which uses TLS/SSL to encrypt communication between your LDAP Server and portal. This is a security measure that some customedrs require, while most don't use.The later setting is no longer supported in 5.0.2 and on, we suggest that users that need SSL between their portal and LDAP server use the new LDAP AWS product that was released around the time of 5.0.3. The LDAP AWS uses Java and JNDI technology to interact with remote LDAP servers, where as our native LDAP Authentication Source uses a Netscape library for communication with the remote LDAP server. This netscape library has been found to be unstable and detrimental to Portal performance, hence it was de-supported when the LDAP AWS became available.
Based on your message, I'm guessing you thought I meant the Netscape browser could not use portalsecurity mode 2. There is no such bug, all portal security modes are supported as far as I know. Your project should work just fine, drop us a line if you have any problems.
-Akash

Solaris 2.6 or 7 using LDAP Auth

I know Solaris 8 support LDAP for Auth. However, there is some 3rd party applications which support in running on Solaris 2.6 only. The existing name service is NIS. Is there any solution for Solaris 2.6 using LDAP (Netscape Directory Server 4.1x) Auth??

Jolene,
The drivers are available free of charge at Openlink Software's
web site - http://www.openlinksw.com. You should download the
Multi-Tier components where JDK1.2 is your client platform and
Oracle 7 is your database engine. This will involve an install
on the client machine as well as the server, but will provide
for maximum flexibility and performance down the road. You will
simply need to point CLASSPATH on your client to the newly
downloaded "opljdbc2.jar" file - the Openlink driver class
archive.
Best regards,
Stephen
Jolene (guest) wrote:
: Hi,
: Can anybody please tell me which driver I can use to connect to
: an Oracle database(7.1) from a Java application running on
: Solaris 2.6 using the 1.2 version of the JDK? Where can I get
it
: from and do I have to put it in a specific place?
: Thanks in advance,
: Jolene
null

NDS 4.16 Auth Solaris 8, password aging support or not?

I have set up a Netscape Directory Server from version 4.13 to 4.16 for auth Solaris 8. I find the password policy do not affect to the Solaris users. Also, the group of the LDAP show in the number.
-rw-r--r-- 1 test2 11 0 Nov 21 16:26 test2
The number 11 should be the group name refer to LDAP but the user test2 is a LDAP's user and group policy is working.
Please help!!
Lucas

The Solaris 8 authentication through LDAP does not support the Password Policy yet.
Ludovic.

Ldap Auth 5.1 with solaris 8

Hi
When I used ldap_gen_profile to create a profile in Ldap for client machine , I have an error invalid Pararamter (proxyDN) specified , the syntax is :
ldap_gen_profile -v -P default -b "dc=domain,dc=com" -d "domain.com" -a simple -D "cn=proxyagent,ou=profile,dc=domain,dc=com" -w password localhost.
Any idea.

Hmm, I have the feeling that you are in the wrong forum... This forum is about the Sun One Portal Server 6.0.
Michel.

Amadmin; changing ldap auth service; unable to set or clear/set bind passwd

I am trying to clear the attribute iplanet-am-auth-ldap-bind-passwd. In the AttributeValuePair, the Value element just contains a single space. This works to clear iplanet-am-auth-ldap-bind-dn, but has no effect on the passwd.
I have also tried setting the password to "hello" and that didn't have any effect either.
Here's my xml file (with name of organization replaced with "myorg"):
<Requests>
<OrganizationRequests DN="o=myorg.org,o=isp">
<ModifyServiceTemplate serviceName="iPlanetAMAuthLDAPService"
schemaType="Dynamic">
<AttributeValuePair>
<Attribute name="iplanet-am-auth-ldap-server"/>
<Value>ldap.myorg.org:389</Value>
</AttributeValuePair>
<AttributeValuePair>
<Attribute name="iplanet-am-auth-ldap-base-dn"/>
<Value>o=myorg.org</Value>
</AttributeValuePair>
<AttributeValuePair>
<Attribute name="iplanet-am-auth-ldap-bind-dn"/>
<Value> </Value>
</AttributeValuePair>
<AttributeValuePair>
<Attribute name="iplanet-am-auth-ldap-bind-passwd"/>
<Value> </Value>
</AttributeValuePair>
<AttributeValuePair>
<Attribute name="iplanet-am-auth-ldap-return-user-dn"/>
<Value>false</Value>
</AttributeValuePair>
</ModifyServiceTemplate>
</OrganizationRequests>
</Requests>

Sirrah wrote:How do I manually mount a drive that automounts?
As root:
ntfs-3g /dev/sdX /mnt/mountpoint
or
mount -t ntfs-3g /dev/sdX /mnt/mountpoint
http://wiki.archlinux.org/index.php/NTFS_Write_Support
You can also pass other options to mount: (in this example drive is ext3)
mount -t ext3 -o user,rw,async /dev/sdX /mnt/mountpoint
check man mount for all the details.

CE565/CE7325 with MS LDAP Auth - Problem

Once again seems I am the first one to use a new product. I have a CE565 that I am trying to get to work with MS LDAP. Anyone had any luck doing this? Cisco TAC is having difficult time tracing down problem.
ce565#sho ldap
LDAP Configuration:
LDAP Authentication is enabled
Allow mode: disabled
Base DN: DC=domain,DC=com
Filter: <none>
Retransmits: 2
Timeout: 5 seconds
UID Attribute: uid
Group Attribute: memberOf
Administrative DN: <none>
Administrative Password: <none>
LDAP version: 3
LDAP port: 389
Server Status
192.168.99.7 primary
<none> secondary
ce565#debug authe http
Apr 24 22:44:56 ce565 http_authmod: pam_sm_authenticate:2498 ***pam_ldap: Begin
Apr 24 22:44:56 ce565 http_authmod: pam_sm_authenticate:2502 *** pam_ldap: Got username ralldread
Apr 24 22:44:56 ce565 http_authmod: _pam_ldap_get_session:1977 *** pam_ldap: Begin
Apr 24 22:44:56 ce565 http_authmod: _read_config:570 ***pam_ldap: Reading configuration
Apr 24 22:44:56 ce565 http_authmod: ldap_server_validate:1928 ***pam_ldap: === Host[0] 192.168.99.7 ===
Apr 24 22:44:56 ce565 http_authmod: ldap_server_isalive:1851 ***pam_ldap: Connecting...
Apr 24 22:44:56 ce565 http_authmod: ldap_server_isalive:1867 ***pam_ldap: Socket timeout 5
Apr 24 22:44:56 ce565 http_authmod: ldap_server_isalive:1891 ***pam_ldap: Connected to 192.168.99.7
Apr 24 22:44:56 ce565 http_authmod: ldap_server_validate:1948 ***pam_ldap: ServerAlive [1] (up=1, down=0)
Apr 24 22:44:56 ce565 http_authmod: pam_sm_authenticate:2508 *** pam_ldap: Got session
Apr 24 22:44:56 ce565 http_authmod: pam_sm_authenticate:2519 *** pam_ldap: Do authentication
Apr 24 22:44:56 ce565 http_authmod: _get_user_info:1672 *** pam_ldap: Begin user ralldread
Apr 24 22:44:56 ce565 http_authmod: _connect_anonymously:1059 *** pam_ldap: Host 192.168.99.7
Apr 24 22:44:56 ce565 http_authmod: _connect_anonymously:1063 *** pam_ldap: Open session
Apr 24 22:44:56 ce565 http_authmod: _open_session:927 *** pam_ldap: Begin
Apr 24 22:44:56 ce565 http_authmod: _connect_anonymously:1074 *** pam_ldap: Binding...
Apr 24 22:44:56 ce565 http_authmod: _get_user_info:1676 *** pam_ldap: Connected anonymously
Apr 24 22:44:56 ce565 http_authmod: _get_user_info:1699 *** pam_ldap: Filter (uid=ralldread)
Apr 24 22:44:56 ce565 http_authmod: pam_sm_authenticate:2522 *** pam_ldap: Done authentication FAILURE
Any thoughts?

I got it working. I did 2 things. One, I rebuilt the the server to make sure Active Directory was working correctly. Two, I changed the DC=domain to be dc=domain. I havent had a chance to test which one actually fixed it, but here it the config that I am using.
ce565#sho run
device mode content-engine
hostname ce565
http authentication header 407
http authentication cache timeout 1
http authentication cache max-entries 32000
http proxy incoming 8888
clock timezone EST -5 0
ip domain-name demodomain
https proxy incoming 8888
interface GigabitEthernet 1/0
ip address 10.10.220.71 255.255.255.0
exit
interface GigabitEthernet 2/0
shutdown
exit
ip default-gateway 10.10.220.1
primary-interface GigabitEthernet 1/0
no auto-register enable
ip name-server 10.10.220.80
pre-load enable
pre-load depth-level-default 2
pre-load resume
pre-load traverse-other-domains
pre-load url-list-file ftp://ftpuser:[email protected]/ce-preload.txt
transaction-logs enable
transaction-logs log-windows-domain
transaction-logs archive interval every-hour every 10
transaction-logs sanitize
transaction-logs export enable
transaction-logs export interval every-hour every 10
transaction-logs export ftp-server 10.10.220.80 ftpuser ftpuser /
transaction-logs format extended-squid
username admin password 1 bVmDmMMmZAPjY
username admin privilege 15
ldap server base "dc=demodomain"
ldap server userid-attribute cn
ldap server host 10.10.220.80 primary
ldap server administrative-dn "cn=administrator,cn=users,dc=demodomain"
ldap server administrative-passwd ****
ldap server active-directory-group enable
ldap server version 3
ldap server enable
authentication login local enable primary
authentication configuration local enable primary
url-filter http smartfilter enable
cdm ip 10.10.220.70
cms enable

Ldap auth specification about password

Similar Messages

Maybe you are looking for