Ldasearch against Microsoft AD - authentication error

Question

Hi,
I'm having a strange issue with ldapsearch against Microsoft AD.
I'm using this query:
ldapsearch -p 389 -h <ad_host> \
-D "CN=oraclesso,OU=Service Accounts,OU=Admin,DC=<domain>,DC=<domain>" \
-w "<the_correct_password>" -s sub -b "DC=<domain>,DC=<domain>" "(&(objectcategory=person)(objectclass=user)(iceNc=1)" dn
This query correctly returns the DNs I'm looking for on AD, but strangely ad the end of the command the following error message il also reported:
LDAP AuthenticationException javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece^@]
I've researched the "data 525" error and it means "user not found" and this is very strange because I'm sure that the "oraclesso" user exists on AD (this user is member of the Domain Admins group) and also I can successfully bind using that DN:
ldapbind -D "CN=oraclesso,OU=Service Accounts,OU=Admin,DC=<domain>,DC=<domain>" -h <ad_host> -p 389 -q
Please enter bind password: <the_correct_password>
bind successful
And if I use a wrong username I correctly get this message:
ldapbind -D "CN=<wrong_username>,OU=Service Accounts,OU=Admin,DC=<domain>,DC=<domain>" -h <ad_host> -p 389 -q
Please enter bind password: <a_wrong_password>
ldap_bind: Invalid credentials
ldap_bind: additional info: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece
If the "oraclesso" user doesn't exist on AD (as indicated by the "data 525" error) I should not get any result from the ldapsearch command or at least I should only get an authentication error message. Instead I'm getting the correct list of users plus the authentication error at the end. I cannot explain this.
This is preventing me from configuring the OID-AD integration because the initial bootstrap of the users is failing as the authentication fails.
Can you help?
Thank you

Answer 1

I assume the same user definitions will exist both in AD and internal store
If so can achieve as follows:
- define an i]dentity sequence. Select Password Based authentication method and select AD in list of "Authentication and Attribute Retrieval Search List". Select "Internal Users" in list of 'Additional Attribute Retrieval Search List". Can also select the option "If internal user/host not found or disabled then exit sequence and treat as "User Not Found" to ensure that only users defined in the internal store get access
- Select the defined Identity Sequence as result in the Identity Policy for the TACACS+ service
This means that when TACACS+ request is received, authentication will be performed against AD. If that succeeds then attributes will be retrieved for the internal user and can be used in policy