Should I use Authenticated Binding?

Hi,
I have a 10.5.6 Xserver configured as and OD master and bound to AD windows 2003 domain. The OD kerberos realm was deleted and I have kerberized the OD services with the command line sudo dsconfigad -enableSSO.
All seems to be working well at the moment but I wanted to know if I should use Authenticated binding for clients. I have read the 10.6 Open Directory Administration Guide which says:
"Also, avoid mixing Authenticated Directory Binding and Active Directory on the same client or server. Authenticated binding makes use of Kerberos as does Active Directory. Using both will cause unexpected behavior or nonfunctioning authentication services unless care is taken as detailed below.
If you want to mix Authenticated Directory Binding and Active Directory, your Active Directory Domain and Open Directory realms and servers must be in a different hierarchy."
Since I have killed off the OD realm and only using the AD realm does the above apply or can I simple enable authenticated binding.
Also there is an option to enable SSL for LDAP. Do I need this with the Binding policy set to Encrypt all packets (requires SLL or Kerberos)?

Hi robfoster34,
Regarding binding, you may have already seen it, but you may find the following doc useful:
OS X Server: How to require authenticated binding between server and clients
http://support.apple.com/kb/HT4068
Regards,
- Brenden

Similar Messages

Upgrade from 10.6.8 to Mavericks server: issue with authenticated bind

Hello, I have tried upgrading a 10.6.8 server to 3.1.2 Mavericks server and found I can't bind 10.9.x clients.
I need to keep using authenticated bind to manage clients in Workgroup Manager
I have exported the 10.6.8 OD database and imported into a clean installation of Mavericks 3.1.2 server and everything went fine that far.
I then noticed that authenticated bind in Mavericks now requires SSL and the certiicate.
Once I have imported the 10.6.8 OD database into the new server (same name and IP), only the selfsigned certificate coming from the 10.6.8 server is being imported and OD service remains "unprotected" without any certificate assigned (it seems I can't change this)
The problem is I can successfully bind 10.8.x clients against the 10.9 server while this seems not to be possible with 10.9.x clients when using authenticated bind.
If I create a new OD domain, there's an intemediate certificate assigned by default and I can bind 10.9.x clients (authenticated bind).
Am I missing something obvious?
Many thanks for your help
Cheers
Carlo

Hello and many thanks to all for your hints
@Strontium90 I am aware I should move to profiles and I am working towards this goal, but I had mixed results as far as reliability here.
Anyway, I took my time to perform the upgrade once again from scratch and it's defenatly something related to certificates
The only way to (authenticated) bind a 10.9 test client is when I create a new OD domain and the server uses the intemediate certificate that it's automatically created and assigned to OD service
Using the sefl-signed certificate (the existing one - that is imported along with the OD DB - or a new one assigne to it) does not work with the imported DB.
This is the error I get when I try to bind with dsconfigldap
iMac-di-admin:~ admin$ sudo /usr/sbin/dsconfigldap -vsemgx -a my.ODserver.FQDN.com
Password:
dsconfigldap verbose mode
Using suggested computer ID <imac-di-admin>
Options selected by user:
Enforce Secure Authentication is enabled
SSL was chosen
Add server option selected
Server name provided as <my.ODserver.FQDN.com>
Computer ID provided as <imac-di-admin>
Local username determined to be <root>
Enforce man-in-the-middle only policy if server supports it.
Adding new node to search policies
Enforce packet encryption policy if server supports it.
Enforce packet signing policy if server supports it.
Certificates will be automatically added to your system keychain in order to talk to this server.
Would you like to continue (y/n)? y
Error: Description unavailable (9006)
While this is the error I get from Directory Utility
I think I'll seek support from a consultant... ...it all seems beyod my skills
Many thanks again!
Carlo

Authenticated binding: Should be asking for password when joining OD?

Hello,
I have enabled "Authenticated Binding" under OD-Policies-Binding.
When I join a computer from Accounts to OD, should the OD be asked for password? It just presents the dialog for autoconfigure services and it just binds, without any credentials.
Is it how it suppose to work?
Regards
Kostas

So after unlocking the lock, entering your password, and clicking on Login Options, the checkbox for autologin is greyed out? Did you try clicking the toggle box anyway? Does that bring up a blank dropdown menu? Did you click on the little triangle?

Authenticated Bind succeeds but "This server is not responding"

Hey everyone,
I have a "from scratch" magic triangle setup. AD has 2 DC's in a domain named domain.priv, 1 Lion (10.7.4) OD server successfully bound to AD and authentication is working flawlessly and fast! There are a handful of clients running SL which have mobile homes. There are also a handful of Lion clients with mobile homes. DNS is running on AD.
Here's the rub. I can bind the SL clients to AD and OD just fine. I do an authenticated bind to OD so that it creates the computer record. On the Lion clients I bind them to AD without a problem and OD without and error message however once I bind Directory Utility has a red light stating "This server is not responding". Search paths are correct, pinging works the server works. Because authentication and mobile homes are working I think it's fairly safe to assume DNS is setup properly.
For clarification, I have a script that does the binding but I promise I've tried every available option in dsconfigldap without success. I've obviously tried using the GUI as well with no luck. I've tried turning on SSL and no SSL. I've tried enabling other security options without success as well. A work around I have found for the Lion clients was first do an authenticated bind to create the computer record and add it to appropriate computer groups then unbind the client and rebind UNauthenticated. Binding without authentication works perfectly and the client never loses contact with the OD server.
The reason I am posting this problem is because I am finally getting around to adding a secondary OD server for replication. I do not have the option to do an unauthenticated bind with OS Server and I have not found a way to successfully setup a replica without binding first, obviously.
I will post log files as needed but I have not found anything that is out of the ordinary except for:
9/20/12 7:34:16.560 PM servermgrd: -[PasswordServerPrefsObject getSearchBase]: Unable to locate search base: -1 Can't contact LDAP server
9/20/12 7:34:16.562 PM servermgrd: -[PasswordServerPrefsObject loadXMLData]: Unable to locate passwordserver config record's plist attribute: -1 Can't contact LDAP server
9/20/12 7:34:16.564 PM servermgrd: -[PasswordServerPrefsObject getSearchBase]: Unable to locate search base: -1 Can't contact LDAP server
9/20/12 7:34:16.567 PM servermgrd: -[PasswordServerPrefsObject saveXMLData]: ldap_modify_ext_s of the passwordserver config record's plist attribute: -1 Can't contact LDAP server
It goes on like that...
Also, IPv6 is not setup on the AD DNS servers. Not sure that matters but I figured I should put it out there.
Any help or ideas of where to look would be greatly appreciated! Thanks!
Nick.

I ended up opening a ticket with Apple and the cause has been identified and even a "fix"!
Turns out that I skipped a vital step prior to binding to AD or setting up the OD Master; preparing the server to connect to another directory.
It's necessary to go to Server Admin, select Open Directory, Settings, then Change. Select "Connect to another directory" and then continue. After that the normal steps should be taken; Connect to AD with Directory Utility and then Create Open Directory Master with Server Admin.
Since I have a test enviroment that consists of 1 week old backups of the AD Domain Controllers and OD Master I decided to destroy the current OD and start over and testing this out. Guess what? Everything works as it should. Bount a couple of Lion clients, tested management, and even created a replica with the GUI!
Here's the rub...
In order to keep my current environment in tact (computers and computer groups) I exported all of the computers and computer groups from WGM prior to destroying the Open Directory Master. Once I completed setting everything up and created a new Directory Master I reimported the archive. With this method all currently I was back to square one. SL clients were bound, I could unbind and re-authenticaed bind with no problems. Lion clients however, had the same issue, could not bind with authentication. Fail.
I also tried exporting the computers and computer groups from WGM prior to destroying the Master. Set everything back up, imported the computers and computer groups. Nice part is that new binds both SL and Lion work wonderfully. However, any machines that were already bound don't work. I assume this is because even though the Kerberos realm has the same name, there has to be some differences in hash or whatever else Kerberos is using for encryption. There are log entries telling me about all the computers trying to connect that the server can't find in it's database.
Where to go from here?
Not sure. How do I find out what is broken in the Archive? I know that 10.7 took out the option of -merge in slapconfig which may or may not have worked here. Knowing what the "Connect to another directory" option in Server Admin is doing would help out greatly. Not knowing why that simple step does changes everything is deflating to say the least.
I should be talking to an Apple Engineer tomorrow. I will post back.
Nick.

LDAP Authenticated Bind

I have been looking for documentation on LDAP authenticated bind, except there is very little and the stuff that is there doesn't go into any detail. I was able to get authenticated binds to work properly but I wanted to ensure that it was all done correctly.
I found that the users that you are authenticating have to be in the same OU as the service account that you are using to perform the authenticated bind. For example you have an OU called Wireless. users1, user2 and a service account called WiSA are all in this OU. You can authenticate users1 and user2, but no users out of any other OU.
Is this really all there is? There appears to be no ability to do memberOf which really limits what you can do with this.
I am running 6.0.182.0. Any thoughts??

You can use users in another location for authenticated binding of LDAP, in that case while writing the the username you should mention entire path instead of username.
for eg: you should specify the username as cn=user,ou=cisco,ou=wireless,dc=com.
If both your client authentication username and bind username in same location then you can just specify the username controller will pick the path from the LDAP config.
I hope i answerd your question.

User domain\SPFservice is not authorized to perform request using authentication type Negotiate

Hi,
I have installed WAP/SPF in the same domain via express installation. The SPF domain service account is sysadmin on the SPF database. The SPF domain service account is running as identity in IIS application pool. I have registered SPF in
WAP via SPFcomputeraccount\LocalSPFaccount. The LocalSPFaccount is member of the 4 local groups created by the SPF setup. The domain SPF service account is member of the VMM administrators.
When a new tenant want to subscribe to a hosting plan I get an error "One or more errors occurred while contacting the underlying resource providers. The operation may be partially completed. Details: Failed to create subscription".
When I look in the eventviewer of the SPF server in ManagementODataService, I can see "User domain\SPFservice is not authorized to perform request using authentication type Negotiate".
SPF/VMM are both on the latest update rollup. The VMM console is also updated on the SPF server.
I can successfully reproduce the troubleshooting steps from http://blogs.technet.com/b/privatecloud/archive/2013/11/08/troubleshooting-windows-azure-pack-spf-amp-vmm.aspx.

Hi,
During the install it is also asking you to specify groups during the installation (4 x) Is the user you specified als spf runas account also member of those group in the AD?
So you have 4 groups created on the local box by the installation. But also 4 specified during the installation. Check if the account is member of those group(s) as well, reboot the spf and you should be up and running.
Best regards, Mark Scholman. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Error using a binding to get current row data

Hi, from a previous post ( Calling a stored procedure ) that has been answered i have reached to this point and cant get go on:
i have a method declared on appmoduleimpl that calls to a procedure stored in the database and passes two parameters (one string, and one int)to the stored procedure.I drag and drop the method from the data control pallete to my jspx page.
the problem is that i want to get the value of two rows from the current record and set them as values from the parameters.
My Binding:
${bindings.Module3EmpIterator.currentRow.empno}
${bindings.Module3EmpIterator.currentRow.ename}
Note: Module3Emp its the name of my view
when i use this binding i get this error code
JBO-29000: javax.servlet.jsp.el.ELException: Unable to find a value for "ename" in object of class "oracle.jbo.server.ViewRowImpl" using operator "."
javax.servlet.jsp.el.ELException: Unable to find a value for "ename" in object of class "oracle.jbo.server.ViewRowImpl" using operator "."
JBO-29000: javax.servlet.jsp.el.ELException: Unable to find a value for "ename" in object of class "oracle.jbo.server.ViewRowImpl" using operator "."
javax.servlet.jsp.el.ELException: Unable to find a value for "ename" in object of class "oracle.jbo.server.ViewRowImpl" using operator "."
JBO-29000: javax.servlet.jsp.el.ELException: Unable to find a value for "ename" in object of class "oracle.jbo.server.ViewRowImpl" using operator "."
javax.servlet.jsp.el.ELException: Unable to find a value for "ename" in object of class "oracle.jbo.server.ViewRowImpl" using operator "."
Thanks.

Here i store a pl/sql code in a method (At AppModuleImpl Level)
public void callProc1 (String ename,
int empno)
PreparedStatement plsqlBlock = null;
// String statement = "BEGIN p_proc1(:1,:2); END;";
String statement = "BEGIN INSERT INTO p_proc (ID, dato, numero) VALUES (s_proc.NEXTVAL, :1, :2); END;";
plsqlBlock = getDBTransaction().createPreparedStatement(statement,0);
try
plsqlBlock.setString(1,ename);
plsqlBlock.setInt(2,empno);
plsqlBlock.execute();
catch (SQLException sqlException)
throw new SQLStmtException(CSMessageBundle.class,
CSMessageBundle.EXC_SQL_EXECUTE_COMMAND,
statement,
sqlException);
finally
try
plsqlBlock.close();
catch (SQLException e)
// We don't really care if this fails, so just print to the console
e.printStackTrace();
now i expose the method and set the variables in the page definition.
<methodAction id="callProc1"
InstanceName="Module3AppModuleDataControl.dataProvider"
DataControl="Module3AppModuleDataControl"
MethodName="callProc1" RequiresUpdateModel="true" Action="999"
IsViewObjectMethod="false">
<NamedData NDName="ename"
NDValue="${bindings.Module3EmpIterator.currentRow.ename}"
NDType="java.lang.String"/>
<NamedData NDName="empno"
NDValue="${bindings.Module3EmpIterator.currentRow.empno}"
NDType="int"/>
(that does it automatically when i drag and drop the method to the jspx page).
This is the code in the command button inside the jspx page
<af:commandButton actionListener="#{bindings.callProc1.execute}"
text="callProc1"
disabled="#{!bindings.callProc1.enabled}"/>
When i click the button, the method should insert the selected column on a new table that i created But it doesn't. How i can do it, or how i can see the output of those values (bindings.Module3EmpIterator.currentRow.empno... etc.)
Note: when i hardcode the values and put Hello instead of bindings.Module3EmpIterator.currentRow.empno it inserts into the table and works everything fine.

Fetching table content using JUCtrlHierBinding binding

There is a scenario where I have dragged and drop an employee VO on the page. Now I want to access the current row's email attribute.
So this is the code in the managed bean that we normally use to access the value of the attribute using DCIteratorBinding:
DCBindingContainer bc = (DCBindingContainer)BindingContext.getCurrent().getCurrentBindingsEntry();
    DCIteratorBinding iter = bc.findIteratorBinding("EmployeesView1Iterator");
    Row r = iter.getCurrentRow();
    String issueStatus = (String)r.getAttribute("Email");
Can we do the same using JUCtrlHierBinding? The JUCtrlHierBinding class is used to bind tree, treetable, and table components to the ADF model. So using JUCtrlHierBinding, it should work.
I am trying but not able to get it. This is my code:
        JUCtrlHierNodeBinding rowdata = (JUCtrlHierNodeBinding)this.empTable.getRowData();
        System.out.println("Email: " +
                           rowdata.getCurrentRow().getAttribute("Email"));I have binded empTable with the Employee table.
JDev 11.1.1.6

Hi,
actually no, you don't deserve points for the answer, because you did not answer the question. Your question has been
Can we do the same using JUCtrlHierBinding?
The code you posted as an answer uses JUCtrlHierNodeBinding which is the table row wrapper class but not the answer to the question you asked ;-)
So the previous answer would have been correct if it was
CollectionModel tableModel = (CollectionModel ) empTable.getValue();
JUCtrlHierBinding treeBinding =   (JUCtrlHierBinding ) tableModel.getWrappedData();
DCIteratorBinding iter=treeBinding.getIterator();
Row row = iter.getRowSetIterator().getCurrentRow();
if (row != null )
   email= (String)row.getAttribute("Email");
    System.out.println("Selected value " + nodeBinding.getAttribute("Email"));
}Sorry, adfSonal, I have no points for you. However, Puthanampatti deserves 50% of the right answer
Frank

Address already in use: Cannot bind

Hi all. I have a desktop app that sends commands and receives responses from a network appliance.
All commands and responses work fine except one - trying to use RTPSocketPlayer on port 49154.
The normal command and response UDP port is 49152. Streaming audio should come in on port 49154.
I am closing and disconnecting the socket on 49152 after every command and response.
But when I try to invoke the RTPSocketPlayer and bind port 49154 to my local IP, I get the
Address already in use: Cannot bind error.
Any suggestions? Thanks!
waynew

Ah OK, I get it. Change the InitSocket() method thus:
sock = new DatagramSocket(null);
sock.setReuseAddress(true);
sock.bind(new InetSocketAddress(addr, sockPort));but also have a look at netstat -an to see who else is on that port and whether that's OK.

Why should I use xinetd?

Im using inetd, but in mandrake I had xinetd, and somewhere I had read that it is better. Is this true?, and if so, ahow do I install it, cause it's not in pacman (i know I cant install it from source, but I wonder if it's hidden somewhere in the distro)

http://www.xinetd.org/faq.html
Q. What is xinetd ?
A. xinetd is a replacement for inetd, the internet services daemon.
Q: I am not a system administrator; what do I care about an inetd replacement ?
A: xinetd is not just an inetd replacement. Anybody can use it to start servers that don't require privileged ports because xinetd does not require that the services in its configuration file be listed in /etc/services.
Q. Is it compatible with inetd ?
A. No, its configuration file has a different format than inetd's one and it understands different signals. However the signal-to-action assignment can be changed and a program has been included to convert inetd.conf to xinetd.conf.
Q. Why should I use it ?
A. Because it is a lot better (IMHO) than inetd. Here are the reasons:
1) It can do access control on all services based on:
a. address of remote host
b. time of access
c. name of remote host
d. domain name of remote host
2) Access control works on all services, whether multi-threaded or single-threaded and for both the TCP and UDP protocols. All UDP packets can be checked as well as all TCP connections.
3) It provides hard reconfiguration:
a. kills servers for services that are no longer in the configuration file
b. kills servers that no longer meet the access control criteria
4) It can prevent denial-of-access attacks by
a. placing limits on the number of servers for each service (avoids process table overflows)
b. placing an upper bound on the number of processes it will fork
c. placing limits on the size of log files it creates
d. placing limits on the number of connection a single host can initiate
e. place limits on the rate of incoming connections
f. discontinue services if the load exceeds specified limit
5) Extensive logging abilities:
a. for every server started it can log:
i) the time when the server was started
ii) the remote host address
iii) who was the remote user (if the other end runs a RFC-931/RFC-1413 server)
iv) how long the server was running
(i, ii and iii can be logged for failed attempts too).
b. for some services, if the access control fails, it can log information about the attempted access (for example, it can log the user name and command for the rsh service)
6) No limit on number of server arguments
7) You can bind specifc services to specific IP's on your host machine

Use Authentication on XI using Java code

I work with one project on web service implementation with SAP XI
I want to use XI authentication for my web application.
which style should I use for XI authentication
Do you have any readymade java sample code availabe for user authentication?
Can some one help me on this?
kindly send sample code to me
I very much appreciate your quick response
Thanks
With Kind regards
Bob

Hi bob,
If I understood u right - you want to send a message to XI from Java. For this you can use the url to pass to XI engine. after type=entry please add &sap-user=user&sap-password=password...

Ceating nested table using data binding.

Hi,
My requirement is to create a table using ADF data binding where against a value in column 1, there are multiple rows ( in the same row ) in column 2 . Something similar to what we do in excel when we join the 2 horizontal cells.
I am providing sample table layout below. I have created the backend model to match this but both table and tree not providing what i am looking for. Tree does navigate the model but present this in single column.
========================================================================
Column1 Columns2 Column3
========================================================================
ABC First Data31
Second Data32
Data33
Should i use mange bean to render this ?
Thanks & regards
Pankaj.

Hi Frank i have tried that , my requirement to have the data in different column . Somehow the sample table i put does not display the format correctly , but its like a normal table but the cell with multiple values are merged. I have tried the ADF tree which displays the data but the format is of Tree not of normal table .

Question About what Azure Services I should be using for mobile app with website.

Hello,
I am wondering what Azure service would be best for my new application. I need to have an SQL database that I can connect to and modify from both a website and a mobile app preferably WP8 and Android. I was not really understanding whether I would need a
mobile service or normal SQL database. Which should I use or am I completely off track?
Thanks,
Matthias

Mobile Services uses SQL Database, nothing special on that SQL Database, its just like any other "normal" SQL Database.
Mobile Services provides "back-end services" that simplifies accessing SQL Database, Notification services, authentication, etc...
Let's assume you don't use Mobile Services, to use SQL Database, you would need your app (both mobile and web) to connect to the database. In practice, you will not want to expose your SQL database directly, so you'd end-up writing some kind of a "facade"
that your app will access instead of directly connecting to the database.
Instead of writing that "facade", Mobile services provides that for you (you still have to write code though, but less than what you need to write if you're rolling your own).
Both your web app and mobile apps can share the same SQL database (pay attention to the mobile service schema).
To help you decide, ask yourself what other features will your mobile app require? Authentication? Notification? etc... are you prepared to write those on your own or use various libraries instead of one?

Which view object classes should be used by managed bean in ViewController?

I just like to find out which java implementation classes created for a view object should be referenced in a managed bean on the UI side.
For my view object InfoVO, I can create the following classes:
View Object class: InfoVOImpl
View Row class: InfoVORowImpl
View Row Client Interface: InfoVORow
View Row Client Class: InfoVORowClient
Currently, I use InfoVOImpl and InfoVORowImpl in my managed bean so that I can use the getter methods conveniently to access the attributes with proper data types.
I am not sure when I should use InfoVORow and InfoVORowClient instead of InfoVORowImpl.
What are the context and reasons for using InfoVORow or InfoVORowClient instead of InfoVORowImpl?

Hi,
all of these are wrong. If you want to access a method exposed on a ViewObjectImpl class, the you expose the method as a clientMethod (or clientInterface) in the Java options for the View Object (or Application Module if the method is on AMImpl). You should avoid using implementation classes directly in the managed bean. If you need to access a View Object, use its interface ViewObject. If you need anything more specific than that, expose a method on the client interface after which you can access it through the binding layer.
Frank

Should I use dynamic SQL for simple updates?

Please tell me, out of the two options given below, which option should i use to update columns in a table and why?
what will be the performance difference between the two approaches?
Please note: The options given below is just for an example
procedure proc1(var1 varchar2)
is
begin
update tab1 set col1 = var1;
commit;
end;
procedure proc1(var1 varchar2)
is
sqlstr varchar2(1000);
begin
sqlstr := 'update tab1 set col1 = :v1';
execute immediate sqlstr using var1;
commit;
end;
Thanks
Arun

Arun G Nath wrote:.
Should I use dynamic SQL for simple updates? No way, not a chance.
Performance is not the issue (as long as you are using bind variables).
But with dynamic SQL, you loose compile time checking; you do not know until runtime if the SQL is valid.
You also loose the dependency between proc1 and tab1, which can be found only if you search user_source.
(And in either case, you probably want to remove the commit)
Regards
Peter

Should I use Authenticated Binding?

Similar Messages

Maybe you are looking for