Using Active Directory (LDAP Plugin) Across Multiple AD Servers

Hi,
I need to give an existing application the ability to talk to multiple active directories using the AD LDAP interface from a J2EE Applcation running on Apache 2.x/Tomcat 5.x (there are 4 independent AD trees and users from ANY of the trees can access the application)
Can anyone point me in the right direction with this? I would seem to make sense that I should create a central security servlet that is aware of all the domains and connect to each of the AD servers in turn using LDAP (as often discussed on these forums) to acertain security rights, then turn control back to the application.
Thoughts? Feedback? General help?
thanks
John

Another thing that would help is any references to sample code where someone has done this before for..
1. the server.xml file mods required? Web.xml Mods?
2. Java code to accomplish this?
Also, am i overthinking the problem? Could I just use some utility class inside the controller servlet that would have one method that would return access level or something? Then in the utility file I can do the looping through LDAP servers (really AD trees) and when I find the information I want, simply return it.

Similar Messages

LDAP Using Active Directory failed in BAM

I tried to configure the LDAP Using Active Directory as described in the BAM installation guide 10.1.3.1.0.
In appsetting, i gave the server name, username and password used by us. Then i restarted the active data cache and IIS. Then i tried to access the http:\\server\oraclebam. But it is throwing the following error. What shall i do.
Exception Message The directory service is unavailable
Stack Trace at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at
System.DirectoryServices.DirectoryEntry.Bind() at System.DirectoryServices.DirectoryEntry.get_AdsObject() at
System.DirectoryServices.DirectorySearcher.FindAll(Boolean findMoreThanOne) at
System.DirectoryServices.DirectorySearcher.FindOne() at
Oracle.BAM.Common.Security.Ldap.LdapAuthenticationTicket.Authenticate(String strName, String strPassword) at
Oracle.BAM.Common.Security.Authentication.LDAPAuthenticationModule.GetPrincipal(ICredentials oCredentials) at
Oracle.BAM.Web.Authentication.WebAuthentication.Authenticate(ICredentials oCredentials) at
Oracle.BAM.Web.Authentication.WebAuthentication.Authenticate() at Oracle.BAM.Web.WebPage.ProcessRequest(Page oPage, String
strAssembly, String strApp, String strType, String strMethod, String strParam)
Debugging Information The directory service is unavailable [ErrorSource="System.DirectoryServices"] Debugging information:
System.Runtime.InteropServices.COMException (0x8007200F): The directory service is unavailable at
System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at System.DirectoryServices.DirectoryEntry.Bind() at
System.DirectoryServices.DirectoryEntry.get_AdsObject() at System.DirectoryServices.DirectorySearcher.FindAll(Boolean
findMoreThanOne) at System.DirectoryServices.DirectorySearcher.FindOne() at
Oracle.BAM.Common.Security.Ldap.LdapAuthenticationTicket.Authenticate(String strName, String strPassword) at
Oracle.BAM.Common.Security.Authentication.LDAPAuthenticationModule.GetPrincipal(ICredentials oCredentials) at
Oracle.BAM.Web.Authentication.WebAuthentication.Authenticate(ICredentials oCredentials) at
Oracle.BAM.Web.Authentication.WebAuthentication.Authenticate() at Oracle.BAM.Web.WebPage.ProcessRequest(Page oPage, String
strAssembly, String strApp, String strType, String strMethod, String strParam)

Hi,
We are also facing the issue stated in the first thread. We followed everything specified in the LDAP PDF under TechNotes and still not able to access the BAM console successfully.
The error we get is pasted at the end of this post. The request doesn't even seem to reach our LDAP server (configured in a remote system).
A couple of clarifications required:
1. Does our windows logon need to be the same as BAM console logon?
2. I do not know the LDAP setting for my actual windows logon. But i have retained my same usrId and have configured a user in LDAP with my own organization and other hierarchies. I have configured this userId with the complete hierarchy in BAM login management and have given admin access also to this user. Is this correct?
An error occurred while processing your request
Details...
Exception Message The server is not operational
Stack Trace at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at System.DirectoryServices.DirectoryEntry.Bind() at System.DirectoryServices.DirectoryEntry.get_AdsObject() at System.DirectoryServices.DirectorySearcher.FindAll(Boolean findMoreThanOne) at System.DirectoryServices.DirectorySearcher.FindOne() at Oracle.BAM.Common.Security.Ldap.LdapAuthenticationTicket.Authenticate(String strName, String strPassword) at Oracle.BAM.Common.Security.Authentication.LDAPAuthenticationModule.GetPrincipal(ICredentials oCredentials) at Oracle.BAM.Web.Authentication.WebAuthentication.Authenticate(ICredentials oCredentials) at Oracle.BAM.Web.Authentication.WebAuthentication.Authenticate() at Oracle.BAM.Web.WebPage.ProcessRequest(Page oPage, String strAssembly, String strApp, String strType, String strMethod, String strParam) ...
Debugging Information The server is not operational [ErrorSource="System.DirectoryServices"] Debugging information: System.Runtime.InteropServices.COMException (0x8007203A): The server is not operational at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at System.DirectoryServices.DirectoryEntry.Bind() at System.DirectoryServices.DirectoryEntry.get_AdsObject() at System.DirectoryServices.DirectorySearcher.FindAll(Boolean findMoreThanOne) at System.DirectoryServices.DirectorySearcher.FindOne() at Oracle.BAM.Common.Security.Ldap.LdapAuthenticationTicket.Authenticate(String strName, String strPassword) at Oracle.BAM.Common.Security.Authentication.LDAPAuthenticationModule.GetPrincipal(ICredentials oCredentials) at Oracle.BAM.Web.Authentication.WebAuthentication.Authenticate(ICredentials oCredentials) at Oracle.BAM.Web.Authentication.WebAuthentication.Authenticate() at Oracle.BAM.Web.WebPage.ProcessRequest(Page oPage, String strAssembly, String strApp, String strType, String strMethod, String strParam) ...
Assembly StartPage
State Oracle.BAM.StartPage.StartUp
Event Initialize
Thanks,
KM

Client Certificate Mapping authentication using Active Directory across trusted forests

Hi,
We currently have a setup where the on-premises environment and the cloud environment are based on two separate forests linked by a 1-way trust, i.e., the exist in the on-premises AD and the 1-way trust allows them to use their
credentials to login to a cloud domain joined server. This works fine with the Windows authentication.
We are now looking at implementing a 2-Factor authentication using Certificate. The PKI infrastructure exists in the On-Premises Forest. The users are able to successfully login to on-premise servers configured with "AD CLient Certificate
Mapping".
However, we are unable to achieve the same functionality on the cloud domain joined servers. I would like to know
1. Is this possible?
2. If yes, what do we need to do to make this work.
Just to clarify, we are able to authenticate using certificates by enabling anonymous authentication. However, we are unable to do the same after turning on "Client Certificate Mapping authentication using Active Directory"

1. Yes!
2. Before answering this I need to know if your are trying to perform a smart card logon on a desktop/console or if you just want to use certificate based authentication in an application like using a web application with client certificate requirements
and mapping?
/Hasain
We will eventually need it for smartcard logon on to desktop/console. However, at present, I am trying to use this for certificate based authentication on a web application.
To simulate the scenario, I setup up two separate forests and established a trust between them.
I then setup a Windows PKI in one of the forests and issued a client certificate to a user.
I then setup a web server in both the forests and configured them for anonymous authentication with Client SSL requirement configured.
I setup a test ASP page to capture the Login Info on both the servers.
With the client and the server in the same forest, I got the following results
Login Info
LOGON_USER: CORP\ASmith
AUTH_USER: CORP\ASmith
AUTH_TYPE: SSL/PCT
With the client in the domain with the PKI and the server in the other Forest, I got the following response
Login Info
LOGON_USER:
AUTH_USER:
AUTH_TYPE:
I tried the configuration with the Anonymous Authentication turned off and the AD CLient Certificate mapping turned on.
With the client and the server in the same forest, I am able to login to the default page. However, with the server in a trusted forest, I get the following error.
401 - Unauthorized: Access is denied due to invalid credentials.
You do not have permission to view this directory or page using the credentials that you supplied

Connected to Domain but can't log in using Actived Directory Credentials

Hey everyone. I've been working on this issue for two weeks now, and I don't know what else to try. I'm connected to my domain but cannot get my Macbooks to log in using Active Directory credenitals both through our wireless network, and hard wired with an ethernet cable. The weird part about it is that it is not uniform all across our network. This only happens to certain Macbooks and as of right now there doesn't seem to be a pattern. I can say that it has happened to all new Macbook Pros that we have ordered lately though.
We use Jamf to manage our Macs on our network, and ever since upgrading to a new version (9.01 and now 9.1) we have had this issue. However I can't connect after manually adding the domain either, so for now it makes me think it is not a Jamf issue. Has anyone dealt with this issue before, that might know of a fix? Thanks!

Hi Burnettb1,
I have come across a similar issue as yours. I have included the instructions that I use to bind the Mac at my institution. In regards to wifi, I have not tried binding the Mac over wifi. Should you need to log in to a Mac with domain user credentials I would suggest to bind the Mac over ethernet. Once you get to the:
*Click on triangle to the left of Show Advanced Options to expand"
portion of the instructions click on the Mappings tab and select the checkbox for creating a mobile account at login. This will create a domain user profile on the machine that you can log into when not connected to the domain.
Hope this helps.
BIND iMac:
          Login into iMac using administrative credentials
          Open System Preferences
                    *Goto Users & Groups
                    *Click on lock in lower left-hand corner
                    *Use same password used to log into iMac
                    *Click on Login Options
*Click on ‘Join...’ button right of "Network Account Server: "
                    *Click on ‘Open Directory Utility…’ button
                    *Click on lock in lower left-hand corner
                    *use same password used to log into iMac and click on Modify Configuration
                    *Double-click on Active Directory
Active Directory Domain = domain
                              Computer ID = name of Mac
                    *Click on triangle to the left of Show Advanced Options to expand
                              *Click on Administrative tab
                              *Check Prefer this domain server
Type domainserver_ipaddr -or- servername.domain in this field
                              *Click on ‘Bind…’ button
                              *When prompted for network administrator login
                                        username = [domain admin user]
                                        pwd = [domain user password]
                              *Click OK (Note: search path will be updating. Until completed the ‘OK’
button will be greyed out
*Click OK
*Click lock to lock and close window
                    *Click lock to lock and close window
BIND CHECK:
          *Search AD for added mac host - it should be there.
          Open Terminal app by either:
                    1)
                              *Press command+spacebar
                              *Type Terminal and select app
                    2)
                              *Click on desktop
                              *Press shift+command+A
                              *Goto Utilities folder located within Application folder (which you should
be in) and open Terminal
          *Once Terminal is opened type in id [domain username] and press return key. The output should be
some some network account information
          *Close app by pressing command+Q and any other opened windows
          *Restart iMac
          *Log in

Getting User Attributes from an Active Directory LDAP

Hello all.
I want to extract attributes assigned to a user in the Active Directory LDAP and make them available through the getPropertyValue property in Javascript. I know that a user's System Attributes can be accessed with getPropertyValue but I have not found a way to get specific attributes from the LDAP and make them available as specific attributes in xMII. System attributes like "EmailAddress1" seem to transfer from the LDAP but others don't. Anyone have any ideas?
Thanks.
...Sparks

Sparks,
If you're using 11.5 or 12 actually they should all map into the system as session properties. You can use the following URL to verify your session properties:
http://<xMIIServer>/Lighthammer/PropertyAccessServlet?Mode=List
If you are not seeing the attributes you expect then your Attribute Query for User or Role is incorrect for your LDAP system and you need to change the LDAP configuration queries.
-Sam

Oracle 9i/10G DB authentication using Active Directory (with out OID)

Hello All,
We want to use a Single-Password authentication scheme using the Active
Directory as the primary source for userId/Password.
We don't want to use the Active Directory and OID bridge.
As we have many databases and would like to configure all Databases to use Active
Directory for Authentication. Our goal is to have single id/password across all
the databases and any user should be able to login from any computer using their
windows id/password, note that we don't want to use the OSAuthentication.
We have read the documents provided by oracle for authentication using Active
Directory, we were able to create Oracle Schema in Active Directory and were
also able to register a DB with Active Directory and then created user as global
user in Oracle Database and provided the DN of the user. When we tried
authenticate with all this setup it comes back and says invalid ID/Password !!!
And with 10G database we get the Oracle Error ORA-03113: end-of-file on communication channel !!
Has any one tried or have information on Integrating Oracle to Auth against Active Directory?
Envoirnment:
Oracle DB Version: 9.2.0 and also tried on 10.0.1 with same results
Operating System: Windows 2000/ Windows 2000 Server
Constraint: We don't want to user OID ( as we don't have license for this
product ! )

I have a thread started similar to your request.
OS Authenication on Windows
Somewhere I read this. It works on Oracle 9i on Linux, but I have not tried it with Oracle 9i on Windows.
SHOW PARAMETER OS_AUTHENT_PREFIX;
SHOW PARAMETER REMOTE_OS_AUTHENT;
CREATE USER OPS$SOMEUSER IDENTIFIED EXTERNALLY;
GRANT CREATE SESSION TO OPS$SOMEUSER;
For the username, I wonder if we are supposed to put the Windows Domain name as part of the username? Such as, for a Windows domain user MyDomain\SomeUser
CREATE USER OPS$MYDOMAIN\SOMEUSER IDENTIFIED EXTERNALLY;
I really wish Oracle or somebody created a guide or book on how to do this.

Integrating Active Directory LDAP in OBIEE 11g

Hi All,
I Have Configured Active Directory LDAP in OBIEE.
Steps i have Followed are,
1) configured Active Directory in providers under Scurity Releam.
2) Restarted BI Services to Load the Ldap Users.
3) login to the EM under bifoundation domain selected securitues->security configuration provider.created user.login.attr and username.attr.
4) under Credentials->oracle.bi.system map->system.user->deleted BISystemUser and Created key with the Existing name in Active Directory.
5) assigned System user to BISystem role in em.
6) in Console Roles and Polocies->Global Roles->Roles->Admin->view Role Condition (User = Active Directory User or Group=Administrators).
7) Restarted BI Server and Presentation Services.
Now I am Unable to Login to Presentation Services.
Please Reply ASAP.
Thanks and Regards
Kiran Kumar

Kiran, Is there a specific reason for using RPD for LDAP authentication? From 11g onwards, the best practice is to use Weblogic (or external Authentication providers). Is it correct to say that for "Authentication' without proper RPD LDAP config for "USER" variable, users cannot login via presentation layer?
Cheers!
BK

What is the Point of Active Directory/LDAP Specification?

My college threw an interesting curve ball today and I couldn't give him a good enough answer. The question was simple 'What is the point of active directory'. Now I don't have a lot of exposure to active directory, but I thought I could easily answer. My argument was; If you have a group of objects its easy to look up attributes for those objects using active directory. For example, if you have a group in AD and you want to verify the users of that group you simply look up the member attribute of that group. However he argued, rightly so, that you can do that with a table in a database, why do that in AD. I couldn't give him a good enough answer and now I'm curious. Given the above example, why use AD over a database?
To me AD is a way to manage a set of resources, whatever they are, by mapping them to objects that have however many attributes. But we could do that in a database, whats the point of AD? Why do you use AD?

I come from a primarily database centric background. Just like life experience, it casts a certain perspective on problems. Database people solve things with databases. Directory people solve things with directories. Everyone has their perspective. It's not really about who's right and who's wrong. It's about perspective because people are most likely to go with what's familiar when given a problem. It's easy to have this conversation in a educational environment but when you're on the job it's about turf, schedules and careers. My latest job (in which this debate comes up a lot) has been about directories which has been a very enlightening experience because I've been given a gift of perspective. I can put on the directory hat and look at it from another angle.
To get back to your professor's question. The answer is easy. LDAP (AD or other) is an application above a database. It has a data store behind it, in most cases we can just assume this is a database. So, in short, it's apples to oranges. But if we insist on comparing which makes the better juice, let's look at how we'd make a database like a directory. We could create a data model with an attributes table, an entries table and so on. We can deconstruct what LDAP data structures really are and implement each type as a table with FK/PK relationships and so on. It's sure to work because there are already so many products on the market doing this very thing. But think about the effort now. How are you going to add new users? A front-end? Stored procedures? Scripts? How are you going to keep someone from seeing things they shouldn't? You have to insert an object into all the right tables to ensure that your data is consistent and valid. In a pure database, you're trying to create ACLs on database rows. Now you're writing a full featured application with a lot of complexity. Given enough directory features, the database isn't going to be able to do everything without an external application.
What is the point of LDAP? It's got hierarchy, ACLs, group of unique names functionality and things that are a layer of abstraction above the data store. I love databases but if you start designing out a directory server from scratch you'll realize it's far beyond comparing a user.ldif to a row in a user table. They are similar in appearance but different types of software.
Edited by: milkfilk on Dec 16, 2008 11:48 AM
Edited by: milkfilk on Dec 16, 2008 11:54 AM

Using Active-Directory PW at SAP logon procedure

Hello,
I have the requirement no to use single sign on for some systems with sensitive data, but would like to check during sap logon procedure the from our central active directory password.
is there any best practice configuration or SAP / AD Win Addon solution available to connect SAP NW abap 7.40 at Win2012 sever with our active directory. Nearly all win based applications can handle a PW check from application to AD. Is there any SAP or Partner implementation helpful to expand the SAP client internal User-PW check?
Thanks in advanced for alternatives to the standard client SSO or any idea in the direction using active directory password within sap-logon.
Please give me a short feedback if you need more details.
regards,
Bernhard Mair
Goethe-Institut München

The SAP NetWeaver ABAP app server only accepts SAP user id and password or it can use SNC to authenticate the user when SAP GUI is used on workstation. So, if you want the user to be prompted to enter their Active Directory credentials during a logon using SAP GUI, and you don't want SSO, then you need to purchase a third party product.
Please note, that SAP is not JUST a Windows based application, as it can also be installed on Unix and Linux, so SAP have made it work in same way on all platforms without any 'special' windows authentication capabilities.
Thanks
Tim

Time Machine Backup using Active Directory account

I have two macbook pros (running 10.6.4) using Active Directory accounts and I am trying to backup them up to an Active Directory integrated XServe (running 10.6.4) with a shared Time Machine backup point. I open Time Machine preferences, select the disk, entering username and password, and it starts trying to make the backup disk available. However, it quits and gives me the following error - the network backup disk could not be accessed because there was a problem with the network username and password. The username and password are correct. I have tried three different accounts and they all produce this error.

This happened to an issue AFP. I had AFP authentication set to use Kerberos. I changed it to use "Any Method" and it is working properly.

Portal Authentication using Active Directory

I am trying to set up authentication using Active Directory. Can anyone provide me with instructions on what to do ? I know that I have to go to System Admin - > System Configuration - > UM configuration and change the Data Source. What else do I need to do...How do specify which domain to authenticate against. Do I have to change the XML file. Please help.

It depends on what you wanna do with the AD server. If you want to read/write on the AD then you have to first setup SSL connection between the two boxes.Else if you just want to read from AD server you don't require a SSL connection. Then you have to select the hierarchy type in the System Admin - > System Configuration - > UM configuration. Save.
Next thing you do is to open the config tool and modify your xml file accordingly.
And restsart the server.
Hope this helps.
Regards,
Hassan

ThinkVantage Technology Deployment using Active Directory

I am attempting to automate the deployment of Rescue and Recovery using Active Directory for about 50 laptops. So far, I've read through all of the Lenovo documentation for RnR deployments, none of which is useful. The deployment guide has broken links, the section "Corporate Active Directory Rollout" is incomplete, the command line options aren't clearly written, and the AD instructions end with 'then deply settings using a registry edit'.
My goal is to configure the laptops to automatically backup to a network share once a week, in the background, without any user intervention. So far, almost everything that I've tried in my test environment has led to failure.
First step, install the software. I can't deploy via Group Policy, as the installation doesn't seem to end up working. I did the administrative install to a network location, then published the program via AD. After the reboot, I'll click the RnR shortcut in the start menu, and nothing happens. I've also tried creating a batch file that runs rrcmd.exe to create a backup, but that fails too "Service not found". So I resort to installing manually.
Next, I try to configure the network location via Group Policy and the supplied ADM file. I set the destination path for MND to \\server\%computername%\, but that fails, as MND tries to connect to a share called %computername% instead of what the system variable says. To get around this, I had to create an MND batch file that edits the MND info right before the backup, which doesn't seem to always work.
Now, if mid-backup the user disconnects from the network, there is a series of Delayed Write errors. That's not acceptable.
Also, if I set the backup location to local via GP, then change it to network, the backup command still reads "L", even after a reinstall of the software with the "local" location set to 0 in group policy.
Are there any tips to help ease this deployment?
Thank You

I think I figured it out! You can do exactly what I was doing.
The solution seemed to be I was missing:
orcluserprincipalname=<ADUser>@<domain>
orclsamaccountname=<name>
objectclass=orclADUser
You need at least the first and third one in order for it to work ( adding them is another story - you are on your own for that :-) ).
FYI I found this in the document that I have been using all day (but I didn't pay close enough attention as I missed that part) Doc ID: Note:277382.1
which can be found on metalink.

User Account Authentication across multiple Solaris servers - Best Practice

Hi,
I am new to Solaris admin and would like to know the best practice/setup for authenticating user accounts across multiple solaris servers.
Currently we have 20 - 30 Solaris 8 & 10 servers which each have their own user accounts setup. I am planning to replace these with a similar number of Solaris 10 servers and would like to centralise the user accounts and their authentication.
I would be grateful for any suggestions on the best setup and any links to tutorials.
Thanks
Jools

i would suggest LDAP + kerberos, LDAP for name lookups and krb5 for auth. provides secure auth + extensable directory for users and other apps if needed. plus, it provides a decent spring board to add other unix plats into the mix since this will support any unix/linux/bsd plat. you could integrate this design with a windows AD env if you want as well.
[http://www.sun.com/bigadmin/features/articles/kerberos_s10.jsp] sol + ldap+ AD
[http://docs.lucidinteractive.ca/index.php/Solaris_LDAP_client_with_OpenLDAP_server] sol + ldap (openldap)
[http://aput.net/~jheiss/krbldap/howto.html] sol + ldap + krb5
now these links are all using some diff means, however they should give you some ideas as to whats out there. sol 10 comes with suns ldap server and you can use the krb5 server which comes with it as well. many many diff ways to do this. many many more links out there as welll. these are just a few.

Active Directory LDAP integration; can not see the XMLP_ groups/roles

We have configured XMLP 10.1.3.3 to use "LDAP" as the Security model. The LDAP server is Active Directory running under Windows Server 2003.
It is working to a certain extent:
Users can log on to the XML Publisher using login/password as defined in AD.
-When logged in as administrator, groups (roles) are visible in Admin/Roles and Permissions and can have assigned folders and data sources.
Problems/questions:
The required roles ("XMLP_ADMIN, etc) can not be seen in Admin/Roles and Permissions. Is this as expected or is it an error?
-When logging in as a user who is member of the group/role XMLP_ADMIN, I do not get any administrator privileges (I have not tested the other XMLP_* roles defined in AD yet). So all administration has to be done as the local superuser.
Is there any way to monitor the login process to try and see what goes wrong?
-Roald
-Roald

The problem has been solved, it was self inflicted, typo in the config file:
<property name="LDAP_PROVIDER_USER_DN" value="Cn=Users;dc=company,dc=com"/>
(semicolon instead of comma after Users).
It is a little surprising that this typo lead to problems with group matching, though. It took some time before this part of the config got enough attention.
-Roald

Is Lightroom supported in a Active Directory domain environment with multiple users logging into a machine?

We are a school district using an Active Directory environment. We currently use other Adobe products with multiple users on different machines and it works fine. If Lightroom does work in a domain environment what are the required local user permissions needed for it tor work properly? Thanks!

Lightroom is not a multiuser program. It is required that the catalog is located on a hard drive that is local to the machine accessing it. There are no workarounds.

Using Active Directory (LDAP Plugin) Across Multiple AD Servers

Similar Messages

Maybe you are looking for