Do some of u guys have some experience with authentication in zabbix using lotus domino? Im not quite sure what to enter there. I know i made some authentication for IBM WebSphere but i cant get it working in zabbix. Can someone give me some tutorial? or explanations? :)
There is :
LDAP HOST : mydomino.local.address
Port : 389
Base DN : ???What is this???
Search attribute : cn;
Bind DN : ???my 'sudo'user / binduser???
Bind password : binduser.password
Ok so I tried it. Also i can easily telnet "mydomino.local.address" on 389 port. So there is nothing bad with connection. Maybe Base DN. Is this something special - unique for each LDAP server like "mycompany DomainName?" or can it be something universal? Alsosearch attribute. I know cn; or uid; or mail; works in WAS.
I would be really glad if someone could just help me with this.
In Domino there are different "Base DNs". For a user search the Base DN typically is o=YourOrganizer, so if your Notesnames look like CN=MartinFric/OU1=IT/O=YourCompany, then the base DN would be o=YourCompany.
Groups do NOT have a Base- DN. If you search for groups, then the Base DN has to be empty.
Bind- DN depends on the configuration of your Domino. Your mail- address will always work as well as your CN- name. So this might be "Martin Fric" or "martin.fric#yourcompany.com". Other variations might work as well. The bind password is the Internet- Password of the bind user (HTTP Password in person document in domino directory).
Usually one creates a specific LDAPBind user in the directory with an internet password to not expose user- passwords to any external program.
The search- attributes depend on what you want to achieve.
Open the Lotus- Notes- Program- Directory of any installed Lotus Notes client in a CMD and type the following:
ldapsearch.exe -h mydomino.local.address -p 389 -D "Martin Fric"
-w YourInternetPassword "(CN=Martin Fric)"
In this query the parameters are:
-h = LDAP HOST
-p = Port
-D = Bind DN
-w = Bind Password
"(cn=Martin Fric)" = Query that sais: Search in (Search attribute) cn for an entry with value "Martin Fric"
If this query succeeeds and the query returns values, then the parameters for zabbix are correct. In that case someone knowing zabbix has to help you further in debugging that.
If this query does NOT succeed, then you need to fix your domino -> Come back with the error mmessage you get for help.
Related
Our organization stores signing certificates in Active Directory. We are using anonymous bind to search for them at a base DN (e.g. OU=MY ORG,dc=mydc,dc=org). I have been trying to use the Spring LdapTemplate to look them up, but no matter what method I use, I get the cryptic InterruptedNamingException.
Assuming a cert subject of cn=mycert.myorg.com
My code looks like this
LdapContextSource contextSource = new LdapContextSource();
contextSource.setUrl(String.format(LDAP_URL_FORMAT, ldapCertStoreParameters.getServerName(),
ldapCertStoreParameters.getPort()));
contextSource.setBase(ldapCertStoreParameters.getBaseDn());
contextSource.setAnonymousReadOnly(true);
contextSource.afterPropertiesSet();
LdapTemplate ldapTemplate = new LdapTemplate(contextSource);
ldapTemplate.setIgnorePartialResultException(true);
ldapTemplate.afterPropertiesSet();
X500Principal principal = x509CertSelector.getSubject();
Object obj = ldapTemplate.lookup(new LdapName(principal.getName()));
The X500 principal's name is the whole dn. cn=mycert.myorg.com,OU=MY ORG,dc=mydc,dc=org
I have also tried the search using just the cn.
We have verified that the DN exists on the server using Apache Directory Studio.
• I would suggest you to please remove the call altogether or set the ‘userSearchBase’ either to an empty String (“”) as per the given example in the below community thread: -
Configure Spring security for Ldap connection
As in the ‘AbstractContextSource’, set the base suffix from which all operations should origin. If a base suffix is set, you will not have to (and, indeed, must not) specify the full distinguished names in any operations performed. Since you specified the full DN for the userDN/filter, you must not specify the base.
AD servers are apparently unable to handle referrals automatically, which causes a ‘PartialResultException’ to be thrown whenever a referral is encountered in a search. To avoid this, set the ‘ignorePartialResultException’ property to true. There is currently no way of manually handling these referrals in the form of ‘ReferralException’, i.e., either you get the exception (and your results are lost) or all referrals are ignored (if the server is unable to handle them properly). Neither is there any simple way to get notified that a ‘PartialResultException’ has been ignored.
For more details regarding the LDAP template search for Active Directory stored certificates, kindly refer to the link below: -
https://docs.spring.io/spring-ldap/docs/current/apidocs/org/springframework/ldap/core/LdapTemplate.html
• Also, please try to refer to the below documentation for configuration of Springboot LDAP template configuration through certificates stored in Active Directory: -
https://www.baeldung.com/x-509-authentication-in-spring-security
Setup is as follows
Forest A
Forest B(trust between A and B is present)
-Separate tree domain(Bt) in forest B
In my application, I am using AdsOpenObject(path, username, password,...) to get list of all groups.
When I am calling it by setting "path" to local domain or forest(A) it works fine.
It also works fine for trusted forest(B).
But when I call AdsOpenObject() for path of separate tree in trusted forest(Bt) it is failing with error as "domain not found".
I am able to logon(LogonUser) using user of that tree domain(Bt).
Anybody have any idea about this behaviour
Thanks in advance
I'm coding on top of some JNI libraries, and I don't really know the details about how they are doing it, but the output of lib is the windows domain user information with sid and sids... They look as shown below
sids: [
"S-1-5-21-2923429462-2395316905-2569861443-1123",
"S-1-5-32-545",
"S-1-5-2",
"S-1-5-5-0-79699478",
"S-1-5-11",
"S-1-1-0",
"S-1-5-15",
"S-1-18-1",
"S-1-5-21-2923429462-2395316905-2569861443-513"
],
sid: "S-1-5-21-2923429462-2395316905-2569861443-1123"
Issue
Can I get the information without a password but only with a user
id?
Is the information changeable?
What are SIDs... I thought there's only one secure identifier.
I'll take a stab at it:
I understand that you're using a Java Native Interface but I'm not sure what other language you're using. If it is with Active Directory, Powershell is perfect for it, though, I'm not sure how it would work with a JNI.
Anyway, here is what I can gather. Each account has a specific Security Identifier, called a SID. There are well-known SIDs for the common accounts (Administrator, for example). Even local account and groups have SIDs, as with any in Active Directory.
If you want to translate a SID to an account, that isn't a problem. If you aren't using Powershell, at least this may give you a starting point:
$SID = New-Object System.Security.Principal.SecurityIdentifier("SID_GOES_HERE")
$user = $SID.Translate([System.Security.Principal.NTAccount])
$user.Value
You could feed each line into these 3 steps by putting it into a function like so:
Function SIDtoUser($SIDint) {
$SID = New-Object System.Security.Principal.SecurityIdentifier($SIDint)
$user = $SID.Translate([System.Security.Principal.NTAccount])
return $user.Value
}
Gather all of the SIDs into an array and run through them like this:
$SIDArray | %{
SIDtoUser($_)
}
I hope this helps. Let me know if I can assist any further.
I am trying to read an msExchMailboxSecurityDescriptor, to find whether it contains a Full Access to another person. The access control entries contain the trustees in the netbios format (DOMAIN\Username).
SecurityDescriptor secDesc = (SecurityDescriptor)userDirectoryEntry.Properties["msExchMailboxSecurityDescriptor"].Value;
AccessControlList usrAcl = (AccessControlList)secDesc.DiscretionaryAcl;
foreach (AccessControlEntry ace in (IEnumerable)usrAcl)
{
var netbiosDn = ace.Trustee.Split('\\')[0];
var netbiosUser = ace.Trustee.Split('\\')[1];
// now, the problem:
UserPrincipal user = UserPrincipal.FindByIdentity(
new PrincipalContext(ContextType.Domain, netbiosDn),
netbiosUser
);
This works until the last line, where I have to connect to the correct AD server and get some user info. Obviously, this fails when there is no server available for that domain, like any of the "NT AUTHORITY" or "BUILTIN" "domains". It does not only fail, it needs quite some time until it does.
How on earth would I distinguish which ones are AD domains, where I can connect to the AD server, and which ones aren't?
Some example users I may find in the Security Descriptor, just for you to get a feel for the problem:
CONTOSO\Alex
CONTOSO\Michael
SUBDOMAIN\Kirk
TRUSTED\George
NTPD\ChiefBrown
NT AUTHORITY\SELF
NT INSTANS\INTERAKTIV
BUILTIN\Администраторы
BUILDING2\Владимир
VORDEFINERT\Administrator
Take a look at SecurityIdentifier.IsWellKnown
You can pass various values, including WellKnownSidType.NTAuthoritySid to determine what kind of SID you have.
(See also this PowerShell code on translating into readable names.)
I'm having trouble logging in to a specific OU in my ConsoleApp. I guess my LDAP string is incorrecct somehow, these are some output samples from my Test-App
This works fine
Path: LDAP://my.domain User: DOMAIN\user Pass: mypass
DOMAIN\user = Autenticated
But none of these
Path: LDAP://my.domain, ou=myou, dc=my, dc=domain User: user Pass: mypass
Path: LDAP://my.domain/ou=myou User: user Pass: mypass
Path: LDAP://my.domain/ou=myou User: DOMAIN\user Pass: mypass
They work in VBS though.. am I getting something all wrong or is it the AD guys that has to do something with my account? All I get is unknown user och wrong password.
They all work, if I leave out the "ou" part, conenctiong to my.domain is a breeze..
Regards
Your LDAP path should be something like:
LDAP://servername/ou=MyOU,dc=my,dc=domain
(you need to provide the server name that you want to use as DC - as your Domain Controller)
or:
LDAP://ou=MyOU,dc=my,dc=domain (for server-less binding)
You cannot specify a username/password to use right in the LDAP string. If you need that, you'll need to find another way to provide those credentials (like picking the right overloaded constructor for DirectoryEntry which allows you to specify a username/password to use for connecting to AD).
Update:
I think you should change your code to work like this:
string adPath = "LDAP://ou=myou,dc=my,dc=domain";
string adUser = "myuser";
string adPass = "mypass";
// you might need to play around with the "AuthenticationTypes" to get it to work
DirectoryEntry entry = new DirectoryEntry(adPath, adUser, adPass, AuthenticationTypes.None);
DirectorySearcher searcher = new DirectorySearcher(entry);
searcher.Filter = #"(objectClass=Person)";
I'm not sure if a LDAP string like this will work:
string adPath = "LDAP://my.domain/ou=myou,dc=my,dc=domain";
I vaguely remember I had to use a server name (not a domain name) to get this to work - something like this:
string adPath = "LDAP://dc01.my.domain/ou=myou,dc=my,dc=domain";