LDAP and AD integration

Need help? Post your questions here.

Moderator: moderators

Re: LDAP and AD integration

Postby sir2u » Wed Nov 28, 2012 7:41 pm

What kind of server is this (i.e. Windows, Ubuntu, Redhat)?
sir2u
 
Posts: 48
Joined: Mon Oct 11, 2010 9:44 pm

Re: LDAP and AD integration

Postby HerrNilsson » Wed Nov 28, 2012 7:46 pm

Finally got it working. My DNS didnt found my domain.local. So i edited the host file.

Anyhow. Could i disable the option where the user authenticate towards the subsonic-server?
Cause if i lock an AD account it still works. And if i change password in the AD it is still the old one.

Ubuntu Server btw.
HerrNilsson
 
Posts: 60
Joined: Fri Aug 17, 2012 5:13 am

Re: LDAP and AD integration

Postby sir2u » Wed Nov 28, 2012 8:26 pm

I suspected it was a DNS thing. A better solution is to check /etc/nsswitch.conf and edit the line for hosts so that the first 2 entries are files and dns.
By default mdns4_minimal is before dns, so this will break domains with a .local suffix. You want the line to look like this:
hosts: files dns mdns4_minimal [NOTFOUND=return] mdns4

I posted a tutorial for LDAPS, AD, and Ubuntu at http://forum.subsonic.org/forum/viewtopic.php?f=6&t=9426. Step 13 addresses the issue with user accounts.
Last edited by sir2u on Fri Dec 07, 2012 3:18 pm, edited 1 time in total.
sir2u
 
Posts: 48
Joined: Mon Oct 11, 2010 9:44 pm

Re: LDAP and AD integration

Postby HerrNilsson » Thu Nov 29, 2012 7:26 am

I see. Thanks!

I've lowered the sync to 30 secs.

How does it work with password recovering?
If a AD integrated user restore his password. Will it automaticly change to the AD password again after the sync?
Cause the manageaccount i use is just a domain user and cannot change anything in my AD.
HerrNilsson
 
Posts: 60
Joined: Fri Aug 17, 2012 5:13 am

Re: LDAP and AD integration

Postby sir2u » Thu Nov 29, 2012 12:37 pm

30 seconds might be too low. I think it gets very spammy in your subsonic log file. There might be a way to turn down the verbosity, but I haven't looked for it.

Subsonic is using LDAP to read account information from your domain controller. Users won't be able to perform any kind of AD account management through subsonic. The user cache option controls how frequently subsonic will pull a record from AD rather than relying on its internal cache. In your case, it could take subsonic up to 30 seconds to reflect any password changes.
sir2u
 
Posts: 48
Joined: Mon Oct 11, 2010 9:44 pm

Re: LDAP and AD integration

Postby HerrNilsson » Thu Nov 29, 2012 1:49 pm

Exactly. Therefor i've deleted the Forgott password link :).

Thank you for all your help!
HerrNilsson
 
Posts: 60
Joined: Fri Aug 17, 2012 5:13 am

Re: LDAP and AD integration

Postby djriffic » Fri Dec 07, 2012 4:52 am

what is the useraccountcontrol part of you filter supposed todo
[quote="HerrNilsson"
I have a test account called "testaccount" under DOMAIN.LOCAL --> Domain --> Accounts
And i have a group called "test" under DOMAIN.LOCAL --> Domain --> Groups
The test account is a member of the test group.

I've specified the following in Subsonic:

LDAP URL: ldap://dc01.domain.local:389/dc=domain,dc=local
LDAP search filter: (&(sAMAccountName={0})(&(objectCategory=user)(!(userAccountControl=514))(memberof=cn=test,ou=Groups,ou=domain,dc=spofify,dc=local)))
LDAP manager DN; cn=ldap,ou=Accounts,ou=Domain,dc=domain,dc=local
.[/quote]
YOU!!! miss 100% of all opportunities that you don't look into or give a chance!
http://thegeek.mobi
djriffic
 
Posts: 5
Joined: Fri Dec 07, 2012 12:33 am
Location: Sarasota, Florida

Re: LDAP and AD integration

Postby djriffic » Fri Dec 07, 2012 5:05 am

I just wanted to share what was working for me. Maby it will help someone.

Code: Select all
LDAP URL:            ldap://dc0.thegeek.mobi:/dc=thegeek,dc=mobi
LDAP search filter:  (&(sAMAccountName={0})(&(objectCategory=user)(memberof=cn=subsonic,ou=security_groups,dc=thegeek,dc=mobi)))
Ldap manager:        cn=subuserauth,ou=secs,dc=thegeek,dc=mobi


i have my search filter modified to only allow user that belong to the group subsonic to be allowed to use subsonic.
i haven't messed with ldaps yet but when i get that successfully finished i will.

HOWEVER things that ive noticed during testing that don't work
    user must have "domain user" group along with subsonic group to be authenticated
    once user is created in subsonic if you, deactivate, remove subsonic group or do anything in the DC to prohibit access. access is still granted. - i think this is because user is already authorized to use subsonic by subsonic so its not re questioning the if in group.
YOU!!! miss 100% of all opportunities that you don't look into or give a chance!
http://thegeek.mobi
djriffic
 
Posts: 5
Joined: Fri Dec 07, 2012 12:33 am
Location: Sarasota, Florida

Re: LDAP and AD integration

Postby sir2u » Fri Dec 07, 2012 12:25 pm

The account is cached by Subsonic for a ridiculous amount of time. You have to change the cache time value to something more reasonable in order for changes to take effect in a shorter amount of time. You could also restart the Subsonic service and the changes will take effect immediately.
sir2u
 
Posts: 48
Joined: Mon Oct 11, 2010 9:44 pm

Re: LDAP and AD integration

Postby djriffic » Fri Dec 07, 2012 2:53 pm

Wow that's awesome to know do you know where those changes should be made?
YOU!!! miss 100% of all opportunities that you don't look into or give a chance!
http://thegeek.mobi
djriffic
 
Posts: 5
Joined: Fri Dec 07, 2012 12:33 am
Location: Sarasota, Florida

Re: LDAP and AD integration

Postby sir2u » Fri Dec 07, 2012 3:16 pm

Read a few posts up in this thread. I explained it there. Hopefully that solves your issue.
sir2u
 
Posts: 48
Joined: Mon Oct 11, 2010 9:44 pm

Previous

Return to Help

Who is online

Users browsing this forum: No registered users and 15 guests