Microsoft Active Directory Authenticate with Centos

Question

I'm having trouble trying to understand how I can authenticate a user without having to explicitly enter the administrator's credentials.

I have successfully set up a secure connection using LDAP over SSL and I can retrieve a users profile by entering in the terminal:

ldapsearch -x -D cn=administrator,cn=users,dc=domain,dc=local -H ldaps://dc.domain.local -W 'sAMAccountName=smithd'

This prompts me for the admin password and it pulls the requested user info.

How I can authenticate a user without having to explicitly enter the administrator's credentials?

Should I be using Winbind? Samba?

Answer 1

Typically with LDAP, you do not log in ("bind") as the administrator but as the user.

Try ldapsearch -x -D cn=your-user,cn=users,dc=domain,dc=local -H ldaps://dc.domain.local -W 'sAMAccountName=smithd' and if the search succeeds, you user has been authenticated. In AD, a user's CN value may not be immediately obvious and is usually not equal to the sAMAccountName (grrr). Try using an LDAP search to find the CN values for your users:

ldapsearch -x -D cn=administrator,cn=users,dc=domain,dc=local -H ldaps://dc.domain.local -W 'objectclass=inetorgperson' cn

This will give you a list of users and their CN values. Now you can try to bind with one of thos users using the CN value in cn=<user cn>,cn=users,dc=domain,dc=local.

Furthermore, Centos can use pam_ldap to authenticate users against an LDAP directory, also AD. You can find more info here: http://www.padl.com/OSS/pam_ldap.html

For a pam_ldap setup, you will probably need a proxy user whose account name and password are in the configuration file, but this does not have to be an administrative user normally. This user will be used by pam_ldap to locate the actual user trying to log in, after which the bind is performed with that actual user.

Be aware that many people from the LDAP world automatically assume that you understand all the basics, so there might be a steep learning curve.