Openldap and ActiveDirectory authentication

0
votes

Is it possible to connect to an OpenLDAP server as the active directory with this form " username@domain " I have tested this form, it connects with active directory but with openLdap i have to put the full DN.

Does anyone has any idea how to modify my openLDAP to connect as AD if it's possible

Thanks.

2
ldapopenldap
OpenLDAP is an LDAP server. ActiveDirectory is another one. 'Connect to an OpenLDAP server as the active directory' is therefore meaningless. OpenLDAP does not support username@domain as a bind name. You have to first search the directory for the user with that mail address, and use that entry's DN as the bind-name. - user207421

2 Answers

1
votes

If you wants to authenticate Openldap and AD users using same DN you need to add proxy to AD server from openldap server.

You need to use back_ldap module to make AD database as subordinate of Openldap database.

You can add custom attribute in openldap/ad for uniqueness of user mostly we find email attribute as common on both sides.

0
votes

If you want to use alternative bind names like the userPrincipalName (username@realm) with openLDAP, you need the rewrite/remap overlay slapo-rwm coming with version 2.4.

A very simple example would be:

# Typed and not tested!

rwm-rewriteEngine   on

rwm-rewriteContext  addName
rwm-rewriteRule     "(.*)" "userPrincipalName=$1" ":"
rwm-rewriteMap      ldap upn2dn "ldap://host/dc=my,dc=org?dn?sub"

rwm-rewriteContext  bindDN
rwm-rewriteRule     ".*" "${upn2dn($0)}" ":@I"

EDIT

In reply to the question in your comment: LDAP as a protocol has no concept of uniqueness, it's a product feature. With OpenLDAP for example, you can use the unique overlay to enforce uniqueness for certain attribute types in suitable backends. With phpLDAPAdmin you can configure the attribute types that shall be tested for uniqueness by that client.