Active Directory Integration Index

I am looking for a setup as follow:

DNS – Runs on Linux
ADS – Windows 2000 or Windows 2003 – Pointing to Linux DNS (BIND 9)
Radius Authentication for Admins to access PIX and other network resources including Servers

- Could you please, guide me, if you have any resources.

Many thanks,

Suresh

We’re having some real goofy experiences with the Unix Identity Management components of R2 within our network…

Situation: we’re running an SBS 2003 R2 domain with a member server (also a DC) that is Server 2003 x64 R2. The member server has Unix Id Management installed on it. Also installed on the primary DC (ie: SBS server) is the IDMU.EXE as described in ( http://support.microsoft.com/kb/921913 ) to ensure all the properties tabs are there (they are).

When we query the 2003 ldap database for unix attributes, they can only be seen if the user whose attributes we want to access is the one accessing LDAP, for example on the “Unix Attributes” tab we have setup information for home directories, uid, etc… on a user called test. If we use a LDAP browser and bind using the test user we can see the attributes, but if we bind using a generic user (as anticipated in just about every how-to we’ve come across), the unix attributes cannot be seen.

All of the recommendations for accessing unix attributes through LDAP, create a proxy user to access the attributes for authorization purposes, but if this proxy user cannot see the attributes, then obviously something is not working.

Any insight on how the permissions are supposed to be setup within AD to ensure LDAP bindings are successful??

Thanks!

I previously had an apache server configured to authenticate against AD using a service account. Everything worked fine, until the primary DC tanked one day. The failover did not work and when the primary DC was brought up, the ldap auth did not work any more. Upon investigation, the SPN (as viewed in adsiedit.msc had duplicate entries, so I deleted them, thinking that ktpass would regenerate the mapping. HOWEVER:

ktpass.exe -princ [email protected] -mapus
er service.svc -crypto des-cbc-md5 +DesOnly -pass password -kvno 19 -ptype KRB5_NT_PRINCIPAL -out keytab.keytab
Targeting domain controller: domaincontroller.domain.com
Failed to set property “servicePrincipalName” to “boxname.domain.com” on Dn “CN=service.svc,OU=ServiceAccounts,D
C=Domain1,DC=Domain2,DC=com”: 0×13.
WARNING: Unable to set SPN mapping data.
If service.svc already has an SPN mapping installed for boxname.domain.com, this is no cause for concern.
Key created.
Output keytab to keytab.keytab:
Keytab version: 0×502
keysize 75 [email protected] ptype 1 (KRB5_NT_PRINCIPAL) vno 19 etype 0×3 (DES-CBC-MD5)
keylength 8 (0x19624394c2434fb5)
Account service.svc has been set for DES-only encryption.

so, question: what is my best course of action from this point?

thanks

1. Hi
I have server running Red Hat Enterprise Linux ES release 4 (Nahant Update 6). we have ldap configured on it, here is several problems that we have encountered and i’m wondering if anyone else has seen them:
1. doing the following causes segmentation fault.
#getent -s ‘dns ldap’ passwd
Segmentation fault
2. using sudo gets the followign error:
#sudo getent passwd
Password:
sudo: ../../../libraries/liblber/sockbuf.c:90: ber_sockbuf_ctrl: Assertion `sb != ((void *)0)’ failed.
Aborted
any comments is appreciated.
regards,
Kathy