2022-04-27 13:22:11 +02:00
<!DOCTYPE HTML>
< html lang = "en" class = "sidebar-visible no-js light" >
< head >
<!-- Book generated using mdBook -->
< meta charset = "UTF-8" >
< title > LDAP - Kanidm Administration< / title >
2022-12-15 07:26:33 +01:00
2022-04-27 13:22:11 +02:00
<!-- Custom HTML head -->
2022-12-15 07:26:33 +01:00
2022-04-27 13:22:11 +02:00
< meta name = "description" content = "" >
< meta name = "viewport" content = "width=device-width, initial-scale=1" >
< meta name = "theme-color" content = "#ffffff" / >
2022-06-05 07:20:33 +02:00
< link rel = "shortcut icon" href = "../favicon.png" >
< link rel = "stylesheet" href = "../css/variables.css" >
< link rel = "stylesheet" href = "../css/general.css" >
< link rel = "stylesheet" href = "../css/chrome.css" >
< link rel = "stylesheet" href = "../css/print.css" media = "print" >
2022-12-15 07:26:33 +01:00
2022-04-27 13:22:11 +02:00
<!-- Fonts -->
2022-06-05 07:20:33 +02:00
< link rel = "stylesheet" href = "../FontAwesome/css/font-awesome.css" >
< link rel = "stylesheet" href = "../fonts/fonts.css" >
2022-12-15 07:26:33 +01:00
2022-04-27 13:22:11 +02:00
<!-- Highlight.js Stylesheets -->
2022-06-05 07:20:33 +02:00
< link rel = "stylesheet" href = "../highlight.css" >
< link rel = "stylesheet" href = "../tomorrow-night.css" >
< link rel = "stylesheet" href = "../ayu-highlight.css" >
2022-04-27 13:22:11 +02:00
<!-- Custom theme stylesheets -->
2022-12-15 07:26:33 +01:00
2022-04-27 13:22:11 +02:00
< / head >
< body >
<!-- Provide site root to javascript -->
2022-12-04 23:16:42 +01:00
< script >
2022-06-05 07:20:33 +02:00
var path_to_root = "../";
2022-04-27 13:22:11 +02:00
var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "navy" : "light";
< / script >
<!-- Work around some values being stored in localStorage wrapped in quotes -->
2022-12-04 23:16:42 +01:00
< script >
2022-04-27 13:22:11 +02:00
try {
var theme = localStorage.getItem('mdbook-theme');
var sidebar = localStorage.getItem('mdbook-sidebar');
if (theme.startsWith('"') & & theme.endsWith('"')) {
localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
}
if (sidebar.startsWith('"') & & sidebar.endsWith('"')) {
localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
}
} catch (e) { }
< / script >
<!-- Set the theme before any content is loaded, prevents flash -->
2022-12-04 23:16:42 +01:00
< script >
2022-04-27 13:22:11 +02:00
var theme;
try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
if (theme === null || theme === undefined) { theme = default_theme; }
var html = document.querySelector('html');
html.classList.remove('no-js')
html.classList.remove('light')
html.classList.add(theme);
html.classList.add('js');
< / script >
<!-- Hide / unhide sidebar before it is displayed -->
2022-12-04 23:16:42 +01:00
< script >
2022-04-27 13:22:11 +02:00
var html = document.querySelector('html');
var sidebar = 'hidden';
if (document.body.clientWidth >= 1080) {
try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
sidebar = sidebar || 'visible';
}
html.classList.remove('sidebar-visible');
html.classList.add("sidebar-" + sidebar);
< / script >
< nav id = "sidebar" class = "sidebar" aria-label = "Table of contents" >
< div class = "sidebar-scrollbox" >
2022-11-23 14:53:51 +01:00
< ol class = "chapter" > < li class = "chapter-item expanded " > < a href = "../intro.html" > < strong aria-hidden = "true" > 1.< / strong > Introduction to Kanidm< / a > < / li > < li class = "chapter-item expanded " > < a href = "../frequently_asked_questions.html" > < strong aria-hidden = "true" > 2.< / strong > Frequently Asked Questions< / a > < / li > < li class = "chapter-item expanded " > < a href = "../installing_the_server.html" > < strong aria-hidden = "true" > 3.< / strong > Installing the Server< / a > < / li > < li > < ol class = "section" > < li class = "chapter-item expanded " > < a href = "../choosing_a_domain_name.html" > < strong aria-hidden = "true" > 3.1.< / strong > Choosing a Domain Name< / a > < / li > < li class = "chapter-item expanded " > < a href = "../prepare_the_server.html" > < strong aria-hidden = "true" > 3.2.< / strong > Preparing for your Deployment< / a > < / li > < li class = "chapter-item expanded " > < a href = "../server_configuration.html" > < strong aria-hidden = "true" > 3.3.< / strong > Server Configuration and Install< / a > < / li > < li class = "chapter-item expanded " > < a href = "../server_update.html" > < strong aria-hidden = "true" > 3.4.< / strong > Server Updates< / a > < / li > < li class = "chapter-item expanded " > < a href = "../security_hardening.html" > < strong aria-hidden = "true" > 3.5.< / strong > Platform Security Hardening< / a > < / li > < / ol > < / li > < li class = "chapter-item expanded " > < a href = "../client_tools.html" > < strong aria-hidden = "true" > 4.< / strong > Client Tools< / a > < / li > < li > < ol class = "section" > < li class = "chapter-item expanded " > < a href = "../installing_client_tools.html" > < strong aria-hidden = "true" > 4.1.< / strong > Installing client tools< / a > < / li > < / ol > < / li > < li class = "chapter-item expanded " > < a href = "../administrivia.html" > < strong aria-hidden = "true" > 5.< / strong > Administration< / a > < / li > < li > < ol class = "section" > < li class = "chapter-item expanded " > < a href = "../accounts_and_groups.html" > < strong aria-hidden = "true" > 5.1.< / strong > Accounts and Groups< / a > < / li > < li class = "chapter-item expanded " > < a href = "../backup_restore.html" > < strong aria-hidden = "true" > 5.2.< / strong > Backup and Restore< / a > < / li > < li class = "chapter-item expanded " > < a href = "../database_maint.html" > < strong aria-hidden = "true" > 5.3.< / strong > Database Maintenance< / a > < / li > < li class = "chapter-item expanded " > < a href = "../domain_rename.html" > < strong aria-hidden = "true" > 5.4.< / strong > Domain Rename< / a > < / li > < li class = "chapter-item expanded " > < a href = "../monitoring.html" > < strong aria-hidden = "true" > 5.5.< / strong > Monitoring the platform< / a > < / li > < li class = "chapter-item expanded " > < a href = "../password_quality.html" > < strong aria-hidden = "true" > 5.6.< / strong > Password Quality and Badlisting< / a > < / li > < li class = "chapter-item expanded " > < a href = "../posix_accounts.html" > < strong aria-hidden = "true" > 5.7.< / strong > POSIX Accounts and Groups< / a > < / li > < li class = "chapter-item expanded " > < a href = "../ssh_key_dist.html" > < strong aria-hidden = "true" > 5.8.< / strong > SSH Key Distribution< / a > < / li > < li class = "chapter-item expanded " > < a href = "../recycle_bin.html" > < strong aria-hidden = "true" > 5.9.< / strong > The Recycle Bin< / a > < / li > < li class = "chapter-item expanded " > < a href = "../why_tls.html" > < strong aria-hidden = "true" > 5.10.< / strong > Why TLS?< / a > < / li > < / ol > < / li > < li class = "chapter-item expanded " > < a href = "../troubleshooting.html" > < strong aria-hidden = "true" > 6.< / strong > Troubleshooting< / a > < / li > < li class = "chapter-item expanded " > < a href = "../glossary.html" > < strong aria-hidden = "true" > 7.< / strong > Glossary of Technical Terms< / a > < / li > < li class = "chapter-item expanded affix " > < li class = "part-title" > Services< / li > < li class = "chapter-item expanded " > < a href = "../integrations/oauth2.html" > < strong aria-hidden = "true" > 8.< / strong > Oauth2< / a > < / li > < li class = "chapter-item expanded " > < a href = "../integrations/pam_and_nsswitch.html" > < strong aria-hidden = "true" > 9.< / strong > PAM and nsswitch< / a > < / li > < li class = "chapter-item expanded " > < a href = "../integrations/radius.html" > < strong aria-hidden = "true" > 10.< / strong > RADIUS< / a > < / li > < li class = "chapter-item expanded " > < a href = "../integrations/ldap.html" class = "active" > < strong aria-hidden = "true" > 11.< / strong > LDAP< / a > < / li > < li class = "chapter-item expanded affix " > < li class = "part-title" > Integration Examples< / li > < li class = "chapter-item expanded " > < a href = "../exam
2022-04-27 13:22:11 +02:00
< / div >
< div id = "sidebar-resize-handle" class = "sidebar-resize-handle" > < / div >
< / nav >
< div id = "page-wrapper" class = "page-wrapper" >
< div class = "page" >
2022-12-15 07:26:33 +01:00
< div id = "menu-bar-hover-placeholder" > < / div >
2022-04-27 13:22:11 +02:00
< div id = "menu-bar" class = "menu-bar sticky bordered" >
< div class = "left-buttons" >
< button id = "sidebar-toggle" class = "icon-button" type = "button" title = "Toggle Table of Contents" aria-label = "Toggle Table of Contents" aria-controls = "sidebar" >
< i class = "fa fa-bars" > < / i >
< / button >
< button id = "theme-toggle" class = "icon-button" type = "button" title = "Change theme" aria-label = "Change theme" aria-haspopup = "true" aria-expanded = "false" aria-controls = "theme-list" >
< i class = "fa fa-paint-brush" > < / i >
< / button >
< ul id = "theme-list" class = "theme-popup" aria-label = "Themes" role = "menu" >
2022-12-04 23:16:42 +01:00
< li role = "none" > < button role = "menuitem" class = "theme" id = "light" > Light< / button > < / li >
2022-04-27 13:22:11 +02:00
< li role = "none" > < button role = "menuitem" class = "theme" id = "rust" > Rust< / button > < / li >
< li role = "none" > < button role = "menuitem" class = "theme" id = "coal" > Coal< / button > < / li >
< li role = "none" > < button role = "menuitem" class = "theme" id = "navy" > Navy< / button > < / li >
< li role = "none" > < button role = "menuitem" class = "theme" id = "ayu" > Ayu< / button > < / li >
< / ul >
< button id = "search-toggle" class = "icon-button" type = "button" title = "Search. (Shortkey: s)" aria-label = "Toggle Searchbar" aria-expanded = "false" aria-keyshortcuts = "S" aria-controls = "searchbar" >
< i class = "fa fa-search" > < / i >
< / button >
< / div >
< h1 class = "menu-title" > Kanidm Administration< / h1 >
< div class = "right-buttons" >
2022-06-05 07:20:33 +02:00
< a href = "../print.html" title = "Print this book" aria-label = "Print this book" >
2022-04-27 13:22:11 +02:00
< i id = "print-button" class = "fa fa-print" > < / i >
< / a >
2022-07-05 03:51:41 +02:00
< a href = "https://github.com/kanidm/kanidm" title = "Git repository" aria-label = "Git repository" >
< i id = "git-repository-button" class = "fa fa-github" > < / i >
< / a >
< a href = "https://github.com/kanidm/kanidm/edit/master/kanidm_book/src/integrations/ldap.md" title = "Suggest an edit" aria-label = "Suggest an edit" >
< i id = "git-edit-button" class = "fa fa-edit" > < / i >
< / a >
2022-12-15 07:26:33 +01:00
2022-04-27 13:22:11 +02:00
< / div >
< / div >
< div id = "search-wrapper" class = "hidden" >
< form id = "searchbar-outer" class = "searchbar-outer" >
< input type = "search" id = "searchbar" name = "searchbar" placeholder = "Search this book ..." aria-controls = "searchresults-outer" aria-describedby = "searchresults-header" >
< / form >
< div id = "searchresults-outer" class = "searchresults-outer hidden" >
< div id = "searchresults-header" class = "searchresults-header" > < / div >
< ul id = "searchresults" >
< / ul >
< / div >
< / div >
2022-12-15 07:26:33 +01:00
2022-04-27 13:22:11 +02:00
<!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
2022-12-04 23:16:42 +01:00
< script >
2022-04-27 13:22:11 +02:00
document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
});
< / script >
< div id = "content" class = "content" >
< main >
< h1 id = "ldap" > < a class = "header" href = "#ldap" > LDAP< / a > < / h1 >
2022-12-04 23:16:42 +01:00
< p > While many applications can support external authentication and identity services through
Oauth2, not all services can.
Lightweight Directory Access Protocol (LDAP) has been the " lingua franca" of
authentication for many years, with almost every application in the world being
able to search and bind to LDAP. As many organisations still rely on LDAP, Kanidm
can host a read-only LDAP interface for these legacy applications.< / p >
2022-08-08 03:34:08 +02:00
< table >
< tr >
< td rowspan = 2 > < img src = "../images/kani-warning.png" alt = "Kani Warning" / > < / td >
< td > < strong > Warning!< / strong > < / td >
< / tr >
< tr >
2022-12-04 23:16:42 +01:00
< td > The LDAP server in Kanidm is not a fully RFC-compliant LDAP server. This is intentional, as Kanidm wants to cover the common use cases - simple bind and search.< / td >
2022-08-08 03:34:08 +02:00
< / tr >
< / table >
2022-04-27 13:22:11 +02:00
< h2 id = "what-is-ldap" > < a class = "header" href = "#what-is-ldap" > What is LDAP< / a > < / h2 >
< p > LDAP is a protocol to read data from a directory of information. It is not
a server, but a way to communicate to a server. There are many famous LDAP
implementations such as Active Directory, 389 Directory Server, DSEE,
2022-06-02 03:20:33 +02:00
FreeIPA, and many others. Because it is a standard, applications can use
2022-04-27 13:22:11 +02:00
an LDAP client library to authenticate users to LDAP, given " one account" for
many applications - an IDM just like Kanidm!< / p >
< h2 id = "data-mapping" > < a class = "header" href = "#data-mapping" > Data Mapping< / a > < / h2 >
2022-06-02 03:20:33 +02:00
< p > Kanidm cannot be mapped 100% to LDAP's objects. This is because LDAP
2022-04-27 13:22:11 +02:00
types are simple key-values on objects which are all UTF8 strings (or subsets
thereof) based on validation (matching) rules. Kanidm internally implements complex
2022-12-04 23:16:42 +01:00
data types such as tagging on SSH keys, or multi-value credentials. These can not
2022-04-27 13:22:11 +02:00
be represented in LDAP.< / p >
2022-06-02 03:20:33 +02:00
< p > Many of the structures in Kanidm do not correlate closely to LDAP. For example
2022-12-04 23:16:42 +01:00
Kanidm only has a GID number, where LDAP's schemas define both a UID number and a
2022-06-02 03:20:33 +02:00
GID number.< / p >
2022-04-27 13:22:11 +02:00
< p > Entries in the database also have a specific name in LDAP, related to their path
in the directory tree. Kanidm is a flat model, so we have to emulate some tree-like
elements, and ignore others.< / p >
< p > For this reason, when you search the LDAP interface, Kanidm will make some mapping decisions.< / p >
< ul >
2022-12-04 23:16:42 +01:00
< li > The Kanidm domain name is used to generate the DN of the suffix.< / li >
2022-04-27 13:22:11 +02:00
< li > The domain_info object becomes the suffix root.< / li >
2022-06-02 03:20:33 +02:00
< li > All other entries are direct subordinates of the domain_info for DN purposes.< / li >
2022-12-04 23:16:42 +01:00
< li > Distinguished Names (DNs) are generated from the spn, name, or uuid attribute.< / li >
2022-06-02 03:20:33 +02:00
< li > Bind DNs can be remapped and rewritten, and may not even be a DN during bind.< / li >
2022-04-27 13:22:11 +02:00
< li > The '*' and '+' operators can not be used in conjuction with attribute lists in searches.< / li >
< / ul >
< p > These decisions were made to make the path as simple and effective as possible,
relying more on the Kanidm query and filter system than attempting to generate a tree-like
representation of data. As almost all clients can use filters for entry selection
2022-06-02 03:20:33 +02:00
we don't believe this is a limitation for the consuming applications.< / p >
2022-04-27 13:22:11 +02:00
< h2 id = "security" > < a class = "header" href = "#security" > Security< / a > < / h2 >
< h3 id = "tls" > < a class = "header" href = "#tls" > TLS< / a > < / h3 >
< p > StartTLS is not supported due to security risks. LDAPS is the only secure method
2022-10-07 11:23:12 +02:00
of communicating to any LDAP server. Kanidm, when configured with certificates, will
use them for LDAPS (and will not listen on a plaintext LDAP port).< / p >
2022-12-04 23:16:42 +01:00
< h3 id = "writes" > < a class = "header" href = "#writes" > Writes< / a > < / h3 >
< p > LDAP's structure is too simplistic for writing to the complex entries that Kanidm internally
contains. As a result, writes are rejected for all users via the LDAP interface.< / p >
2022-04-27 13:22:11 +02:00
< h3 id = "access-controls" > < a class = "header" href = "#access-controls" > Access Controls< / a > < / h3 >
2022-06-02 03:20:33 +02:00
< p > LDAP only supports password authentication. As LDAP is used heavily in POSIX environments
2022-04-27 13:22:11 +02:00
the LDAP bind for any DN will use its configured posix password.< / p >
2022-06-02 03:20:33 +02:00
< p > As the POSIX password is not equivalent in strength to the primary credentials of Kanidm
2022-12-04 23:16:42 +01:00
(which may be multi-factor authentication, MFA), the LDAP bind does not grant
rights to elevated read permissions. All binds have the permissions of " Anonymous"
2022-06-02 03:20:33 +02:00
even if the anonymous account is locked.< / p >
2022-12-04 23:16:42 +01:00
< p > The exception is service accounts which can use api-tokens during an LDAP bind for elevated
read permissions.< / p >
2022-04-27 13:22:11 +02:00
< h2 id = "server-configuration" > < a class = "header" href = "#server-configuration" > Server Configuration< / a > < / h2 >
2022-06-02 03:20:33 +02:00
< p > To configure Kanidm to provide LDAP, add the argument to the < code > server.toml< / code > configuration:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > ldapbindaddress = " 127.0.0.1:3636"
< / code > < / pre >
2022-12-04 23:16:42 +01:00
< p > You should configure TLS certificates and keys as usual - LDAP will re-use the Web
2022-06-02 03:20:33 +02:00
server TLS material.< / p >
< h2 id = "showing-ldap-entries-and-attribute-maps" > < a class = "header" href = "#showing-ldap-entries-and-attribute-maps" > Showing LDAP Entries and Attribute Maps< / a > < / h2 >
2022-12-04 23:16:42 +01:00
< p > By default Kanidm is limited in what attributes are generated or remapped into
LDAP entries. However, the server internally contains a map of extended attribute
2022-06-02 03:20:33 +02:00
mappings for application specific requests that must be satisfied.< / p >
2022-04-27 13:22:11 +02:00
< p > An example is that some applications expect and require a 'CN' value, even though Kanidm does not
provide it. If the application is unable to be configured to accept " name" it may be necessary
2022-06-02 03:20:33 +02:00
to use Kanidm's mapping feature. Currently these are compiled into the server, so you may need to open
2022-12-04 23:16:42 +01:00
an issue with your requirements for attribute maps.< / p >
2022-04-27 13:22:11 +02:00
< p > To show what attribute maps exists for an entry you can use the attribute search term '+'.< / p >
< pre > < code > # To show Kanidm attributes
ldapsearch ... -x '(name=admin)' '*'
# To show all attribute maps
ldapsearch ... -x '(name=admin)' '+'
< / code > < / pre >
2022-06-02 03:20:33 +02:00
< p > Attributes that are in the map can be requested explicitly, and this can be combined with requesting
Kanidm native attributes.< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > ldapsearch ... -x '(name=admin)' cn objectClass displayname memberof
< / code > < / pre >
2022-12-04 23:16:42 +01:00
< h2 id = "service-accounts" > < a class = "header" href = "#service-accounts" > Service Accounts< / a > < / h2 >
< p > If you have < a href = "../accounts_and_groups.html#using-api-tokens-with-service-accounts" > issued api tokens for a service account< / a >
they can be used to gain extended read permissions for those service accounts.< / p >
< p > Api tokens can also be used to gain extended search permissions with LDAP. To do this you can bind
2022-12-15 22:58:21 +01:00
with a dn of < code > dn=token< / code > and provide the api token in the password.< / p >
2022-12-04 23:16:42 +01:00
< blockquote >
2022-12-15 22:58:21 +01:00
< p > < strong > NOTE< / strong > The < code > dn=token< / code > keyword is guaranteed to not be used by any other entry, which is why it was chosen as the keyword to initiate api token binds.< / p >
2022-12-04 23:16:42 +01:00
< / blockquote >
< pre > < code class = "language-shell" > ldapwhoami -H ldaps://URL -x -D " dn=token" -w " TOKEN"
ldapwhoami -H ldaps://idm.example.com -x -D " dn=token" -w " ..."
# u: demo_service@idm.example.com
< / code > < / pre >
2022-04-27 13:22:11 +02:00
< h2 id = "example" > < a class = "header" href = "#example" > Example< / a > < / h2 >
2022-08-08 03:34:08 +02:00
< p > Given a default install with domain " example.com" the configured LDAP DN will be " dc=example,dc=com" .< / p >
2022-12-04 23:16:42 +01:00
< pre > < code > # from server.toml
ldapbindaddress = " [::]:3636"
2022-08-08 03:34:08 +02:00
< / code > < / pre >
< p > This can be queried with:< / p >
< pre > < code > LDAPTLS_CACERT=ca.pem ldapsearch \
-H ldaps://127.0.0.1:3636 \
-b 'dc=example,dc=com' \
-x '(name=test1)'
2022-04-27 13:22:11 +02:00
# test1@example.com, example.com
dn: spn=test1@example.com,dc=example,dc=com
objectclass: account
objectclass: memberof
objectclass: object
objectclass: person
displayname: Test User
memberof: spn=group240@example.com,dc=example,dc=com
name: test1
spn: test1@example.com
entryuuid: 22a65b6c-80c8-4e1a-9b76-3f3afdff8400
< / code > < / pre >
2022-08-08 03:34:08 +02:00
< p > It is recommended that client applications filter accounts that can login with < code > (class=account)< / code >
and groups with < code > (class=group)< / code > . If possible, group membership is defined in RFC2307bis or
2022-12-04 23:16:42 +01:00
Active Directory style. This means groups are determined from the " memberof" attribute which
2022-08-08 03:34:08 +02:00
contains a DN to a group.< / p >
2022-06-02 03:20:33 +02:00
< p > LDAP binds can use any unique identifier of the account. The following are all valid bind DNs for
the object listed above (if it was a POSIX account, that is).< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > ldapwhoami ... -x -D 'name=test1'
ldapwhoami ... -x -D 'spn=test1@example.com'
ldapwhoami ... -x -D 'test1@example.com'
ldapwhoami ... -x -D 'test1'
ldapwhoami ... -x -D '22a65b6c-80c8-4e1a-9b76-3f3afdff8400'
ldapwhoami ... -x -D 'spn=test1@example.com,dc=example,dc=com'
ldapwhoami ... -x -D 'name=test1,dc=example,dc=com'
< / code > < / pre >
2022-12-04 23:16:42 +01:00
< p > Most LDAP clients are very picky about TLS, and can be very hard to debug or display errors.
2022-08-08 03:34:08 +02:00
For example these commands:< / p >
2022-04-27 13:22:11 +02:00
< pre > < code > ldapsearch -H ldaps://127.0.0.1:3636 -b 'dc=example,dc=com' -x '(name=test1)'
ldapsearch -H ldap://127.0.0.1:3636 -b 'dc=example,dc=com' -x '(name=test1)'
ldapsearch -H ldap://127.0.0.1:3389 -b 'dc=example,dc=com' -x '(name=test1)'
< / code > < / pre >
< p > All give the same error:< / p >
< pre > < code > ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
< / code > < / pre >
< p > This is despite the fact:< / p >
< ul >
2022-06-02 03:20:33 +02:00
< li > The first command is a certificate validation error.< / li >
< li > The second is a missing LDAPS on a TLS port.< / li >
< li > The third is an incorrect port.< / li >
2022-04-27 13:22:11 +02:00
< / ul >
< p > To diagnose errors like this, you may need to add " -d 1" to your LDAP commands or client.< / p >
< / main >
< nav class = "nav-wrapper" aria-label = "Page navigation" >
<!-- Mobile navigation buttons -->
2022-06-05 07:20:33 +02:00
< a rel = "prev" href = "../integrations/radius.html" class = "mobile-nav-chapters previous" title = "Previous chapter" aria-label = "Previous chapter" aria-keyshortcuts = "Left" >
2022-04-27 13:22:11 +02:00
< i class = "fa fa-angle-left" > < / i >
< / a >
2022-12-15 07:26:33 +01:00
2022-11-23 14:53:51 +01:00
< a rel = "next" href = "../examples/k8s_ingress_example.html" class = "mobile-nav-chapters next" title = "Next chapter" aria-label = "Next chapter" aria-keyshortcuts = "Right" >
2022-06-06 01:23:06 +02:00
< i class = "fa fa-angle-right" > < / i >
< / a >
2022-12-15 07:26:33 +01:00
2022-04-27 13:22:11 +02:00
< div style = "clear: both" > < / div >
< / nav >
< / div >
< / div >
< nav class = "nav-wide-wrapper" aria-label = "Page navigation" >
2022-06-05 07:20:33 +02:00
< a rel = "prev" href = "../integrations/radius.html" class = "nav-chapters previous" title = "Previous chapter" aria-label = "Previous chapter" aria-keyshortcuts = "Left" >
2022-04-27 13:22:11 +02:00
< i class = "fa fa-angle-left" > < / i >
< / a >
2022-12-15 07:26:33 +01:00
2022-11-23 14:53:51 +01:00
< a rel = "next" href = "../examples/k8s_ingress_example.html" class = "nav-chapters next" title = "Next chapter" aria-label = "Next chapter" aria-keyshortcuts = "Right" >
2022-06-06 01:23:06 +02:00
< i class = "fa fa-angle-right" > < / i >
< / a >
2022-04-27 13:22:11 +02:00
< / nav >
< / div >
2022-12-15 07:26:33 +01:00
2022-12-04 23:16:42 +01:00
< script >
2022-04-27 13:22:11 +02:00
window.playground_copyable = true;
< / script >
2022-12-15 07:26:33 +01:00
2022-12-04 23:16:42 +01:00
< script src = "../elasticlunr.min.js" > < / script >
< script src = "../mark.min.js" > < / script >
< script src = "../searcher.js" > < / script >
2022-12-15 07:26:33 +01:00
2022-12-04 23:16:42 +01:00
< script src = "../clipboard.min.js" > < / script >
< script src = "../highlight.js" > < / script >
< script src = "../book.js" > < / script >
2022-04-27 13:22:11 +02:00
<!-- Custom JS scripts -->
2022-12-15 07:26:33 +01:00
2022-04-27 13:22:11 +02:00
< / body >
< / html >
