Antony c: first post

2019-11-12T16:31:55Z

first post

New page

When using SSSD to authenticate against AD with "ldap_id_mapping = False" a user must have ALL posix attributes to be able to login

when customers tell you that it is done for all users and another user works and one doesn't and you need the smoking gun . . . here is how you find it:

ldapsearch -x -W -D 'zSvcJoinDomainLinux@INT.CORP.GEL.AC' -b 'dc=corp,dc=gel,dc=ac' -H ldap://10.105.15.20 -s sub "(CN=Donald Trumper)"

this is an example from GEL (with name changed so as not to violate GDPR):

* -D is the user to bind to LDAP as in this case the user they gave us to join nodes to this domain
* -b is the bind dn for the domain in this case we know the user should be in the CORP.GEL.AC domain
* -H ldap://10.105.15.20 is one of the AD servers we are joined to
* -s sub "(CN=Donald Trumper)" is the specific user we are looking for and when we look we see that he doesn't have a gidNumber so won't be allowed in

[root@p2postlog0002 ~]# ldapsearch -x -W -D 'zSvcJoinDomainLinux@INT.CORP.GEL.AC' -b 'dc=corp,dc=gel,dc=ac' -H ldap://10.105.15.20 -s sub "(CN=Donald Trumper)"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=corp,dc=gel,dc=ac> with scope subtree
# filter: (CN=Donald Trumper)
# requesting: ALL
#

# Donald Trumper, GEL, Users, GEL, corp.gel.ac
dn: CN=Donald Trumper,OU=GEL,OU=Users,OU=GEL,DC=corp,DC=gel,DC=ac
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Donald Trumper
sn: Trumper
title: Commercial Proposition and Product Manager
description: Permanent
physicalDeliveryOfficeName: Dawson Hall
givenName: Donald
distinguishedName: CN=Donald Trumper,OU=GEL,OU=Users,OU=GEL,DC=corp,DC=gel,DC
=ac
instanceType: 4
whenCreated: 20190716101933.0Z
whenChanged: 20191112083729.0Z
displayName: Donald Trumper
uSNCreated: 139477
memberOf: CN=O365-SelfService-PasswordReset,OU=Applications,OU=Groups,OU=GEL,D
C=corp,DC=gel,DC=ac
uSNChanged: 829130
department: Commercial
proxyAddresses: SMTP:Donald.Trumper@genomicsengland.co.uk
proxyAddresses: smtp:Donald.Trumper@genomicsenglandltd.mail.onmicrosoft.com
proxyAddresses: x500:/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOH
F23SPDLT)/cn=Recipients/cn=c8aab061b3894a979b1f3f1959697821-Donald Nanki
name: Donald Trumper
objectGUID:: FWMDEkpkwk6jL6h4s1itQw==
userAccountControl: 66048
badPwdCount: 0
codePage: 0
countryCode: 0
pwdLastSet: 132180206048436784
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAz0olKw83ALo6csJV3AQAAA==
accountExpires: 9223372036854775807
sAMAccountName: Donald.Trumper
sAMAccountType: 805306368
showInAddressBook: CN=All Recipients(VLV),CN=All System Address Lists,CN=Addre
ss Lists Container,CN=Genomics,CN=Microsoft Exchange,CN=Services,CN=Configura
tion,DC=corp,DC=gel,DC=ac
showInAddressBook: CN=Default Global Address List,CN=All Global Address Lists,
CN=Address Lists Container,CN=Genomics,CN=Microsoft Exchange,CN=Services,CN=C
onfiguration,DC=corp,DC=gel,DC=ac
showInAddressBook: CN=All Users,CN=All Address Lists,CN=Address Lists Containe
r,CN=Genomics,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=corp,DC=g
el,DC=ac
legacyExchangeDN: /o=Genomics/ou=Exchange Administrative Group (FYDIBOHF23SPDL
T)/cn=Recipients/cn=68ff8beeb37d4296a3bc8fc6cb40bb2c-Donald Trumper
userPrincipalName: Donald.Trumper@genomicsengland.co.uk
lockoutTime: 0
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=gel,DC=ac
dSCorePropagationData: 20190903120415.0Z
dSCorePropagationData: 16010101000001.0Z
mS-DS-ConsistencyGuid:: FWMDEkpkwk6jL6h4s1itQw==
msDS-SupportedEncryptionTypes: 0
msDS-ExternalDirectoryObjectId: User_a15bc18c-a3cd-4c3e-8118-7ffeefb42225
mail: Donald.Trumper@genomicsengland.co.uk
manager: CN=Carl Smith,OU=GEL,OU=Users,OU=GEL,DC=corp,DC=gel,DC=ac
uidNumber: 32613
msExchVersion: 88218628259840
msExchPoliciesIncluded: 316e658b-7875-40fb-a467-5a28d79efd21
msExchPoliciesIncluded: {26491cfc-9e50-4857-861b-0cb8df22b5d7}
targetAddress: SMTP:Donald.Trumper@genomicsenglandltd.mail.onmicrosoft.com
msExchUMDtmfMap: emailAddress:37265626548355
msExchUMDtmfMap: lastNameFirstName:62654835537265
msExchUMDtmfMap: firstNameLastName:37265626548355
msExchRecipientDisplayType: -2147483642
mailNickname: Donald.Trumper
msExchMailboxGuid:: KwBgAAPE2UabehM5pv31gg==
msExchBlockedSendersHash:: JCe8iw==
msExchRemoteRecipientType: 1
msExchRecipientTypeDetails: 2147483648

# search reference
ref: ldap://int.corp.gel.ac/DC=int,DC=corp,DC=gel,DC=ac

# search reference
ref: ldap://DomainDnsZones.corp.gel.ac/DC=DomainDnsZones,DC=corp,DC=gel,DC=ac

# search reference
ref: ldap://ForestDnsZones.corp.gel.ac/DC=ForestDnsZones,DC=corp,DC=gel,DC=ac

# search reference
ref: ldap://corp.gel.ac/CN=Configuration,DC=corp,DC=gel,DC=ac

# search result
search: 2
result: 0 Success

# numResponses: 6
# numEntries: 1
# numReferences: 4
[root@p2postlog0002 ~]#

Linux: using ldapsearch to debug Active Directory - Revision history

Antony c: first post