I only need these attributes, so I limit the size of what it returned.
As for the bindDN, it is a regular Domain user, not an admin. It should
only need read access to Active Directory.
Le mardi 27 février 2018 10:52:52 UTC-5, Kevin Liu a écrit :
>
> Marc, what is the sn,givenName,memberOf,cn? Rather what is the
> principalAttributeList?
> For your bindDN and bindCredentials, are you using an authenticating admin
> account or the user who's trying to get in?
>
> On Tuesday, February 27, 2018 at 7:54:08 AM UTC-6, Marc Dufour wrote:
>>
>>
>> Kevin, here are the properties that are working for me.
>>
>> cas.authn.ldap[0].order=0
>> cas.authn.ldap[0].name=AD
>> cas.authn.ldap[0].type=AUTHENTICATED
>> cas.authn.ldap[0].ldapUrl=ldaps://servername:3269
>> cas.authn.ldap[0].useSsl=true
>> cas.authn.ldap[0].connectTimeout=5000
>> cas.authn.ldap[0].baseDn=dc=DOMAIN,dc=TLD
>> cas.authn.ldap[0].userFilter=(userPrincipalName={user})
>> cas.authn.ldap[0].subtreeSearch=true
>> cas.authn.ldap[0].principalAttributeList=sn,givenName,memberOf,cn
>> cas.authn.ldap[0].bindDn=DN of user
>> cas.authn.ldap[0].bindCredential=Password
>>
>> Le lundi 26 février 2018 17:41:37 UTC-5, Kevin Liu a écrit :
>>>
>>> So I've included an extra ldap index to get around multiple OUs. I can
>>> now authenticate users but only with their full name and not their
>>> sAMAccountName. For example, on the cas login screen, if I put my
>>> sAMAccountName kliu as the username and the associated password, I get
>>> denied but if I put Kevin Liu I can login. It doesn't seem like
>>> userFilter=sAMAccountName={name} get used as my sAMAccountName is kliu.
>>> Maybe I don't understand userFilter completely.
>>>
>>> Marc, what other properties did you have to add to cas.properties. Your
>>> situation sounds very similar to mine.
>>>
>>> <SNIP>
>>>
>>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/d8a96be7-ab97-4eb4-80fe-6caeeee8d6cf%40apereo.org.
