Binding to Active Directory with Perl where the OU is variable

Question

I have a piece of legacy code on a internal app that needs to be revised. Before I redo the whole thing is there an easy way to accomplish binding to AD where the OU can vary depending on the user who is authenticating. The setup is pretty standard:

my($mesg) = $ldap->bind ("cn=$uid,ou=Workers,ou=Domain Users,dc=something,dc=com", password => "$psswd");

Not all users are the "Workers" OU. Some are in a different OU... Basically what I am wondering is if there is a "if-then-else" routine for binding to AD from perl. I would prefer not to setup a third party account for the purpose of searching for this if it can be avoided... But almost all the documentation I had read seems to point to this method of login. Any ideas or suggestions?

What's the actual problem here? Your code already shows a variable $uid, what's the problem with having a variable $ou? — user207421
– user207421, Commented Apr 24, 2012 at 8:44
Since the users that are authenticating might be in different OUs. I would need to have them specify what OU they are in so they could authenticate. That's an extra step I don't want to have them take. — oljones
– oljones, Commented Apr 25, 2012 at 12:19
So in other words you don't want a 'variable OU' at all, you want to filter against a number of possible OUs, or possibly against all available OUs? — user207421
– user207421, Commented Apr 25, 2012 at 12:42
That is correct. Maybe the choice of words was not the best. It would be optimal if there was a way to bind to AD without needing to specify the OU... or attempt to bind against all possible OUs. This legacy script was never written for AD, but has since been converted to use it. That is probably part of the problem. — oljones
– oljones, Commented Apr 25, 2012 at 12:57

Brian Desmond · Accepted Answer · 2012-04-23 20:47:47Z

1

You don't need to specify the full DN to AD. The username should be sufficient.

answered Apr 23, 2012 at 20:47

Brian Desmond

4,5131 gold badge15 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

oljones Over a year ago

Changed it to ($uid, password => $psswd). Getting error "Died because LDAP_INVALID_CREDENTIALS:The wrong password was supplied or the SASL credentials could not be processed" Triple checked the password. Doesn't appear to be working. Is that specific to LDAP or any AD bind in general?

Brian Desmond Over a year ago

This is a Windows thing. You can use ldp.exe from the Windows RSAT / support tools to validate the bind. You might need to prefix with <domain>\ to make it work.

oljones Over a year ago

I have tried it as 'something.com\\$uid' and '$uid\@something.com'. Both to no avail. Thanks for the suggestion though.

Terry Gardner · Accepted Answer · 2012-04-24 08:58:42Z

1

This is known as a "simple" bind request, which takes as parameters a distinguished name and the credentials for the distinguished name. Zero or more request controls can be included with the bind request. Construct a variable called $distinguishedName before the bind request is transmitted, transmit the bind request, process the response, and process any response controls included with the response:

my $namingContext = "ou=domain users,dc=something,dc=com";
my $distinguishedName = sprintf "%s,%s,%s",$cn,$ou,$namingContext;
my $bindResult = $ldap->bind($distinguishedName,$credentials);
# handle any response controls attached to the bind response ...

answered Apr 24, 2012 at 8:58

Terry Gardner

11.2k2 gold badges31 silver badges38 bronze badges

2 Comments

oljones Over a year ago

Thanks for the suggestion. With this method, is it possible to change the OU and attempt to bind again if the first bind result is invalid?

Terry Gardner Over a year ago

Yes. A connection is unauthenticated until the authentication state is set by a successful bind request. If the LDAP client is using LDAPv3, the connection authentication state is changed by each successive successful bind request, subject to any limitations set by the server. If the LDAP client requires information about the authentication state of the connection, the Who Am I? extended operation can be used to discover the authentication state, assuming that the server supports the extended operation and authorizes its use.

Collectives™ on Stack Overflow

Binding to Active Directory with Perl where the OU is variable

2 Answers 2

3 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related