Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of covener@gmail.com designates
 66.249.92.173 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references;
        b=pu0g+87OYKb6/u6+IbF4gKXtKFL5xnHCpdAmONg0WTfrhUzuZhfmnU/G0HKxoH5BiQ
         oJLub3F7T0eMc7wTQkbxEJ4gpKDAswQ1sDFYszj3T9Ysd0+H4UyjmAcUyH+j2oemX2pO
         uDCHhoYd0XZQcwoT6v5rhRsPfaby5qiHgCC74=
Message-ID: <1404e5910810211309j14250a88w4ec9d62024fa3e01@mail.gmail.com>
Date: Tue, 21 Oct 2008 16:09:58 -0400
From: "Eric Covener" <covener@gmail.com>
To: users@httpd.apache.org
In-Reply-To: <48FE14B6.2000608@ice-sa.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
References: <a548f35b0810210959x587b7e38wcb00e5fda2a7338c@mail.gmail.com>
	 <1404e5910810211027l1f01cd5hd5f86804b989ff47@mail.gmail.com>
	 <48FE14B6.2000608@ice-sa.com>
Subject: Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server

On Tue, Oct 21, 2008 at 1:43 PM, Andr=E9 Warnier <aw@ice-sa.com> wrote:
> Eric Covener wrote:
>>
>> On port 389, MSAD might send you on a lengthy wild goose-chase of LDAP
>> referrals.
>>
> Eric, can you elaborate a bit on that, or direct me/us to some additional
> information ?
> This is not directly related to the OP's issue, but I'm doing a lot of AA=
A
> related stuff these days, and like to learn these things.


LDAP has a notion of referrals, like HTTP redirects.  When you have a
complicated AD domain, you might talk to what you think of as the
master AD server, but it may send you to go ask other servers (dept.
x, dept y,  AD servers from some remote site, recent acquisitions,
etc).  I don't know if it is misconfiguration, but I've seen some
where conceptually none of the referrals seem to be needed based on
the user you're looking up (and may take you across some slow links)

When you use that high port, you're talking to the "global catalog"
where all info across the "forest" is aggregated on one LDAP server
and you just get a regular/direct result if you query or try to login.
If you use unusual data for authz, i believe you have to tell it what

MS also has a tool called ADAM (AD Application Mode) that frontends AD
for traditional LDAP applications:
http://www.microsoft.com/windowsserver2003/adam/default.mspx


--=20
Eric Covener
covener@gmail.com

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org