Re: How to bind to AD?

--f46d041825709e95840518606823
Content-Type: text/plain; charset=UTF-8

hi,

On Thu, Jun 11, 2015 at 11:45 PM, David Lee Lambert <[email protected]>
wrote:

> I know this question has been asked before, but maybe the
> answers were in response to differnt details...
>
> I'm trying to write a script that compares data in an Oracle
> database with Active Directory.  So, it seems like I should be
> able to use DBD::Oracle and Net::LDAP, but I can't seem to get
> bind() to work.
>
> I've reduced my non-working code to the following...
>
> #! perl -w
>
> use Net::LDAP;
> my $ad = Net::LDAP->new('ad.**org**.com', debug => 2)
>   or die "Couldn't connect to AD: $@, $!";
> $ad->bind('**tried lots of stuff**', password => '**password**')
>   or die "Couldn't bind: $@, $!";
>
> my $results = $ad->search(
>        filter => '(&(objectClass=user)(sAMAccountName=**userid**))');
> die $results->error if $results->code;
> my $count = $results->count;
> print $count;
>
> Whatever I do, I get an error like this...
>
> 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this
> operation a
> successful bind must be completed on the connection., data 0, v1db1  at
> searchde
> mo_1.pl line 13, <DATA> line 755.
>
> So, my first question is, why does the bind() not return an error
> if it didn't succeed for the purposes of a successful operation?
>
> Second, how do I figure out what to use as the first argument
> to bind()? I built a small C# program that looks up my LDAP
> record and prints it out, and I can see that my CN has a comma
> in it (it's in the form "Last, First M"), and I'm below two
> OUs and three DCs (DC=ad,DC=**org**,DC=com)... do I have to write
> that whole path as the bind DN?
>
>
not necessarily. You can bind using your dn, your upn or your
netbios\samaccountname.

this is how we bind to our AD (we use tls, you can skip the start_tls step
first to test it's working without). In this case I use a upn and bind to
the global catalog port which should be faster than the normal ldap port.

my $ldapprod = Net::LDAP->new('dc01.domain.tldl')     || die "$@";

my $msg_prod = $ldapprod->start_tls(
    verify     => 'require',
    sslversion => 'tlsv1',
    port       => '3268',
);

$msg_prod = $ldapprod->bind(
    "testuser\@domain.tld",
    password => 'pwd',
    version  => 3,
);

Basically the same stuff in the synopsis for Net::LDAP in
http://search.cpan.org/~marschap/perl-ldap/lib/Net/LDAP.pod or using
perldoc Net::LDAP.

--
Groeten,
natxo

--f46d041825709e95840518606823
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">hi,<br><div class=3D"gmail_extra"><br><div class=3D"gmail_=
quote">On Thu, Jun 11, 2015 at 11:45 PM, David Lee Lambert <span dir=3D"ltr=
">&lt;<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]=
m</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margi=
n:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex=
">I know this question has been asked before, but maybe the<br>
answers were in response to differnt details...<br>
<br>
I&#39;m trying to write a script that compares data in an Oracle<br>
database with Active Directory.=C2=A0 So, it seems like I should be<br>
able to use DBD::Oracle and Net::LDAP, but I can&#39;t seem to get<br>
bind() to work.<br>
<br>
I&#39;ve reduced my non-working code to the following...<br>
<br>
#! perl -w<br>
<br>
use Net::LDAP;<br>
my $ad =3D Net::LDAP-&gt;new(&#39;ad.**org**.com&#39;, debug =3D&gt; 2)<br>
=C2=A0 or die &quot;Couldn&#39;t connect to AD: $@, $!&quot;;<br>
$ad-&gt;bind(&#39;**tried lots of stuff**&#39;, password =3D&gt; &#39;**pas=
sword**&#39;)<br>
=C2=A0 or die &quot;Couldn&#39;t bind: $@, $!&quot;;<br>
<br>
my $results =3D $ad-&gt;search(<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0filter =3D&gt; &#39;(&amp;(objectClass=3Duser)(s=
AMAccountName=3D**userid**))&#39;);<br>
die $results-&gt;error if $results-&gt;code;<br>
my $count =3D $results-&gt;count;<br>
print $count;<br>
<br>
Whatever I do, I get an error like this...<br>
<br>
000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operati=
on a<br>
successful bind must be completed on the connection., data 0, v1db1=C2=A0 a=
t searchde<br>
<a href=3D"http://mo_1.pl" rel=3D"noreferrer" target=3D"_blank">mo_1.pl</a>=
 line 13, &lt;DATA&gt; line 755.<br>
<br>
So, my first question is, why does the bind() not return an error<br>
if it didn&#39;t succeed for the purposes of a successful operation?<br>
<br>
Second, how do I figure out what to use as the first argument<br>
to bind()? I built a small C# program that looks up my LDAP<br>
record and prints it out, and I can see that my CN has a comma<br>
in it (it&#39;s in the form &quot;Last, First M&quot;), and I&#39;m below t=
wo<br>
OUs and three DCs (DC=3Dad,DC=3D**org**,DC=3Dcom)... do I have to write<br>
that whole path as the bind DN?<br>
<br></blockquote><div><br></div><div>not necessarily. You can bind using yo=
ur dn, your upn or your netbios\samaccountname. <br><br></div><div>this is =
how we bind to our AD (we use tls, you can skip the start_tls step first to=
 test it&#39;s working without). In this case I use a upn and bind to the g=
lobal catalog port which should be faster than the normal ldap port.<br><br=
>my $ldapprod =3D Net::LDAP-&gt;new(&#39;dc01.domain.tldl&#39;)=C2=A0=C2=A0=
=C2=A0=C2=A0 || die &quot;$@&quot;;<br><br>my $msg_prod =3D $ldapprod-&gt;s=
tart_tls(<br>=C2=A0=C2=A0=C2=A0 verify=C2=A0=C2=A0=C2=A0=C2=A0 =3D&gt; &#39=
;require&#39;,<br>=C2=A0=C2=A0=C2=A0 sslversion =3D&gt; &#39;tlsv1&#39;,<br=
>=C2=A0=C2=A0=C2=A0 port=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =3D&gt; &#39;3=
268&#39;,<br>);<br><br>$msg_prod =3D $ldapprod-&gt;bind(<br>=C2=A0=C2=A0=C2=
=A0 &quot;testuser\@domain.tld&quot;,<br>=C2=A0=C2=A0=C2=A0 password =3D&gt=
; &#39;pwd&#39;,<br>=C2=A0=C2=A0=C2=A0 version=C2=A0 =3D&gt; 3,<br>);<br></=
div></div><br></div><div class=3D"gmail_extra">Basically the same stuff in =
the synopsis for Net::LDAP in <a href=3D"http://search.cpan.org/~marschap/p=
erl-ldap/lib/Net/LDAP.pod">http://search.cpan.org/~marschap/perl-ldap/lib/N=
et/LDAP.pod</a> or using perldoc Net::LDAP.<br><br>--<br><div class=3D"gmai=
l_signature">Groeten,<br>natxo</div>
</div></div>

--f46d041825709e95840518606823--