Marc, what is the sn,givenName,memberOf,cn? Rather what is the
principalAttributeList?
For your bindDN and bindCredentials, are you using an authenticating admin
account or the user who's trying to get in?
On Tuesday, February 27, 2018 at 7:54:08 AM UTC-6, Marc Dufour wrote:
>
>
> Kevin, here are the properties that are working for me.
>
> cas.authn.ldap[0].order=0
> cas.authn.ldap[0].name=AD
> cas.authn.ldap[0].type=AUTHENTICATED
> cas.authn.ldap[0].ldapUrl=ldaps://servername:3269
> cas.authn.ldap[0].useSsl=true
> cas.authn.ldap[0].connectTimeout=5000
> cas.authn.ldap[0].baseDn=dc=DOMAIN,dc=TLD
> cas.authn.ldap[0].userFilter=(userPrincipalName={user})
> cas.authn.ldap[0].subtreeSearch=true
> cas.authn.ldap[0].principalAttributeList=sn,givenName,memberOf,cn
> cas.authn.ldap[0].bindDn=DN of user
> cas.authn.ldap[0].bindCredential=Password
>
> Le lundi 26 février 2018 17:41:37 UTC-5, Kevin Liu a écrit :
>>
>> So I've included an extra ldap index to get around multiple OUs. I can
>> now authenticate users but only with their full name and not their
>> sAMAccountName. For example, on the cas login screen, if I put my
>> sAMAccountName kliu as the username and the associated password, I get
>> denied but if I put Kevin Liu I can login. It doesn't seem like
>> userFilter=sAMAccountName={name} get used as my sAMAccountName is kliu.
>> Maybe I don't understand userFilter completely.
>>
>> Marc, what other properties did you have to add to cas.properties. Your
>> situation sounds very similar to mine.
>>
>> <SNIP>
>>
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/96a5b350-e4a7-488c-9973-9511679b55ab%40apereo.org.
