Gotcha! Still a little confused about the principal attributes. Could you give a brief summary of how it works? What is a sn? And how the parsing works? Thanks Sent from my iPhone
> On Feb 27, 2018, at 11:57 AM, Marc Dufour <[email protected]> wrote: > > I only need these attributes, so I limit the size of what it returned. > > As for the bindDN, it is a regular Domain user, not an admin. It should only > need read access to Active Directory. > > > Le mardi 27 février 2018 10:52:52 UTC-5, Kevin Liu a écrit : >> >> Marc, what is the sn,givenName,memberOf,cn? Rather what is the >> principalAttributeList? >> For your bindDN and bindCredentials, are you using an authenticating admin >> account or the user who's trying to get in? >> >>> On Tuesday, February 27, 2018 at 7:54:08 AM UTC-6, Marc Dufour wrote: >>> >>> Kevin, here are the properties that are working for me. >>> >>> cas.authn.ldap[0].order=0 >>> cas.authn.ldap[0].name=AD >>> cas.authn.ldap[0].type=AUTHENTICATED >>> cas.authn.ldap[0].ldapUrl=ldaps://servername:3269 >>> cas.authn.ldap[0].useSsl=true >>> cas.authn.ldap[0].connectTimeout=5000 >>> cas.authn.ldap[0].baseDn=dc=DOMAIN,dc=TLD >>> cas.authn.ldap[0].userFilter=(userPrincipalName={user}) >>> cas.authn.ldap[0].subtreeSearch=true >>> cas.authn.ldap[0].principalAttributeList=sn,givenName,memberOf,cn >>> cas.authn.ldap[0].bindDn=DN of user >>> cas.authn.ldap[0].bindCredential=Password >>> >>> Le lundi 26 février 2018 17:41:37 UTC-5, Kevin Liu a écrit : >>>> >>>> So I've included an extra ldap index to get around multiple OUs. I can now >>>> authenticate users but only with their full name and not their >>>> sAMAccountName. For example, on the cas login screen, if I put my >>>> sAMAccountName kliu as the username and the associated password, I get >>>> denied but if I put Kevin Liu I can login. It doesn't seem like >>>> userFilter=sAMAccountName={name} get used as my sAMAccountName is kliu. >>>> Maybe I don't understand userFilter completely. >>>> >>>> Marc, what other properties did you have to add to cas.properties. Your >>>> situation sounds very similar to mine. >>>> >>>> <SNIP> > > -- > - Website: https://apereo.github.io/cas > - Gitter Chatroom: https://gitter.im/apereo/cas > - List Guidelines: https://goo.gl/1VRrw7 > - Contributions: https://goo.gl/mh7qDG > --- > You received this message because you are subscribed to a topic in the Google > Groups "CAS Community" group. > To unsubscribe from this topic, visit > https://groups.google.com/a/apereo.org/d/topic/cas-user/Rtej6h-Bky0/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > [email protected]. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/d8a96be7-ab97-4eb4-80fe-6caeeee8d6cf%40apereo.org. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/58D27A1E-2508-4565-9D7D-738433F78F86%40gmail.com.
