|
----- Original Message -----
From: Michael Audet
To: Michael Audet
Sent: Friday, February 23, 2001 2:22 PM
Subject: Re: (RADIATOR) Windows 2000 ADSI Authorization Update:
Well.. I fixed my Authentication problem with
Windows 2000.
It would help if the secret key I was using for
testing matched that of the RadPwTst utility. *duh*
I also had to change the domain policy to stop
Password History from occuring. This way a user can change
their password to itself for the authorization to
occur. This should be noted in the FAQ or <AuthADSI>
documentation.
----
Just a quick thought on the ADSI authentication
process.
Why have the user change their password to prove
authentication when I believe you can prove a user is really him or her during
the ADSI OpenDsObject process. Let me quote the MS
documentation:
>>>
Authentication
In ADSI, credentials consisting of a user name and password allow system software to authenticate the identity of a user during the initial system login. Use IADsOpenDSObject::OpenDSObject or the helper function ADsOpenObject to establish a user's credentials for a directory service. If you don't use OpenDSObject, ADSI uses default credentials. Once the system authenticates the user, the user is free to make requests for system resources, access to file shares, and file permissions, as supported by the underlying directory service's security requirements. The following examples show the use of the OpenDSobject method on different directory services: Dim MyNamespace As IADsOpenDSObject
Set MyNamespace = GetObject("LDAP:")
Set X = MyNamespace.OpenDSObject(DN, UserName, Password, Flags)
Reference this MS document:
According to this document you should be able
to use the Users Name and Password in the AuthADSI.pm file OpenDsObject.
If you do not get the error message of "Could not get user object" then the
given user name and password matches that of the user you are requesting
authorization on. I believe a user can look at his or her own logon hours
and attributes....*But...I may be wrong*.
So by replacing the " $self->{Password}," code
with "$password" and changing code after that... you should be able
to skip the whole "ChangePassword" routine. If this actually works it
could speed up authorization.
my $ouser =
$ons->OpenDSObject($bindstring,
$self->{Username},
$self->{Password},
#Change this to $password ???
1); #
ADS_SECURE_AUTHENTICATION
if (!$ouser)
{
$self->log($main::LOG_DEBUG, "Could not
get user object: " . Win32::OLE->LastError());
return ($main::REJECT, 'Could not find
user');
}
Anyway...
Back to working on my Radius
:)
-Michael Audet
Network Services
Chubb & Son
[EMAIL PROTECTED]
|
- (RADIATOR) Windows 2000 ADSI Authorization Michael Audet
- Michael Audet
