topic Re: Alternative to sAMAccountname ,when using Ldap for Authentication in General Topics

Alternative to sAMAccountname ,when using Ldap for Authentication

Retired Member — Thu, 08 Nov 2012 19:11:59 GMT

Hi,

When we use to authenticate users through AD, we configure LDAP profile and in Authentication profile tab.

We write "sAMAccountname" for attribute at this window.We want to change this attribute and we want users not to log in with just username; We want them to log in with username@domain or domain\username so What attribute should we use ? I tried userPrincipalName but it did not work.Thanks

Re: Alternative to sAMAccountname ,when using Ldap for Authentication

essnet — Thu, 08 Nov 2012 19:16:41 GMT

You got to keep sAMAccountname but if you have multiple domains, you will need to configure several LDAP servers (one for each domain) or use a Global one if you infrastructure allows it.

Re: Alternative to sAMAccountname ,when using Ldap for Authentication

Retired Member — Thu, 08 Nov 2012 19:21:48 GMT

we have configured Ldap for each domain.We have 3 domains, 3Ldap profiles.But there are some people with the same name on different domains so

dc1 username: u1

dc2 username: u1

when u1 tries to log in , authentication sequence cannot understand which u1 is he/she user should log in with domain name credential but how ?

Re: Alternative to sAMAccountname ,when using Ldap for Authentication

essnet — Thu, 08 Nov 2012 19:23:36 GMT

did you create an authentication Sequence with Profile 1, Profile 2 and Profile 3 ?

Re: Alternative to sAMAccountname ,when using Ldap for Authentication

Retired Member — Thu, 08 Nov 2012 19:26:15 GMT

yes as you said we created.But when it looks the first match of username it doesn't look the other so it cannot understand the person is on 2nd or 3rd.(with that config it is impossible)

Re: Alternative to sAMAccountname ,when using Ldap for Authentication

essnet — Thu, 08 Nov 2012 19:29:08 GMT

hmm I have a slighlty different experience : over here it tests my 4 authentication servers one after the other until it matches

Re: Alternative to sAMAccountname ,when using Ldap for Authentication

essnet — Thu, 08 Nov 2012 19:31:00 GMT

I see the difference with your setup : I use Kerberos, not LDAP.

I use LDAP for Group extraction only. Authentication is done with Kerberos

Re: Alternative to sAMAccountname ,when using Ldap for Authentication

Retired Member — Thu, 08 Nov 2012 19:31:01 GMT

you also have users with the same name because otherwise no problem occurs.

Re: Alternative to sAMAccountname ,when using Ldap for Authentication

Retired Member — Thu, 08 Nov 2012 19:32:50 GMT

hmm.I see.maybe we should change auth method also

Re: Alternative to sAMAccountname ,when using Ldap for Authentication

essnet — Thu, 08 Nov 2012 19:34:56 GMT

I do have users with same name, no problem so far. But there is a small probabilty that not all of them are using my captive portal ....

Re: Alternative to sAMAccountname ,when using Ldap for Authentication

Retired Member — Thu, 08 Nov 2012 19:55:52 GMT

I understand.Thanks very much for help.I opened a case let me look what support will do and I'll write if there is any option to solve it.