i am currently setting up a PBX System at my work. I´m having trouble figurung out how to connect to the Exchange LDAP Server. To be more specific, how do find out what the LDAP base directory is?
I have to enter something like o=foo,...
I think I saw a command once to run on the Server running Exchange which would show me the base directory and all the other Organizational Units present on the Exchange server.
thx for your help.
The RootDSE has some information about what available contexts are. A tool like LBE - LDAP Browse/Edit will automatically query and show you the available base DN's.
Is it an Exchange LDAP server, or AD LDAP server? Likely the base DN is dc=domain, dc=com (replace those with the real domains).
You connect to the Exchange LDAP server by using ADSI (Active Directory Service Interfaces). See the documentation here: http://msdn.microsoft.com/en-us/library/aa772218%28v=VS.85%29.aspx
Your starting point, to get interrogate the base directory would be the RootDSE. See here: http://msdn.microsoft.com/en-us/library/ms676736%28v=VS.85%29.aspx
Related
I have created a Google Cloud Project MySQL database to use in conjunction with the Jdbc service provided by Google Apps Script. Everything went as planned with the connection. I am basically connecting as it does in the docs.
var conn = Jdbc.getCloudSqlConnection(dbUrl, user, userPwd);
I shared the file with another account and all of a sudden I am seeing a red error saying:
'Failed to establish a database connection. Check connection string, username and password.'
Nothing changed in the code, but there is an error. When I go back to my original account and run the same bit of code, there is no error. What is happening here? Any ideas?
Jdbc.getConnection works from both: my account and another account:
var conn = Jdbc.getConnection('jdbc:mysql://' + IP + ':3306/' + database_name, user, password)
I'm really confused because the recommended method did not work.
There are two ways of establishing a connection with a Google Cloud
SQL database using Apps Script's JDBC service:
(Recommended) Connecting using Jdbc.getCloudSqlConnection(url)
Connecting using Jdbc.getConnection(url)
Notes:
IP is a Public IP address from the OVERVIEW tab in your database console:
I've allowed any host when created a user:
I am not sure whether this question has been resolved or not, but let me add this answer.
I also faced the same problem but I found the resolution. What I did is:
First, go to the console.
https://console.cloud.google.com
Then, open IAM.
and add the account as a member and add this permission: "Cloud SQL Client".
I think this is a permission issue in your second account. Necessary information are missing in your question. But, the secound account, if run as a another user, won't necessarily have your sqlservice authorization. The permission,
https://www.googleapis.com/auth/sqlservice
Manage the data in your Google SQL Service instances
is required to use Jdbc.getCloudSqlConnection(url), while Jdbc#getConnectionUrl() just requires external link connection permission
https://www.googleapis.com/auth/script.external_request
I believe that you can only connect to sql instances owned by you with getCloudSqlConnection() which doesn't even require external connection permission. This method probably calls your sql instance internally.
References:
Jdbc#getCloudConnection
Jdbc#getConnection
Conclusion
To connect to any external service, you need external_request permission. But, You don't need that permission to connect to your own documents say, Spreadsheets owned by you/have edit access permission - through SpreadsheetApp.openByUrl(). I believe it's the same thing with Jdbc.getCloudSqlConnection(). It calls your Google sql internally - So, even if you grant external request permission, It won't work. What will work for this method is
Installable triggers (which runs as you).
Add the second account also as owner in GCP-IAM (may not work though) See this answer
I'd double-check once again all IP ranges which should be whitelisted. According to your description it worked fine in first account, probably in second account Apps Script uses another IP for connection, which was not whitelisted or whitelisted with some typo. Could you share screenshot how did you exactly whitelist the ranges from this article?
I have a GAS Add-On that uses a Google cloud dB. I initially set this up by:
Whitelisting Google Cloud IP ranges in my SQL instance
Getting the script.external_request scope approved for OAuth Consent screen
This all works great from GAS for the add-on, but I suspect that if this whitelist is not comprehensive and volatile (which I expect it is), I will see intermittent connectivity issues.
I recently added a Firebase web app that needs access to the same dB. I had issues, because Firebase does not conform to those Google IP ranges and does not expose its IP for whitelisting. So I had to create a socket layer connection as if Firebase was an external service.
Which got me thinking, should I put a socket layer in my GAS Add-On? But nothing in the GAS JBDC Class documentation indicates a socket parameter.
Which leads me to a question that was not really answered in this thread:
Does anyone know why Jdbc.getCloudSqlConnection(url) is the "Recommended" approach? The documentation seems to imply that because the IP whitelisting is not required, Jdbc.getCloudSqlConnection(url) is using a socket (or some other secure method) to connect to the dB?
It also seems silly that if that is the case, that I would need two have two sensitive scopes to manage a dB connection. I would rather not go through another OAuth const audit and require my users to accept another scope unless there is a benefit to doing so.
I am trying to understand better how Kerberos is integrated in Active Directory but I couldn't find a clear answer to this question from the Microsoft documentation.
I understand the process of getting a service ticket to a service from the KDC: client presents his TGT to the KDC along with a request to a specific service, the KDC will send back a service ticket to the client and the client uses this service ticket when accessing the service.
My question is: can I configure the KDC (Active Directory) to refuse to grant a service ticket to specific services for specific users/groups ?
I've tried to search the web for this and play around with configurations in order to achieve this, but I am beginning to suspect that the service ticket only role is to tell the service that "this user is indeed from the legitimate domain" and therefore a service ticket can be given to anyone on the domain. So for example in the case of CIFS (file server) even if I remove all shares from a computer, I can still see that every user can see this computer (i.e via \computer) and by running "klist tickets" I also see that they are granted a ticket to the CIFS service for "computer" even when they can't see any shared folder or drive on it. So specifically in this example, can I somehow make it so that a specific user will never be given a "CIFS" type service ticket for this computer ?
Not with Kerberos. It has been designed for authentication only. You wan't authorization. This is a different problem area.
This is non-trivial to setup but with Windows Server 2012 R2 AD, this is possible to do. Take a look at Authentication Policies & Siloes - http://technet.microsoft.com/en-us/library/dn486813.aspx
I'd like to have my Scala application server find out if it's running inside Heroku or CloudBees or Cloud Foundry or something else. Is there some standard way of finding out which Java hosting provider is currently in use? (if any)
Perhaps the hosting provider's firewall/load-balancer/whatever adds some standard HTTP header that the app server could check? Or perhaps it's possible to do hosting provider specific checks somehow, for the most popular hosting providers?
Background: The app server could then show helpful tips to the server admin that tells him/her how to view the server's log files. This would be useful during the initial setup of the server + database, because then the admin needs to find a certain magic password in the log file, which s/he then uses to get access to the admin interface web pages the very first time (before any admin user exists in the database, see this security question). — The installation would be more user-friendly, if the server could tell the admin exactly how to view the log files (which varies from hosting provider to hosting provider).
In the case of cloudbees there are several ways, none of which are guaranteed to be future proof (given changing containers).
Perhaps what is needed is a standard environment variable to make this doable.
I am trying to start an application in Websphere 8, and keep on getting the following error.
From the message, it means we are missing the bindPassword, but we never have to define in WAS 6.1
Currently we are using Standalone LDAP registry. Does anyone have any idea where I should start looking to fix this error?
UserManagemen E com.ibm.ws.wim.management.UserManagementProcess handleNo
tification CWWIM6004E Initialization of the dynamic reload manager failed.
com.ibm.websphere.wim.exception.MissingInitPropertyException: CWWIM0004E The initialization property 'bindPassword' is missing from the configuration.
at com.ibm.ws.wim.adapter.ldap.LdapConnection.initializeEnvironmentProperties(LdapConnection.java:194
7)
at com.ibm.ws.wim.adapter.ldap.LdapConnection.initializeServers(LdapConnection.java:1904)
at com.ibm.ws.wim.adapter.ldap.LdapConnection.initialize(LdapConnection.java:1832)
at com.ibm.ws.wim.adapter.ldap.LdapAdapter.initialize(LdapAdapter.java:235)
at com.ibm.ws.wim.RepositoryManager.initialize(RepositoryManager.java:610)
at com.ibm.ws.wim.RepositoryManager.<init>(RepositoryManager.java:131)
In regards to ".... never have to define in WAS 6.1"
The requirement for a LDAP bind password is enforced by the LDAP server, this is not a WAS requirement
If in fact you didn't define it in WAS v6.1, the LDAP server in use for WAS V6.1 didn't require it.
Based on the error, you've either changed LDAP servers or the LDAP server configuration has changed (or both)
As mentioned in the other post, you can troubleshoot this using a tool like ldapsearch
The technote at http://www-01.ibm.com/support/docview.wss?uid=swg21470063 discusses obtaining "must gather" and troubleshooting these types of issues (refer to the "collecting data manually" section)
You must check your ldap connection to the ldap server
User IBM WebSphere Console, Security settings, LDAP and take note about the LDAP connection settings.
Use a tool like ldapsearch in order to check the connection via shell command line.
It is possible that these bind password is not correct.
If you are using un Novell eDirectory Server you must take special attention in the bind user creation ( field password )
I'm building an internal website in Perl and I would like to get it to use Windows credentials for authentication. My research so far has turned up a lot of keywords: Kerberos, LDAP, NTLM, etc, but no solid information. Anyone got pointers or good tutorials?
Thanks.
Are your servers part of a Microsoft Active Directory?
Active Directory is LDAP-compliant. Therefore, you can setup LDAP to authenticate your users
Are you using Apache? If so, there is a module that allows you to authenticate to an Active Directory directory: mod_ auth_sspi
Finally, Microsoft has created Active Directory Service Interfaces (ASDI) to solve these types of problems. There is a lot of information at MSDN. For example, this is how the open-source Hudson CI server authenticates to Active Directory.
I hope one of these suggestions help you.
We've been using Mod NTML for Apache. It fetches the windows credentials of the user logged in. But you're probably not interested in the SSO?
http://modntlm.sourceforge.net/
I've been looking into this topic myself. I'm still not sure what the right answer is because the topic is out of my domain of knowledge & experience. But here are some possibilities that I've come up with by searching the Internet:
An Apache LDAP module: http://httpd.apache.org/docs/2.0/mod/mod_auth_ldap.html
A Perl Module for Apache LDAP authentication: Apache2::AuthNetLDAP
NT authentication using an Apache Perl Module: Apache2::AuthenSmb
Using NIS for Apache user authentication: http://www.yolinux.com/TUTORIALS/LinuxTutorialApacheAddingLoginSiteProtection.html#NIS
An article describing ActiveDirectory authentication using Apache: http://www.le.ac.uk/cc/sh23/adldap.html
An open source ActiveDirectory solution from a business: http://www.likewise.com/
For Tomcat on Windows you can use Waffle, both SSO and form-based/basic/digest auth.