Yubico Forum

Re: [SOLVED] YubiRADIUS Bind to Active Directory fails

2013-10-16T15:48:43+01:00

The only thing i can think of is I used an account that is in the Users OU, and the account name is a single word (where the username and the first name are the same, and there is no last name). I may have created the user on a different domain controller than the one i configured the VA to use to authenticate (i dont explicitly remember which one i used to create the account) and replication too a while, which could be why it 'just started working', perhaps.

Statistics: Posted by bbladesCSE — Wed Oct 16, 2013 3:48 pm

Re: [QUESTION] YubiRADIUS Bind to Active Directory fails

2013-10-07T19:34:03+01:00

Thanks for replying! I always find that anything that uses canonical names and not just a plane old login are always a pain in the rear to get working. Using my example 'Yubi' is the login, and first name of the user I've created for ldap queries, there is no last name. --

I just logged into my YRVA to change the filter and ....
WHOA! All my AD users showed up What the EFF???

I seriously have no idea how or why it started working.

Statistics: Posted by bbladesCSE — Mon Oct 07, 2013 7:34 pm

Re: [QUESTION] YubiRADIUS Bind to Active Directory fails

2013-10-05T07:50:11+01:00

This seems very poorly documented in the YubiRADIUS literature. I'm running successfully against 2012 to authenticate Cisco AnyConnect VPN clients.

I spent a long time and went through quite a bit of swearing to get this to work. I was not (and still not) an AD/LDAP expert when I started this so if I point out some things that are obvious, my apologies. They were not obvious to me.

User DN is the Full Name of the user, not the login. That is, if I create an AD user with first name LDAP and last name Query and give it the login ldapq, then use "CN=LDAP Query" and not "CN=ldapq"

Also, the default filter is pretty poor. You'll probably want something more like:

Code:

(&(objectCategory=person)(objectClass=user))

This should limit the accounts brought over to those that belong to real people.

Lastly, LoginNameIdentifier should be sAMAccountName and not cn. Just like under User DN, cn will yield the full name as the login and not the login you're used to.

Hope this helps.

Statistics: Posted by agonsman — Sat Oct 05, 2013 7:50 am

[SOLVED] YubiRADIUS Bind to Active Directory fails

2013-10-16T15:44:36+01:00

I'm trying to set up YubiRADIUS with Active Directory 2012. I've created a dedicated account for the VA to use to bind to AD.

Here is the error:

Quote:

User Import operation started...
Connecting to LDAP/AD server.
Successfully connected to LDAP/AD server.
Binding to server with given user credentials.
Failed to bind to server.
Failed to find Users.
Please check login credentials or Directory Type.

Any clue what i am doing wrong here?

Statistics: Posted by bbladesCSE — Thu Oct 03, 2013 3:31 pm