Databases
StackOverflow2013
Postsdbo
POISAPI Filter LDAP Authentication Error on DMZ Server
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POISAPI Filter LDAP Authentication Error on DMZ Server
    primarykey
    data
    text
    <p>I am writing an ISAPI filter for a web server that we have running in a DMZ. This ISAPI filter needs to connect to our internal domain controllers to authenticate against Active Directory. There is a rule in the firewall to allow traffic from the DMZ server to our domain controller on port 636 and the firewall shows that the traffic is passing through just fine. The problem lies in the <code>ldap_connect()</code> function. I am getting an error <code>0x51 Server Down</code> when attempting to establish the connection. We use the domain controllers IP address instead of the DNS name since the web server's outside the domain.</p> <p>ISAPI LDAP connection code:</p> <pre><code>// Set search criteria strcpy(search, "(sAMAccountName="); strcat(search, username); strcat(search, ")"); // Set timeout time.tv_sec = 30; time.tv_usec = 30; // Setup user authentication AuthId.User = (unsigned char *) username; AuthId.UserLength = strlen(username); AuthId.Password = (unsigned char *) password; AuthId.PasswordLength = strlen(password); AuthId.Domain = (unsigned char *) domain; AuthId.DomainLength = strlen(domain); AuthId.Flags = SEC_WINNT_AUTH_IDENTITY_ANSI; // Initialize LDAP connection ldap = ldap_sslinit(servers, LDAP_SSL_PORT, 1); if (ldap != NULL) { // Set LDAP options ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION, (void *) &amp;version); ldap_set_option(ldap, LDAP_OPT_SSL, LDAP_OPT_ON); // Make the connection // // FAILS HERE! // ldap_response = ldap_connect(ldap, &amp;time); if (ldap_response == LDAP_SUCCESS) { // Bind to LDAP connection ldap_response = ldap_bind_s(ldap, (PCHAR) AuthId.User, (PCHAR) &amp;AuthId, LDAP_AUTH_NTLM); } } // Unbind LDAP connection if LDAP is established if (ldap != NULL) ldap_unbind(ldap); // Return string return valid_user; </code></pre> <p><code>servers = &lt;DC IP Address&gt;</code></p> <p>I have tested this code on my local machine that is within the same domain as AD, and it works, both LDAP and LDAP over SSL. We have a server certificate installed on our domain controller from the Active Directory Enrollment Policy but I read elsewhere that I might need to install a client certificate as well (for our web server). Is this true? </p> <p>Also, we have a separate wordpress site running on the same DMZ web server that connects to LDAP over SSL just fine. It uses OpenLDAP through PHP to connect and uses the IP address of our domain controllers to connect. We have an ldap.conf file that with a line of code: <code>TLS_REQCERT never</code>. Is there a way to mimic this effect in Visual C with what I'm trying to do for the ISAPI filter? Hoping this is a programming issue more than a certificate issue. If this is out of the realm of programming, please let me know or redirect me to a better place to post this.</p> <p>Thanks!</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USZac
    1. USZac
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POISAPI Filter LDAP Authentication Error on DMZ Server
      1. This table or related slice is empty.
      1. VTUpMod
    1. COYou shouldn't need a client cert here. Can you get a network trace and see what's going on?
      singulars
      1. POISAPI Filter LDAP Authentication Error on DMZ Server
      1. USBrian Desmond
    2. COAlso, tweak your filter to `(&(objectCategory=person)(objectClass=user)(samAccountName=...))`. That will be more efficient.
      singulars
      1. POISAPI Filter LDAP Authentication Error on DMZ Server
      1. USBrian Desmond
    3. COOh one more thing, I believe you want a simple bind not NTLM here.
      singulars
      1. POISAPI Filter LDAP Authentication Error on DMZ Server
      1. USBrian Desmond
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload