I am using ldap for user authentication as mentioned in this link.
http://www-archive.mozilla.org/directory/csdk-docs/writing.htm
Here I am getting "Operations error" while ldap_search_ext_s call. Can anyone tell me what changes I need to do in order to get the user information from Active Directory.
Note : I don't want to enter the dc name and password while binding. Since machines will be running under normal users account (domain users) which do not have admin credentials in domain.Please let me know how to do binding in this case also.
My machine details :
Mac Lion, 64 Bit.
I am trying to connect to Windows Active Directory.
Thanks,
Tausif.
You need to bind with a valid username and password when connecting to a Windows Active Directory server in most cases.
When you're performing your ldap_simple_bind_s(), the two NULL parameters need to be replaced - the first with the DN of the user that is performing the bind, the second with the password for that DN.
There's more link detail in this answer
Related
I would like to restrict some functions in a user written server add-in for certain users or groups.
Question: Is it possible to get (via an API) the user name who is sending a "Tell" command from a remotely connected server console?
Example:
Tell AddinName Command (issued remotely by Hotline User)
Tell AddinName Command (issued remotely by Admin User)
The remote console (and therefore the "Tell" command) is available to both users, but a subset of commands should only be allowed to authorised users (e.g. Group in Server Document->Security).
Is the user name (entering the "Tell" command) available (e.g. in the MessageQueue)?
I know that internally in Domino there are already some restriction possible to commands issued at the console.
The session.getCommonUserName() always returns the server name (since the add-in runs in context of the server).
Thanks for any pointer or ideas.
Andy
I believe that the answer to this is no, and it would not be advisable to implement tell commands that you can't trust to all authorized administrators.
If you really do need to confirm a user identity for a command, you're going to need to use database to queue the commands. I.e., you could build an application that stores the commands in documents in a database with a restricted ACL. Your addin code can use an Extension Manager hook to monitor the database for changes and read new documents when they appear, or you could have your application use NotesSession.SendConsoleCommand to issue something like 'tell myAddIn process ' to wake up your addin and give it the noteid of the document it just created. If you need to protect against people with full access admin rights overriding the ACL, your application could digitally sign the documents and your addin could verify the signatures.
I have found the answer of this issue;
the answer is to right click on the service / properties and logon tab then you should change the password;
but when I change the password and click apply my password does not work and it changes automatically to old one;
what you think I can do now?
This is the wrong forum to ask this question, but your issue is either you're putting in the wrong password for the service account.
OR
The user account you are using with the service does not have correct SQL permissions.
You should read up on SQL Permissions:
https://msdn.microsoft.com/en-us/library/bb669084(v=vs.110).aspx
https://msdn.microsoft.com/en-us/library/bb669065(v=vs.110).aspx
If you tried to update the password the SQL service uses via Windows Services, try instead via SQL Server Configuration Manager. Doing it via Windows Services will not work correctly.
And if you are not 100% sure you are typing the correct password, you may need to update the logon account's password first.
I have written my own windows service which interacts with a SQL database and updates it. The service was running fine and seems to be functioning correctly, however of late it seems to go down at random times and cannot restart due to the error designated in the question. I have tried various searches to fix this, but unfortunately I have come up with nothing. The aim is to eventually having this service running on my companies server, but I can't adjust any server settings, I am but a user on the server, so I have restrictions to some settings.
Any quick fixes, would be helpful!
Open the Services Manager. ( Win + R, then type services.msc )
Then right click on the SQL Server process and click Properties
Then go to Log On, and select This account:
Then click Browse, and add your username in the box. (Notice it should contain the domain, in my case is AD\myusername), then Check Names and accept.
Finally type your password in the other two fields, and that's it, you should have permission to start your process now.
Cheers!!
One issue for us was the format of the account user name, we initially used
domain\username
and got the 1069-logon error, then ultimately I tried validating the user name in the properties | logon tab of the Service (in Control Panel / Service Manager), using the "Browse" and "Search" for the user name and it turned it suggested and validated ok with the reverse format
username#domain
This also worked and resolved the 1069 error, and let us script the startup using sc.exe.
Error 1069 is vague and can have different causes. I am sharing my experience here.
I encountered this error when trying to get a service to run under my account (I am trying to get my services to see the same LocalDB as interactive processes running on my account for development purposes). I use an MSA (Microsoft Account) with Windows’s PIN login normally, so I rarely enter my Windows password. To resolve the issue, I locked my screen, selected Password input instead of PIN input, and then entered my password. I assume this somehow reminded Windows what my password was and made my local account more legit.
Before doing this, you need to configure the user account in question to have the Logon as Service privilege. To do this, open the Group Policy Editor. Expand Computer / Windows Configuration / Security Configuration / Local Policies / User Permissions Assignment and then open Login as Service. From there, you can add your user in question.
also check for "Deny Logon service" policy.
user should not be added over there
We had this issue as well because the account was set so that the password expired. After we updated the account to not expire and set the password this error stopped.
The account could also be locked out. To unlock it, you only need to change that user's password (new and old password can be the same).
What also worked for me was re-entering the password in the services->LogOn window. Even when you think the account and password is correct, re-entering it will re-grant the account permission to log on as a service.
I am trying to figure out what is going on. Here is our setup:
We have four SQL servers that are in replication with each other.
We add a new user to Windows Active Directory and add them to a group that is in SQL Server that we have been using for ages.
The new user, when trying to authenticate using Windows authenication returns that error in the subject line. But, any users that were previously in Active directory work fine.
At one point I had gotten SQL Server "caught up" becauuse we had a group of users that could not log in because of this error. I did some changes to the SPNs and ended up making it so no one could log in. Then I realized how the SPNs were supposed to look and fixed it. Then I guess some magic happened and those users were able to authenticate. I thought it was fixed, but it is obviously not as we had to add one new user and they cannot authenticate.
What is interesting is that the user can authenticate with three out of the four SQL Servers. It is only this one server that is working incorrectly. I set up two SPNs for the SQl Service on this sql server.
They look like -
MSSQLSvc/[servername].[domain].local:1433
MSSQLSvc/[servername]:1433
These are actually registered to the Service account that we use for the SQL Servers. What is interesting is that I can't find the SPNs for the servers that are working anywhere.
Any help would be appreciated!
Edit: Also, another point to note is that if I try to add the user directly as a login into SQL server. I right click Logins and click Add Login then click search. I then type in [Domain]\[Username] and click check names. It validates the name as being correct. Then I click OK. And then OK again, and it gives the Error Windows NT user or group '[Domain]\[Username]' not found. Check the name Again.
I thought it was fixed, but it is obviously not as we had to add one
new user and they cannot authenticate.
The user has to relogin in order to pick up the new group. Otherwise, it's kerberos ticket is still using the old group membership information in its PAC
These are actually registered to the Service account that we use for
the SQL Servers. What is interesting is that I can't find the SPNs for
the servers that are working anywhere.
I think what happen is that you have one SQL Server with SPN setup properly while the other three SQL Servers with no SPN setup at all. So, you are going to use Kerberos on this particular server while NTLM on the other three.
As mentioned before, when you are using Kerberos, you have to either purge the ticket using some tools or you have to relogin in order to pick up the new group membership. You can also try to lock the screen and then unlock it. If I remember correctly, this should also refresh the ticket.
Unlike Kerberos, NTLM doesn't carry the group memberhsip data. After SQL Server authenticated the user using NTLM, it will find the authenticated user's group membership, including the new group you just added.
I have an asp.net application directory, and I want to use anonymous authentication in the Directory Sercurity tab.
If I use the pre-Windows 2000 style DOMAIN\USERNAME for the username, everything is fine.
If I use the AD-style (UPN) usename#domain.local, then I get a 401.1 failed login.
I've tried a number of variations, but can't get it to work. If I select the user from the Browse box, the AD name comes up in the box, but the pre-Windows 2000 name is filled-in. Likewise for SQL Server 2005.
It seems that the UPN isn't 'real', is this right? Given that it's not required and doesn't have to be unique; it seems very odd.
Am I correct, in that this is not supported? Would IIS 7 make any difference?
I wish to do this, because the limit of 20 characters for the pre-Windows 2000 username is insufficient for the role-based security I wish to apply for different webservices (the application directories) coming off this website.
UPN suffixes should work, althouh there is a bug which occurs when there is a service pack difference between the IIS box and the domain controller. There is a patch for it. This link discusses the issue in detail.
Are you sure it's domain.local and not domain.com. If the domain\username is working, then username#domain.com should work.
Update 1:
I have tried it on Windows 2003 sp 2. In the login "directory security" I have checked the enable anonymous access check box ( and only this box ) and put ausername#mydomain.com and the ausername password. The site is plain asp.net without sql backend.
Are you able to login to the server with the usename#domain.local ?
Can you test this on different domain? It may be some wired dns resolution problem.
Update 0:
I tested it on iis 6 and the username#domain.com combination works fine on my machine.
About the "realnes" of the names. No name is "real" the actual account is just a GUID. The names are just for convenience.