freeipa

#7431 LDAP application auth with AD users
Closed: insufficientinfo by rcritten. Opened by davecuny.

Closed: insufficientinfo
Reopen Issue

Issue

We are investigating whether or not our freeipa 4.5.0 can handle an application (i.e. not an ssh login) authentication request via LDAP using Active Directory credentials. I have seen some documentation discussing the --enable-compat feature for use with legacy ssh logins using pam, but no documentation on if this would work for an app that currently initiates an LDAP session with AD directly.

Currently the auth path is: app -> LDAP protocol -> single Active Directory server

If possible, we would love to be able to have the auth path look like this: app -> LDAP protocol -> freeipa -> entire AD domain, for redundancy and allowing us to have multiple trust relationships with multiple domains.

The success of this is very much dependent on what attributes this application expects to retrieve. Schema Compatibility plugin is configured to provide compatibility with RFC2307 clients mostly. This schema is for older nss resolvers like you can find in other UNIX systems.

See https://pagure.io/slapi-nis/blob/master/f/doc/ipa/sch-ipa.txt for details of how integration with FreeIPA is done on slapi-nis side.

However, if your application is looking for something that is not represented by RFC2307 schema, you will not be able to get it working. For example, if you are expecting to see 'mail' attribute, it is will not be there. Schema Compatibility plugin/subtree in FreeIPA is not for a generic LDAP proxy functionality.

Metadata Update from @rcritten:
- Issue close_status updated to: insufficientinfo
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.