LDAP Search Filter for Authentication
Ok I am having an issue setting up K1000 for LDAP Authentication. I add the external server. Give it the host name for my Domain Controller and the proper port. My AD tree is "ICT.ad.somename.com" All my users are in one OU so my search base DN looks like this:
OU=employees,DC=ICT,DC=ad,DC=somename,DC=com
I set up a basic user in my domain "KACE". When I put in a search filter like this "(&(ObjectClass=person)(!(ObjectClass=Computer))" and enter the LDAP Login Field "ICT\Kace" then test the settings it gives me the right number of entries found.
However when I go to "apply" the settings it says: "KBOX_USER need to be part of Search Filter" so I change the Search Filter to "(&(samaccountname=KBOX_USER)(ObjectClass=user)(!(ObjectClass=Computer)))" and the test completes but comes up with 0 entires found.
I change the search field to "(&(samaccountname=*)(ObjectClass=person)(!(ObjectClass=Computer)))" and it is successful in finding all the users but still won't apply stating "KBOX_USER need to be part of Search Filter".
I don't know how to get around this. Anyone help?
2 Comments
[ + ] Show comments
Answers (1)
Answer Summary:
Please log in to answer
Posted by:
aragorn.2003
8 years ago
Top Answer
We´re putting the users in different groups with different roles. In AD we have a group called GROUP_KACE_ADMIN (e.g, see the distinguished name in code section) and put all admins in this group and another group for default users.
(&(memberOf=CN=GROUP_KACE_ADMIN,OU=SVC_KACE,OU=Services,DC=contoso,DC=com)(samaccountname=KBOX_USER))
Comments:
-
TY. I tried using the ITADMIN group using that format and it worked. Now on to the hard stuff, MSI building. - NMSUC 8 years ago
I'm going to link an ldap filter article also.
Link: https://support.software.dell.com/k1000-systems-management-appliance/kb/112277
Hopefully that helps you understand. If not - KACE_Irwin 8 years ago