#Bugzilla ldap full

WRjBEBggrBgEFBQcwAYY4aHR0cDov元l0dHJpdW0uaWRtcWUubGFiLmVuZy5ib3MucmVkaGF0LmNvīTo4MDgwL2NhL29jc3AwMwYDVR0lBCwwKgYIKwYBBQUHAwEGCCsGAQUFBwMCBggrBgEFBQcDBAYKK

RkwFxsIa2RjdXNlcjIbC0VYQU1QTEUuQ09NMB0GA1UdDgQWBBTLLVbh9rTYVyQCUv/GP3fA76X8BzĪfBgNVHSMEGDAWgBSprEnWriPbYG15LDE8qnQ2YmoTATAJBgNVHRMEAjAAMFQGCCsGAQUFBwEBBEg ZGN1c2VyMkBFWEFNUExFLkNPTaA/BgYrBgEFAgKgNTAzoA0bC0VYQU1QTEUuQ09NoSIwIKADAgEBo RUk+zfDNXnWLOAs1t2sZvqUEcR4GnvsRqRG57CO9ks1seJQy7dj2+4ChQs8SpRrJ/V/LuQM+Xfc9sĢbhj0osWoxr2TZXpbwh9BXMZJje9K/EiDB5cX9UPeMVSbtAgMBAAGjggFyMIIBbjAOBgNVHQ8BAf8ĮBAMCBsAwgYUGA1UdEQR+MHyBE3JwYXR0YXRoQHJlZGhhdC5jb22gJAYKKwYBBAGCNxQCA6AWDBRr KoZIhvcNAQEBBQADgY0AMIGJAoGBAIxF7FWEeCGBph/9D7Z7gsFH3gQAgc4BPkRGl/FJgM+StxChy XFzAVBgNVBAoMDlRva2VuIEtleSBVc2VyMRgwFgYKCZImiZPyLGQBAQwIa2RjdXNlcjIwgZ8wDQYJ WWQ0EgU2lnbmluZyBDZXJ0aWZpY2F0ZTAeFw0xNTA5MDkxODQwMTZaFw0yMDA5MDcxODQwMTZaMDM QQKDCxpZG1xZS5sYWIuZW5nLmJvcy5yZWRoYXQuY29tIFNlY3VyaXR5IERvbWFpbjEfMB0GA1UEAw UserCertificate binary:: MIID9jCCAt6gAwIBAgIBOjANBgkqhkiG9w0BAQsFADBYMTUwMwYDV

UserPassword:: e1NTSEF9YVpVa1c5RkZ3UnB6ajFJeC9tVEtxcnNyVkRVWkNRc3Byd0I4ckE9PQ= UserSMIMECertificate: This the userSMIMECertificate of kdcuser2 RoomNumber: This the roomNumber of kdcuser2 PreferredLanguage: This the preferredLanguage of kdcuser2 LabeledURI: This the labeledURL of kdcuser2 HomePostalAddress: This the homePostalAddress of kdcuser2 HomePhone: This the homePhone of kdcuser2 TelephoneNumber: This the telephoneNumber of kdcuser2īusinessCategory: This the businessCategory of kdcuser2ĬarLicense: This the carLicense of kdcuser2ĭepartmentNumber: This the departmentNumber of kdcuser2ĮmployeeNumber: This the employeeNumber of kdcuser2ĮmployeeType: This the employeeType of kdcuser2 Insert a smartcard enrolled with a kerberos user.ĭescription: this is the description of kdcuser2 Must only let pass user entry for the login user.įilter = '(&(objectClass=posixAccount)(uid=%s))'Īttribute_map = 'uid=uid&mail=email', 'redhatPrincipalName=upn', 'userCertificate binary=cert' Ģ. # Attribute of user entry which contains the certificate Must have read-access for user entries under 'base' Module = /usr/$LIB/pam_pkcs11/ldap_mapper.so Make the following changes to /etc/pam_pkcs11/pam_nf Source RPM : pam_pkcs11-0.6.īuild Host : .ġ.

#Bugzilla ldap full

The IPA server would contain a user account whose entry's DN, recorded full name, IPA user name, recorded email address, and Kerberos principal name I'd specified when creating the certificate, and the user entry would have been modified to add the 'pkiUser' object class so that the newly-generated certificate could be set as its userCertificate value.Īfter that, it should have been pretty straightforward to cycle through the various matching options that we're adding to pam_pkcs11's ldap mapper. I probably used 'local-getcert request' with the -F flag to generate the certificate and a CA certificate, either pk12util or openssl's pkcs12 command to export the key and certificate into a PKCS#12 bundle, and OpenSC's pkcs15-init's -store-private-key option to dump the private key and certificate onto the card. It's been a while, but I'd have used pklogin_finder and a card containing a certificate whose contents I could easily reissue with different contents, and combined it with an IPA server. I recommand you create a dedicated account in your AD to use as the bind account in your Bugzilla config.Nothing automated, unfortunately. Note that the DN/password combo you use to bind to the LDAP server does not need to be that of a valid bugzilla user. > bugzilla portal, so required a least permitted user supposed to use We cannot configure the administrator account on > Can I know what is the least access required for the user to bind the Subject: Re: Issues with LDAP Configuration įrom: support-list On Behalf Of Emmanuel Seyman We were able to bind with userPrincipalName (user: ' username at company.local'), but things were easier once we switched to sAMAccountName (user: 'username').Į. Be careful with security here as this account is a domain super account (again I'm not an expert on AD by any means) and a potential attack vector. We ended up creating a domain service account 'xxxxxxxxconnector' just for this.

Messages sorted by: ĪD is a bit of voodoo to me but I recommend Emmanual's suggestion as well.

Next message (by thread): Issues with LDAP Configuration.

Previous message (by thread): Issues with LDAP Configuration.

Issues with LDAP Configuration Daniel McCarty danielm at