My corp Jenkins instance uses the corp LDAP for user authentication. We have a requirement to automate one on the internal portals which also takes corp LDAP for authentication.
Since there is a restriction of using "dummy" LDAP for automation purpose, i am thinking of passing my (or Jenkins users) corp credential to automation script securely.
How do I pass the Jenkins logged in user credential as parameters to a job.
How do I securely pass the parameters to job that executes remote script.I dont want to store / pass corp LDAP anywhere between Jenkins and remote.
Advanced thanks. appreciate inputs and any suggestions on alternate solution to meets this requirement.
This is an old question I stumbled on while searching answers for a similar issue. But I believe you can use the apitoken in place for the password. To find out apitoken, go to http(s)://yourJenkinsURL/user/yourID/configure, you will find it there.
I have successfully assembled over a half dozen passport strategies (facebook, twitter, linkedin, instagram, tumblr, google, youtube) exchange account info with oauth1 and oauth2 token, into a single standalone auth server that saves session in Mongo and creates active profiles, with token/session/code/id fields and with many standardized atribute fields in SQL server using Tedious.js. These passport tools are excellent, thank you.
My last challenge for this project is not going as well, username and password into an active directory repository, to look up and auth in the same way. I have been trying over and over again passport-ldap, passport-ldapauth (based on ldapauth-gfork, based on ldapjs), passport-windowsauth and passport-kerberos, and seem to be getting related credential errors (deep in code, adding console.logs to try and figure out what I am getting syntactically wrong).
Are there any other resources and documentation to accessing LDAP/AD in Node.js using any strategy of Passport? The DN versus ou syntax and where the account access user (have a service account specifically set up to access the AD) for the repository versus the account user you are looking up and the filters make it very difficult to find anything error related to figure out where I am going wrong. Do you match to sAMAccountName or uid? I keep consistently getting "unauthorized" errors.
Unlike the other 70 passport strategies, where the doc and examples are clear and just work, not so much for ad/ldap passport. Can anyone point me to a good test, doc or setup that works well specifically with Passport.js and Active Directory?
While this is an old question I thought, as the maintainer of passport-ldapauth, I should clarify LDAP authentication a little.
LDAP authentication is different from those strategies you've used before. Those OAuth strategies can really be configured only one way - provide the required options, and then it works. This part is the same with LDAP, but the actual values to the options differ from one server to the other. The questions you are asking, like do you match to sAMAccountName or uid, are really up to you and the LDAP server.
General things like what does a DN look like, what is search base, or what is the syntax of search filter have been defined extensively in RFCs. If one is not familiar with the basics it can be difficult to get the authentication to work. Often the AD/LDAP server maintainer input is needed to have proper settings, eg. what search base allows finding all required users but does not cause unnecessary load on the LDAP server.
LDAP authentication usually works in three steps:
Using a service account (in passport-ldapauth, bindDn and bindCredentials), bind against the LDAP server.
Once bound, perform the configured search substituting the placeholder with user provided username. This determines if the given username is found from the LDAP server.
Use the DN of the search result, together with user provided password, and bind against the LDAP server. This verifies the password.
If you wish to have users login using their SAMAccountName, your search filter could be eg. (sAMAccountName={{username}}). If you wish that the users use uid, the filter could be just (uid={{username}}). If you want to enable both, use (|(sAMAccountName={{username}})(uid={{username}})). The search filter syntax is specified in RFC 4515.
I was able to authenticate to AD via passport-ldapauth.
One key was knowing to use server opts which are different than in some LDAP examples online
searchBase: 'ou=Accounts,dc=mydomain,dc=com'
searchFilter: '(sAMAccountName={{username}})' // {{username}} comes from the html form.
You also need to know if you need ldaps and TLS or not. (I did not) I spent a good amount of time digging through ldapjs.org.
Microsoft have released an official library for this:
https://github.com/AzureAD/passport-azure-ad
Add to your project from npm directly:
npm install passport-azure-ad
Or Auth0's passport-azure-ad-oauth2 for OAuth2 flows.
I am not sure how flexible you are with your requirements, but I was researching the same subject and stumbled upon a specific solution from Microsoft that uses AD FS as an Oauth provider
https://msdn.microsoft.com/en-us/library/dn633593.aspx
A superficial reading shows that a web client contacts AD to get a JWT token, then this token is sent to your server, which then authenticates the token with the AD server.
The AD server needs to be configured to accept your server as a relying party that needs its identity service.
I am a consultant. The company that I am doing work for has given me limited access to a couple servers. I do not have permission to log on to the ldap server.
I am using the following to bind:
(sAMAccountName={{username}})
If I cannot physically log on to the ldap server am I not able to authenticate via ldap?
If they give me access to log on to the server, ldapauth works.
Gina
I'm developing an application with Grails.
Im trying to implement an SSO-functionality. But I can't authenticate the users via windows session, because some of them has another windows passwort as the domain password.
(I retrieve the users via LDAP) So, how can I authenticate them?
Scenario should be following:
User goes to the Grails-Site
Popup appears where the users has to fill in with his credentials
After that, he has never to authenticate again...
Does anyone of you has some experience with it?
I think if you need SSO for many grails applications a good choice is to add saml support to your grails applications using this plugin and then build an IdP (there are many in many languages) and connect the IdP to your ldap.
SAML is standard and is the future.
If you need more info about saml check the saml entry at wikipedia. There you can find links to documentation and software.
I have a web service which needs to use HTTP authentication with IIS. The only hurdle is that the user's credentials are in LDAP. Is there a way to configure IIS to use LDAP credentials for it's basic authentication? I thought I could set the default domain or realm to part of the LDAP connection string, but haven't had any luck.
Thanks,
-Will
What I would do (I'm assuming you're using a third party LDAP, and that there isn't a built in way of doing this; I haven't checked) is set up MADAM and implement a custom IUserSecurityAuthority by extending Madam.UserSecurityAuthorityBase to check the credentials against LDAP.
All you will have to do is override a handful of methods to authenticate from LDAP. If you happen to be using an LDAP Membership Provider for forms authentication, you can skip implementing that separately and use the example MembershipSecurityAuthority included with MADAM.
Excerpt from that example file here:
protected override bool ValidateUser(string userName, string password)
{
return MembershipProvider.ValidateUser(userName, password);
}
Potentially useful LDAP user validation code
There is a codeplex project that looks like it has exactly what you need.
It has a great Search function so you can even test what Roles the user is in.
http://ldapwebservice.codeplex.com/
I set up an RCS server (hybrid ircd). I would like to secure it with authentication. But my user credentials are stored in a database table.
1- I cannot find anywhere documentation on how to configure the "auth" section of httpd.conf.
2- From what I understand I could use an authentication service (identd) but I don't understand how this works, how to set it up, and how to configure this to use a database table for credentials.
Please give me a hand with this.
By using InspIRCd instead, I can use this SQL authentication module:
http://wiki.inspircd.org/Modules/1.2/sqlauth
Problem solved!