1

We need to configure our SP2013 people picker to support a new one-way trust domain. According to this msdn article I need to run follow command in every WFE.

STSADM.exe -o setproperty -pn peoplepicker-searchadforests -pv "forest:Contoso.com,Contoso\User1,Password1; domain:Fabrikam.com,Fabrikam\User2,Password2" -url http://central

My question is, do we need to open port 389 (LDAP port) on WFE towards the one-way trust domain DC? I am not so sure the people picker query is started from end user browser (the IE9) or started from SharePoint WFE, or both?

Improve this question

1 Answer 1

Reset to default
4

Bill Baer outlines the required ports. If you want to test it, I created the People Picker Port Tester which you would run from the SharePoint server(s). The query is only done from the SharePoint server. End user machines do not need those ports open to the remote DCs.

Ports:

  • TCP/UDP 135, 137, 138, 139 (RPC)
  • TCP/UDP 389 by default, customizable (LDAP)
  • TCP 636 by default, customizable (LDAP SSL)
  • TCP 3268 (LDAP GC)
  • TCP 3269 (LDAP GC SSL)
  • TCP/UDP 53 (DNS)
  • TCP/UDP 88 (Kerberos)
  • TCP/UDP 445 (Directory Services)
  • TCP/UDP 749 (Kerberos-Adm) [Opt.]
  • TCP port 750 (Kerberos-IV) [Opt.]
Improve this answer
4
  • May I know how to determine the DC is using LDAP SSL or non-SSL?
    – Mark L
    Jan 4, 2016 at 1:38
  • You can use ldp to determine if you can connect to your DC via LDAP over SSL. DCs require a Server Auth certificate to be installed (typically this would come from an internal Cert Authority). That said, SharePoint uses "GC://" for Active Directory Domains marked as "Forests" and "LDAP://" for those not marked as forests (default), without port number. What that means is, unfortunately, the use of non-secure GC/LDAP connections.
    – user6024
    Jan 4, 2016 at 2:10
  • Thanks! You have fully answered my question. But I think you need to copy & paste the bill's blog content here to make it a valid answer.
    – Mark L
    Jan 4, 2016 at 9:13
  • Added just the ports
    – user6024
    Jan 4, 2016 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.