2

I've been trying to use openLdap for SharePoint authentication. I followed this document http://technet.microsoft.com/en-us/library/ee806890.aspx

but I don't know how to customize the foolllowing xml:

<membership defaultProvider="LdapMembershipProvider"> 
 <providers> 
 <add  
 name="LdapMembership"  
 type="Microsoft.Office.Server.Security.LDAPMembershipProvider, Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C"  
 server="DC"  
 port="389"  
 useSSL="false"  
 userDNAttribute="distinguishedName"  
 userNameAttribute="sAMAccountName"  
 userContainer="CN=Users,DC=userName,DC=local"  
 userObjectClass="person"  
 userFilter="(|(ObjectCategory=group)(ObjectClass=person))"  
 scope="Subtree"  
 otherRequiredUserAttributes="sn,givenname,cn"  
 /> 
 </providers> 
</membership>

and 

<roleManager defaultProvider="LdapRoleProvider" enabled="true" cacheRolesInCookie="true" cookieName=".PeopleDCRole"> 
 <providers> 
 <add  
name="LdapRoleProvider"  
type="Microsoft.Office.Server.Security.LDAPRoleProvider, Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" 
server="DC" 
port="389" 
useSSL="false" 
groupContainer="DC=userName,DC=local" 
groupNameAttribute="cn" 
groupMemberAttribute="member" 
userNameAttribute="sAMAccountName" 
dnAttribute="distinguishedName" 
groupFilter="(ObjectClass=group)" 
scope="Subtree" 
/> 
 </providers> 
</roleManager>

Here is the data I use to access with Ldap Browsers:

Host:10.32.192.149 Base DN:dc=mycompany,dc=it Username:uid=MYUSERNAME,ou=Users,dc=mycompany,dc=it Password:MYPASSWORD

Once I'm authenticated, I get this set of data in my Ldap browser:

objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: sambaSamAccount
objectClass: enatelUser
cn: MYUSERNAME
uid: MYUSERNAME

Could anyone tell me how to change the xml above? For example, I don't know what I should put instead of:

userDNAttribute="distinguishedName"
userNameAttribute="sAMAccountName"

All I tried didn't work.

EDIT: I have tried, without lsuccess, inserting the following xml in the web.config files:

 <add name="membershipLdap" type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="myserver" port="389" useSSL="true" userDNAttribute="distinguishedName" useDNAttribute="true" userNameAttribute="uid" userContainer="ou=Users,dc=mycompany,dc=it" userObjectClass="user" userFilter="(ObjectClass=user)" scope="Subtree" otherRequiredUserAttributes="sn,givenname,cn" />



            <add name="roleManagerLdap" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="myserver" port="389" useSSL="true" enableSearchMethods="true" groupContainer="ou=Users,dc=mycompany,dc=it" groupNameAttribute="Ou" groupNameAlternateSearchAttribute="Ou" groupMemberAttribute="member" userNameAttribute="uid" dnAttribute="distinguishedName" useUserDNAttribute="true" scope="Subtree" userFilter="&amp;(objectClass=user)(objectCategory=person)" groupFilter="&amp;(objectCategory=Group)(objectClass=group)" />

I got the following ULS errors:

System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)), StackTrace:   
 at Microsoft.SharePoint.SPWeb.InitWeb()    
 at Microsoft.SharePoint.SPWeb.get_WebTemplateConfiguration()    
 at Microsoft.SharePoint.WebControls.ScriptLink.InitJs_Register(Page page)    
 at Microsoft.SharePoint.WebControls.ScriptLink.RegisterForControl(Control ctrl, Page page, String name, Boolean localizable, Boolean defer, Boolean loadAfterUI, String language, Boolean injectNoDefer, Boolean controlRegistration, Boolean loadInlineLast, Boolean ignoreFileNotFound)    
 at Microsoft.SharePoint.WebControls.ScriptLink.Register(Control ctrl, Page page, String name, Boolean localizable, Boolean defer, Boolean loadAfterUI, String language, String uiVersion, String ctag)    
 at Microsoft.SharePoint.WebControls.ScriptLink.Register(String uiVersion, Control ctrl, Page page, String name, Boolean localizable, Boolean defer)    
 at Microsoft.SharePoint.WebControls.ScriptLink.Register(Control ctrl, Page page, String name, Boolean localizable, Boolean defer)    
 at Microsoft.SharePoint.WebControls.ScriptLink.GetOnDemandScriptKey(String strKey, String strFile, Boolean registerDependencies, Control ctrl, Page page)    
 at Microsoft.SharePoint.WebControls.ScriptLink.RegisterOnDemand(Control ctrl, Page page, String strKey, String strFile, Boolean localizable)    
 at Microsoft.SharePoint.WebControls.ScriptLink.RegisterOnDemand(Page page, String strFile, Boolean localizable)    
 at Microsoft.SharePoint.WebControls.ScriptLink.RegisterForControl(Control ctrl, Page page, String name, Boolean localizable, Boolean defer, Boolean loadAfterUI, String language, Boolean injectNoDefer, Boolean controlRegistration, Boolean loadInlineLast, Boolean ignoreFileNotFound)    
 at Microsoft.SharePoint.WebControls.ScriptLink.Register(Control ctrl, Page page, String name, Boolean localizable, Boolean defer, Boolean loadAfterUI, String language, String uiVersion, String ctag)    
 at Microsoft.SharePoint.WebControls.ScriptLink.RegisterOnDemand(Control ctrl, Page page, String strKey, String strFile, Boolean localizable)    
 at Microsoft.SharePoint.WebControls.ScriptLink.OnLoad(EventArgs e)    
 at System.Web.UI.Control.LoadRecursive()    
 at System.Web.UI.Control.LoadRecursive()    
 at System.Web.UI.Control.LoadRecursive()    
 at System.Web.UI.Control.LoadRecursive()    
 at System.Web.UI.Control.LoadRecursive()    
 at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)    
 at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)    
 at System.Web.UI.Page.ProcessRequest()    
 at System.Web.UI.Page.ProcessRequest(HttpContext context)    
 at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()    
 at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)    
 at System.Web.HttpApplication.PipelineStepManager.ResumeSteps(Exception error)    
 at System.Web.HttpApplication.BeginProcessRequestNotification(HttpContext context, AsyncCallback cb)    
 at System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context)    
 at System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)    
 at System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)    
 at System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr pHandler, RequestNotificationStatus& notificationStatus)    
 at System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr pHandler, RequestNotificationStatus& notificationStatus)    
 at System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)    
 at System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)


STS Call: Failed to issue new security token. Exception: System.ServiceModel.FaultException`1[Microsoft.IdentityModel.Tokens.FailedAuthenticationException]: The security token username and password could not be validated. (Fault Detail is equal to Microsoft.IdentityModel.Tokens.FailedAuthenticationException: The security token username and password could not be validated.).


Token Handler: Claims Forms Sign-In: Membership Provider 'membershipLdap' username-password check for user 'myusername' failed.


An exception occurred when trying to issue security token: The security token username and password could not be validated..
Improve this question
2
  • Are you using SharePoint Foundation or Server? What attribute do users log in with to OpenLDAP?
    – user6024
    Aug 15, 2014 at 14:05
  • @Trevor Seward I am using SharePoint server. Users usually login with a username and a password. In a script I need to pass uid (so maybe that is the attribute you refer to) ex. with php I pass these parameters: ldap_bind($ds0, "uid=" . $username . "," .'ou=Users,dc=mycompany,dc=it', $password)
    – Gyonder
    Aug 18, 2014 at 12:36

2 Answers 2

Reset to default
2

In the end I used this document Configuration Example for OpenLDAP

<membership defaultProvider="LdapMembership">
  <providers>
    <add 
    name="LdapMembership"
    type="Microsoft.Office.Server.Security.LDAPMembershipProvider, 
    Microsoft.Office.Server, Version=15.0.0.0, Culture=neutral, 
    PublicKeyToken=71E9BCE111E9429C" 
    server="<server name>" 
    port="389" 
    useSSL="false" 
    useDNAttribute="false" 
    userNameAttribute="uid" 
    userContainer="ou=People,dc=domain,dc=org" 
    userObjectClass="person" 
    userFilter="(ObjectClass=person)" 
    scope="Subtree" 
    otherRequiredUserAttributes="uid,cn" 
    />
  </providers>
</membership>

<roleManager> 
  <providers>
    <add 
    name="LdapRole" 
    type="Microsoft.Office.Server.Security.LDAPRoleProvider, 
    Microsoft.Office.Server, Version=15.0.0.0, Culture=neutral, 
    PublicKeyToken=71E9BCE111E9429C"
    server="<server name>" 
    port="389" 
    useSSL="false" 
    groupContainer="dc=domain,dc=org" 
    userNameAttribute="uid" 
    useUserDNAttribute="false" 
    userFilter="(objectClass=person)" 
    groupNameAttribute="cn" 
    dnAttribute="" 
    scope="Subtree" 
    />
  </providers>
</roleManager>

and I was able to be authenticated with openLdap.

Improve this answer
0

Consider a scenario where you need email to be entered as username . 

<system.web>
    <roleManager>
      <providers>
        <add name="FabrikamRole" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="adlds01.nauplius.local" port="636" useSSL="true" enableSearchMethods="true" groupContainer="CN=SharePoint,DC=Fabrikam,DC=local" groupNameAttribute="cn" groupNameAlternateSearchAttribute="cn" groupMemberAttribute="member" userNameAttribute="mail" dnAttribute="distinguishedName" useUserDNAttribute="true" scope="Subtree" userFilter="&amp;(objectClass=user)(objectCategory=person)" groupFilter="&amp;(objectCategory=Group)(objectClass=group)" />
      </providers>
    </roleManager>
    <membership>
      <providers>
        <add name="FabrikamMembership"  type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="adlds01.nauplius.local" port="636" useSSL="true" userDNAttribute="distinguishedName" useDNAttribute="true" userNameAttribute="mail" userContainer="CN=SharePoint,DC=Fabrikam,DC=local" userObjectClass="user" userFilter="(ObjectClass=user)" scope="Subtree" otherRequiredUserAttributes="sn,givenname,cn" />
      </providers>
    </membership>
</system.web>

PS below link it should give you an idea , since i am not sure which verson of sharepoint you using :

http://thesharepointfarm.com/2012/11/sharepoint-2010-and-2013-sample-active-directory-lightweight-directory-services-configuration-files/

Improve this answer
3
  • the link is not working now (500 internal server error). Anyway I am using SharePoint 2013. I have edited the question with a new attempt based on your answer, which unfortunately is not working
    – Gyonder
    Aug 18, 2014 at 13:13
  • SecurityTokenServiceApplication sevice is running ? social.technet.microsoft.com/Forums/en-US/…
    – Nikhil J
    Aug 18, 2014 at 13:27
  • Yes @Nikhil Secure Token Service Appplication is running. I can also query the securitytoken.svc and get the wsdl for example
    – Gyonder
    Aug 18, 2014 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.