1

I need to do practice with LDAP so I think that is a good idea to install a LDAP server only for do some test.

For client side I'm using a LInux Mint distribution and I have installed all the software packages as I found in this link. In my company is available an Active Directory service, but obviously my user has not administrator privileges needed for the following command:

sudo realm join domain.tld -U domain_administrator --verbose

So I was thinking to install a LDAP server to do tests.

Someone know a LDAP server suitable for my purposes?

Thanks.


At this link I have found a tutorial to install OpenLDAP Server and OpenLDAP Client on Linux Mint.

The installation of the OpenLDAP Server is possible, as always, by apt:

sudo apt update
sudo apt -y install slapd ldap-utils 

After that the Server must be configured and the link gives some details. Obviously this article is only an introduction but it is enough to start studying an LDAP Server.

3
  • you mentioned linux mint; I think it might be best to use CentOS since that is equivalent to Redhat (RHEL) which is the corporate standard that everyone for the most part uses. CentOS is the free version of Redhat Enterprise Linux and with it's included repositories and EPEL that would provide everything needed to set up an LDAP test setup.
    – ron
    Commented Oct 5, 2022 at 14:58
  • @ron Thanks: I'm using Mint only because I have this distribution and I'd like to do only some tests. I will not use Mint for production..
    – User051209
    Commented Oct 5, 2022 at 15:07
  • I understand not for production use but that's kinda also my point; I use CentOS at home to mimick everything I do at work under RHEL. For a test setup I think you would be open to more risk using some other distribution versus corporate norms (which is RHEL). But if you are using MINT at work and need to make it happen on that then yeah also use MINT for your test setup.
    – ron
    Commented Oct 5, 2022 at 15:15

1 Answer 1

1

You don't need anything other than a normal user account to query Active Directory through LDAP. (Some fields will be inaccessible, but the majority of them are relatively public access.)

authacct='[email protected]'    # Authentication (your AD account)
ldapuri='ldap://ad.contoso.com'      # Address of any AD server
searchbase='dc=contoso,dc=com'       # Starting point for searches
what='frankfalse'                    # What text to search for

# LDAP query filter
filter="(&(objectclass=user)(|(cn=$what*)(userPrincipalName=$what*)(mail=$what*)(proxyAddresses=smtp:$what*)(sn=$what*)(sAMAccountName=$what*)(physicalDeliveryOfficeName=*$what*)(c=$what)))"

# Fields to return
fields=(sAMAccountName cn mail c targetAddress description title)

# Perform the search
ldapsearch -W -L -x -H "$ldapuri" -D "$authacct" -b "$searchbase" -s sub "$filter" "${fields[@]}"

What you cannot do with ordinary non-privileged access is to differentiate between user accounts that are disabled and those that are active. If you have a suitably privileged account you can add this into the filter immediately after (objectclass=user) to select only active accounts:

(!(userAccountControl:1.2.840.113556.1.4.803:=2))

The $filter string directly and naively interpolates the $what value. Do not blindly accept $what from an untrusted user.

1
  • Thanks with your help I'm able to query directly the AD Server of my company. Wonderful.
    – User051209
    Commented Oct 6, 2022 at 15:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .