7.1 Active Directory Connector

Review the following considerations before using the Active Directory connector:

  • Ensure the DN of the bind user is in LDAP format. For example, cn=Administrator, cn=Users, dc=domain, dc=com.

  • Provide the IP as Host whenever Active Directory is configured.

  • Make sure the default users container in Active Directory is cn=Users, and not ou=Users.

    For more information about Actions, see LDAP Based Connectors.

7.1.1 Assert Password

The Assert password method has been modified to try a bind as the user with the specified password to avoid this problem. Be careful while entering the password because multiple retries can lead to intruder lockout.

To set the password, you need an SSL connection to AD. In addition, it is best to set the password using the Set Password action as opposed to setting the password during an object create.

Active Directory has two possible password attributes exposed via LDAP.

  • userPassword (as all LDAP systems should).

  • unicodePwd.

Each AD tree can be configured according to the behavior of these attributes. Please read MSDN articles linked for each.

7.1.2 Set a Password

To set the password you need an SSL connection to AD. It is recommended to set the password using the Set Password action. Note that you cannot create a password during object creation or user creation. So, use the Set Password action after the user is created.

7.1.3 Reset Password on Administrative Setup

AD set to require user to reset password on administrative password reset.

This will return an error LDAP 49, subcode 773 (List of codes) which will be reported in the log, and counts as a login failure, even though it technically indicates the password is correct, but login via LDAP is not allowed until the password is changed.

7.1.4 Create Group in AD

To create a group in AD, follow this procedure:

  1. Use the “create object” action.

  2. Enter these two classes:

    • objectclass=Top

    • objectclass=group

  3. Enter these attributes:

    • cn:MyGroup

    • dn:cn=MyGroup,ou=groups,dc=whatever,dc=com

    • sAMAccountName:MyGroup

    • name:MyGroup

NOTE:When handling CN’s with commas, or specifying the DN, escape the comma with a backslash.For example: cn=Jones\, Fred,ou=user,dc=company,dc=com

7.1.5 Objects Created in AD are in Disabled State

If you try to set userAccountControl during object creation, you may get an error “WILL_NOT_PERFORM”.

You must create the user in AD without a password and without setting userAccountControl. Once the user is created, use the Set Password action to set the password. This is critical because you cannot enable the account without a password being set on the user.

Then use Replace Attributes and Values to set the appropriate value in “userAccountControl”. Set it to a value of 512 for a normal enabled account. See http://support.microsoft.com/kb/305144 for all possible values for userAccountControl.

7.1.6 Possible Error Codes

Possible error codes that might occur on a LDAP bind attempt

  • 525 - user not found

  • 52e - invalid credentials

  • 530 - not permitted to logon at this time

  • 531 - workstation restriction

  • 532 - password expired

  • 533 - account disabled

  • 568 - too many contexts ids (too many group memberships)

  • 701 - account expired

  • 773 - user must reset password

Some of these errors are not technically errors. For example in Assert Password equals, while 525 and 52e are clearly indicators that the password is incorrect, 531 (workstation restriction), 532 (password expired), 533 (account disabled), 701 (account expired), and 773 (user must reset password) only return if the password is correct, and thus in the context of an Assert Password test, mean the password is actually correct.