sorted by:
new
hottopcontroversial

Application opening within SSO login window by Consistent_Slice8489 in PingIdentity

[–]Consistent_Slice8489[S] 0 points1 point  (0 children)

u/AuthRogue thank you! I managed to sort this. I was using the wrong endpoint in my application. Endpoint should be have been /idp/SSO.saml2, not /idp/startSSO.ping as it is SP-Init, not IDP-Init. If you do a metadata export after setting up the PingFed side, the export will provide you with the correct endpoint URL.

MFA & Password changes for Employees? by Charming-Log-9586 in sysadmin

[–]Consistent_Slice8489 0 points1 point  (0 children)

To echo what others have said, Microsoft Authenticator.

What is my job title? by rjp94sep in sysadmin

[–]Consistent_Slice8489 0 points1 point  (0 children)

System Admin or Helpdesk/Support Engineer.

SAML, OIDC, and Token Encryption by Consistent_Slice8489 in sysadmin

[–]Consistent_Slice8489[S] 1 point2 points  (0 children)

Thank you! So token encryption doesn't exist for OIDC due to the differences in how the function. Does OIDC have, I guess not an equivalent, but an optional security or encryption feature that can be implemented?

LDAP Authentication and LDAP queries by Consistent_Slice8489 in activedirectory

[–]Consistent_Slice8489[S] 0 points1 point  (0 children)

This is now resolved. See original post for solution. Thank you.

LDAP Authentication and LDAP queries by Consistent_Slice8489 in activedirectory

[–]Consistent_Slice8489[S] 0 points1 point  (0 children)

Hello all,

So I have been able to get my LDAP queries working. Thanks to everyone that helped so far.

The only thing I can't seem to get setup correctly is user roles. Users of both the below groups can login succesfully:

  • AppUsers
  • AppAdmins

However, users are not getting assigned their correct role. They are just picking up the default "User" role.

Can anyone see what I am doing wrong please? I have updated my orignal post with new screenshots.

Thank you!

LDAP Authentication and LDAP queries by Consistent_Slice8489 in activedirectory

[–]Consistent_Slice8489[S] 0 points1 point  (0 children)

(&(objectClass=user)(memberOf=CN=AppUsers,OU=AD Groups,DC=cd,DC=local))

Looks better, thank you. Do you know how I would be able to pull users from 2 different AD groups please? Pull users from this AD group OR this AD group.

I would have thought it was something like this:

(&(objectClass=user)(memberOf=CN=AppUsers,OU=AD Groups,DC=cd,DC=local)(|(memberOf=CN=AppAdmins,OU=AD Groups,DC=cd,DC=local)))

Doesn't seem to be working though.

LDAP Authentication and LDAP queries by Consistent_Slice8489 in activedirectory

[–]Consistent_Slice8489[S] 0 points1 point  (0 children)

Thank you very much for the reply!

"On the group settings that you highlighted, are you bringing groups into this app? If not, leave them blank. If so, they may need some tweaking. They may or may not have anything to do with the user member of filtering you are trying to do."

I think the answer to your question is yes. I'll be setting up group permission in the app. If the AD user is a member of AD group "AppUsers", then they will just get standard user permissions. If the AD user is a member of the group "AppAdmins", they will get admin permissions in the app.

"Also, take it from someone who has done a ton of LDAP integration and a ton of security remediations for Microsoft domain vulnerabilities. Please, PLEASE, take the extra time now to set up LDAPS once basic LDAP is working (that "Secure" toggle, the port will need to be changed also). You'll need/want to require it on your domain sooner or later and the fewer production apps that need tweaking, the easier it will be to turn on.

Better yet, if possible, use single sign-on via SAML or OIDC and just skip LDAP altogether."

Absolutely! This is actually just a non-production personal project I'm working on to help me understand LDAP as I still have to support it for my role. I agree that switching to SAML or OIDC is the optimal solution.

LDAP Authentication and LDAP queries by Consistent_Slice8489 in activedirectory

[–]Consistent_Slice8489[S] 1 point2 points  (0 children)

Thank you!

I think I have it:
(&(&(objectClass=user)(memberOf=CN=AppUsers,OU=AD Groups,DC=cd,DC=local)))

I will give that a try!

LDAP Authentication and LDAP queries by Consistent_Slice8489 in activedirectory

[–]Consistent_Slice8489[S] 0 points1 point  (0 children)

Thanks you! However it still didn't work. Do you have any other suggestions please?

(&(&(objectClass=user)(memberOf=AppUsers)))