使用 Active Directory 的 Drupal 7 和 LDAP 身份验证

Question

我正在使用 Drupal 7 ldap 模块 (http://drupal.org/project/ldap) 通过 Windows Active Directory 进行身份验证。我收到以下错误：

username : Beginning authentification....
username : Existing Drupal User Account not found. Continuing on to attempt ldap authentication
username : Trying server global_directory where bind_method = 2
username : Success at connecting to global_directory
ldap_search() call: base_dn: CN=Configuration,DC=ab,DC=cd,DC=ef, filter = (samaccountname=username), attributes: , attrsonly = 0, sizelimit = 0, timelimit = 0, deref = , scope = 3
username : Trying server global_directory where bind_method = 2. Error: Success
username : Authentication result id=0 auth_result=3 (Sorry, unrecognized username or password.)
username : Failed ldap authentication. User may have authenticated successfully by other means in a mixed authentication site. LDAP Authentication Error #: 3 error message: Sorry, unrecognized username or password.
Login attempt failed for username.

设置：

sid = global_directory
numeric_sid = 1
name = Global Directory
status = 1
ldap_type = ad
address = ldaps://ldap.url
port = 3269
tls = 0
followrefs = 0
bind_method = 2
basedn = Array ( [0] => CN=Configuration,DC=ab,DC=cd,DC=ef )
binddn = 
user_dn_expression = %username@domain.com
user_attr = samaccountname
account_name_attr =
mail_attr = mail
mail_template =
picture_attr =
unique_persistent_attr =
unique_persistent_attr_binary = 0
ldap_to_drupal_user =
testing_drupal_username =
testing_drupal_user_dn =
grp_unused = 1
grp_object_cat =
grp_nested = 0
grp_user_memb_attr_exists = 0
grp_user_memb_attr =
grp_memb_attr =
grp_memb_attr_match_user_attr =
grp_derive_from_dn = 0
grp_derive_from_dn_attr =
grp_test_grp_dn =
grp_test_grp_dn_writeable =
search_pagination = 0
search_page_size = 1000

如果我将 BaseDN 更改为 DC=cd,DC=ef 错误将是：

username : Beginning authentification....
username : Existing Drupal User Account not found. Continuing on to attempt ldap authentication
username : Trying server global_directory where bind_method = 2
username : Success at connecting to global_directory
ldap_search() call: base_dn: DC=cd,DC=ef, filter = (samaccountname=username), attributes: , attrsonly = 0, sizelimit = 0, timelimit = 0, deref = , scope = 3
ldap_search() function error. LDAP Error: Referral, ldap_search() parameters: ldap_search() call: base_dn: DC=cd,DC=ef, filter = (samaccountname=username), attributes: , attrsonly = 0, sizelimit = 0, timelimit = 0, deref = , scope = 3
username : Trying server global_directory where bind_method = 2. Error: Referral
username : Authentication result id=0 auth_result=8 (Authentication Server or Configuration Error.)
username : Failed ldap authentication. User may have authenticated successfully by other means in a mixed authentication site. LDAP Authentication Error #: 8 error message: Authentication Server or Configuration Error.
Login attempt failed for username.

注意：我使用drupal ldap-7.x-2.0-beta5+24-dev

有人遇到同样的问题吗？任何帮助将不胜感激。

Answer 1

我终于找到了一个魔法： 我必须在 LDAP 服务器字段中写入：ldaps://ldap.url:3269，并在 LDAP 端口字段中保持相同的端口号。

Answer 2

您的问题显然是 baseDN。在第一个错误时，身份验证失败（登录名或密码错误）。至于第二个，你的配置还有一些问题。

你检查过一切吗？启用 iptables 中的端口？因为它在尝试与服务器联系时似乎失败了（bind_method；身份验证服务器或配置错误）。

我希望这至少有助于澄清情况:)