How to configure referral domain in openldap? - centos

I have two LDAP server(both are configured using OpenLDAP) running on CentOS 6.2. Suppose hostnames are;
a.xyz.com
b.xyz.com
My requirement is to configure b.xyz.com as referral domain with a.xyz.com.
How can I configure it?
#EJP Thanks for reply. As per OpenLDAP link OpenLDAP Admin guide, I added below entry at a.xyz.com and restart slapd service.
dn: dc=develpers,dc=xyz,dc=com
objectClass: referral
objectClass: extensibleObject
dc: subtree
ref: ldap://b.xyz.com/dc=developers,dc=xyz,dc=com
Here, 'developers' is ou at b.xyz.com. Therefore, again I added below entry;
dn: ou=develpers,dc=xyz,dc=com
objectClass: referral
objectClass: extensibleObject
dc: subtree
ref: ldap://b.xyz.com/ou=developers,dc=xyz,dc=com
But still from client end I am not able to query for the user exist on b.xyz.com. I am using ldapadmin client.

Related

LDAP User login succesful without Role membership

My Rundeck detail Rundeck version: 4.10.0
install type: DEB
OS Name/version: Debian 11
DB Type/version: h2
A LDAP user without a Role membership can properly login but can not see any Projects - so far fine.
How can i block such a user to Login at all?
We have one "userBaseDn" Group (userBaseDn="cn=Users,ou=PROD,dc=company,dc=com") in which all users are stored. But of course, only users in following roleBaseDn (roleBaseDn="cn=Rundeck_Admins,cn=Applications,ou=PROD,dc=company,dc=com") Group should have access to Rundeck Web UI.
I expect, only users in Group "Rundeck_Admins" can Login to Rundeck at all
Currently, you can only restrict that using an ACL policy (the user can log in but cannot view/edit/run any project/job, as you say), please take a look at this.
Alternatively, you can create a specific branch in your LDAP server only for Rundeck users.
Currently, means there will be a change on this behavior?
As far a i understand LDAP right, for a specific LADP branch in which a place users, i have to manage users twice. 1st, in user directory and 2nd in the specific Rundeck Group. For me quite unhandy...

How can I assign an Exchange Online role group to a registered app

Backstory
I registered an app in Azure AD with an app secret and a certificate to login. I assigned the permission "Exchange.ManageAsApp" to the app, but still I cannot add group members to groups where the app is not owner. This can usually be mitigated by using the parameter "BypassSecurityGroupManagerCheck". But this parameter needs the Exchange role "Security Group Creation and Membership".
Question
How can I assign an Exchange Role Group (containing the role "Security Group Creation and Membership") to a registered app?
Most probably I'm stating the most obvious stuff here, but just for another beginner who stumbles across this problem like I did here is the solution:
To be able to add an app to an Exchange role group you need to create a service principal for the app in Exchange Online.
creating a service principal is as easy as calling a powershell command:
Connect-ExchangeOnline
New-ServicePrincipal -DisplayName "<Name of the App>" -AppId <Application (client) ID> -ServiceId <Object ID>
The display name can be anything but I'd recommend to use the name of the app. The other two values can be easily found in the app registration in Azure Active Directory.
After registering the service principal you can assign this principal to any role group by simply using the command:
Add-RoleGroupMember -Identity "<Name of role group>" -Member <Application (Client) ID>

Azure DevOps Audit logs Group.CreateGroups for groups prefixed by [TEAM FOUNDATION] by users without permission

Am investigating Azure DevOps audit logs regarding users (who are not Project Collection Admins) appearing to create Groups.
The groups all have the following in common:
a GroupName that starts with "[TEAM FOUNDATION]\\"
they appear to be AD Groups related to Microsoft Teams' Teams
Can you confirm if activity like the below is done by the Azure Active Directory integration and not by the non-admin user indicated?
Id: redacted
CorrelationId: redacted
ActivityId: redacted
ActorCUID: redacted
ActorUserId: redacted
ActorUPN: user#1#mycompanydomain.com
AuthenticationMechanism: S2S_ServicePrincipal
Timestamp: redacted
ScopeType: Enterprise
ScopeDisplayName: mycompany (Organization)
ScopeId: 696d346f-db...9a-18e120110d16
ProjectId: 00000000-0000-0000-0000-000000000000
ProjectName: blank
IpAddress: redacted
UserAgent: VSServices/16.173.30403.3 (w3wp.exe) (Service=tfsprodweu3)
ActionId: Group.CreateGroups
Data: {"ScopeId":"2468cd06-7d...e9-470b591bcade","ErrorOnDuplicate":"True","Groups":[{"Sid":"S-1-9-155...28022-2234316434","Id":"e0e9d112-64...c7210a69","ScopeId":"2468c...e9-470b591bcade","Name":"Group Name without [TEAM FOUNDATION] prefix","Description":"a description","VirtualPlugin":null,"SpecialType":5,"ScopeLocal":false,"RestrictedView":false,"Active":true}],"EventAuthor":"e972bfe1-0...43b8961","AddActiveScopeMembership":"False","CallerProcedure":"prc_CreateGroups","GroupId":"e0e9d1...2ac7210a69","GroupName":"[TEAM FOUNDATION]\Group Name"}
Details: [TEAM FOUNDATION]\Group Name group was created
Area: Group
Category: Create
CategoryDisplayName: Create
ActorDisplayName: name of user #1 at my company
GroupName that starts with "[TEAM FOUNDATION]\"
This means that the group is an AAD group.
Can you confirm if activity like the below is done by the Azure Active Directory integration and not by the non-admin user indicated?
This should not be AAD integration automatically adding AAD group to organization.
Based on my test, when you see this record in Auditing log, this means that the AAD Group has been added to the Organization manually by name of user #1 at my company .

azure devops server : revoke access from Domain Admin User

I'am recently installed Azure DevOps Server 2019 in on-premises server.
However, i'am so confused : How i can block access from Domain Admin User Group : all memebers can access and manage all project and collection
I ask for idea to implement that
Thank you
EDIT :
I also try to delete the user admin group via TFS Console , but not work
azure devops server : revoke access from Domain Admin User
You could try to remove the Domain Admin User Group from its parent group, like Project Collection Administrators.
Check which group the domain admins group is a member of
In Team Foundation Server Administration Console tool, navigate to Group Membership page. Find out the Domain Admin User Group is under which groups, and remove:
Or you can move the member in that group:
Hope this helps.
It's work
I remove the AD domain admin group from the local group administrator , with this way ; only the specific user in the local group administrator , can access to all project

the web server certificate template could not be duplicated. Access Is denied

Windows Server 2016, ADFS, Certification Authority
I tried to create duplicate web server template, but it says that it's not an accessible. see below snap.
Now, My client is not technical, he provide me an account with most of the access, account is not an administrator, but I can assign many access to my self using AD Administrative service.
My only question is which access DO I need to provide to this account for creating duplicate web server certificate template?
In a multi-domain environment, I have had the same issue, if I did not select a domain controller in the root domain, respectively in the domain that hosts the CA. In my case, another domain was chosen by the console, because my computer for remote administration is in another domain (child domain).
Try the following:
Open "Certificate Template Console"
Right-click "Certificate Templates" in the left pane
Click "Connect to another writable domain controller ..."
Change the domain
click "Ok"
Try to duplicate once again. :)
I know this is an old thread, but thought I might add a fix that could help others. The account you use to login to the CA server should have Enterprise admin rights and should also be a member of local IIS_IUSRS group. If you have verified both, just logout and login to the box again and you should be able to duplicate a template.