timbo343 Posted July 13, 2016 Posted July 13, 2016 We are looking to get SMHW for 1 year at the start of September. I thought we could use SSO and things would be great. Instead, SMHW are wanting to to do a lookup into our domain. At the moment we dont have anything like this setup so i was wondering how others have setup SMHW and SSO. We do have O365 but only for Students at the moment. They are wanting to know the following: 1. Please provide the information below: The IP address or hostname of the server to connect to The port to connect to (usually 636 for the secure connection) The LDAP / Active Directory base : If you have all users in 1 OU : ou=people,dc=example,dc=com If you have more than 1 OU : ou=teachers,dc=example,dc=com|ou=students,dc=example,dc=com (notice the | separating the 2 OU) The (bind) username to use to connect to the server (this user should only have read only rights) The (bind) secret to use to connect to the server The name of the AD attribute storing the username on the ActiveDirectory server (usually ‘sAMAccountName’ or ‘userPrincipalName’ or just ‘mail’) The name of the AD attribute storing the email on the ActiveDirectory server (usually ‘mail’) The only server we show to the outside world are the HAP and Exchange servers. This is done via the smoothwall. Would i need to setup a RODC? Thanks
ITGuyWestMidlands Posted July 13, 2016 Posted July 13, 2016 Open it up on your ad server but only allow access from smhw ips
timbo343 Posted July 14, 2016 Author Posted July 14, 2016 Open it up on your ad server but only allow access from smhw ips How do you mean open it up? You mean do a port forward on the smoothwall from their IPs on port 636 to one of the DCs? Surely it would be better if i had a RODC which they talked to? Im wondering how others do it?
Achandler Posted July 14, 2016 Posted July 14, 2016 We use secure LDAP as above with them, through a Smoothwall box. On one of your external IPs, you need to forward 636 to your AD server. On the actual port forward you can specify IP addresses that the incoming connection can be made from, then its restricted to only allowed IP addresses, others just get rejected.
Steve21 Posted July 14, 2016 Posted July 14, 2016 Restrict to IP from SMHW via smoothwall port forward etc. While it's better to have a RODC etc the userbind for ldap to just read passwords (not change) doesn't need admin privelages so a normal user works fine. Steve
timbo343 Posted July 14, 2016 Author Posted July 14, 2016 We use secure LDAP as above with them, through a Smoothwall box. On one of your external IPs, you need to forward 636 to your AD server. On the actual port forward you can specify IP addresses that the incoming connection can be made from, then its restricted to only allowed IP addresses, others just get rejected. I thought that was the way to do it. I guess its under Network > Configuration > Port Forwards. Client IPs... their IPs. Local IPs... one of my external IP Addresses. Protocol... TCP Local Port 636 Target IP... One of my DCs. Target Port.. 636
howartp Posted July 14, 2016 Posted July 14, 2016 I believe an RODC in DMZ is the correct way to do it; similar to how ADFS has a proxy in DMZ. I currently have a custom school app doing secure LDAP direct to my live DC, port forwarded from their specific IP to a non-default IP address we own (ie not http://www.*.com), with a dedicated account - this will be disappearing in summer. Peter 1
Steve21 Posted July 14, 2016 Posted July 14, 2016 We did it slightly different as the LDAP is blocked at SWGFL firewall side to just their IP address as stops anyone else even attempting it but aye, there's a predefined LDAP over SSL port rule too which might be better for future proofness One thing I note though, everyone's talking about 1 IP but we were given 3 to add in, as seems there's more it can come from SMHW on (note always just the main one) Steve 1
Achandler Posted July 14, 2016 Posted July 14, 2016 Yep @timbo343 thats correct. You can also use the predefined LDAP over SSL and then put the port on preserve mode, makes no real difference of course. 1
timbo343 Posted July 14, 2016 Author Posted July 14, 2016 I believe an RODC in DMZ is the correct way to do it; similar to how ADFS has a proxy in DMZ. I currently have a custom school app doing secure LDAP direct to my live DC, port forwarded from their specific IP to a non-default IP address we own (ie not http://www.*.com), with a dedicated account - this will be disappearing in summer. Peter That would be the correct way but we dont have the money for another server license . It would be a lot easier if i had the time to move everyone to O365 which i think will happen next year. I've got too much to deal with this year what with a new phone system to oversee, cable and learn, roll out windows 10 and install projectors. We did it slightly different as the LDAP is blocked at SWGFL firewall side to just their IP address as stops anyone else even attempting it but aye, there's a predefined LDAP over SSL port rule too which might be better for future proofness One thing I note though, everyone's talking about 1 IP but we were given 3 to add in, as seems there's more it can come from SMHW on (note always just the main one) Steve Luckily we have a connection from TalkTalk and they dont block any ports so it should be straight forward. Ive got the 3 IPs from SMHW, i didnt post them up due to confidentiality. Yep @timbo343 thats correct. You can also use the predefined LDAP over SSL and then put the port on preserve mode, makes no real difference of course. Thank you
timbo343 Posted July 14, 2016 Author Posted July 14, 2016 You not on Datacentre licenses? We are for the VM hosts yeah, but i would want the machine to be a physical machine sat in a corner.
timbo343 Posted July 14, 2016 Author Posted July 14, 2016 V L A N .... I know, i know, i know. Maybe ill set it up after summer. That's another thing to add to my list of things to do .
timbo343 Posted July 20, 2016 Author Posted July 20, 2016 Yep @timbo343 thats correct. You can also use the predefined LDAP over SSL and then put the port on preserve mode, makes no real difference of course. So SMHW have come back to me and said they are getting errors: Connection reset by peer – SSL_connect Normally i would keep trying different options but with this been a hosted solution, it gets a bit teidious going back to them asking them to keep trying. I've got the Port Forward setup as stated above however is there anything else that needs to be setup?
Steve21 Posted July 20, 2016 Posted July 20, 2016 Did you setup your certs locally etc? Have you tested the LDAP over SSL connection locally with the test tools? Steve
Steve21 Posted July 20, 2016 Posted July 20, 2016 Also what external connection did you give to SMHW/settings? We had to use an external URL (SMHWLDAP.school.co.uk etc) to match our SSL certs else we'd get an error with the actual bind as using our IP wouldn't match the cert addresses (unless you have a special cert?) Steve
timbo343 Posted July 20, 2016 Author Posted July 20, 2016 Did you setup your certs locally etc? Have you tested the LDAP over SSL connection locally with the test tools? Steve I haven't got any certs for it, SMHW said they dont need them: Me: As for the certificate, there is no certificate on this IP address, i wasn't told we needed one if we did. Them: we are not receiving any error messages that would indicate the the username or password is incorrect just yet, as we would normally expect. Are you by any chance using a self-signed certificate or something similar? I've been thrown in the deep end with this and literally had to work out everything myself. I wasn't even involved in anything. - - - Updated - - - Also what external connection did you give to SMHW/settings? We had to use an external URL (SMHWLDAP.school.co.uk etc) to match our SSL certs else we'd get an error with the actual bind as using our IP wouldn't match the cert addresses (unless you have a special cert?) Steve We have given them our IP Address only.
Steve21 Posted July 20, 2016 Posted July 20, 2016 If you're using LDAP over SSL you need a cert to secure it. (Assuming you're using port 636, rather than plain unsecure 389). By default it'd use a self signed one internally, but this then wouldn't be trusted externally. We had to import our wildcard SSL cert onto our DC that's being used for LDAPS to enable a secure connection, then map an external URL to that connection as trying via IP errored out as it wasn't a valid URL for the cert to match to. Unless we did it a long way but that's what everything online seems to suggest for it. Steve 1
timbo343 Posted July 20, 2016 Author Posted July 20, 2016 If you're using LDAP over SSL you need a cert to secure it. (Assuming you're using port 636, rather than plain unsecure 389). By default it'd use a self signed one internally, but this then wouldn't be trusted externally. We had to import our wildcard SSL cert onto our DC that's being used for LDAPS to enable a secure connection, then map an external URL to that connection as trying via IP errored out as it wasn't a valid URL for the cert to match to. Unless we did it a long way but that's what everything online seems to suggest for it. Steve Looks like im going to have to set up that wildcard ive been planning.
Steve21 Posted July 20, 2016 Posted July 20, 2016 Doesn't need to be wildcard as such, just whatever URL they're using to connect to needs to match it. But as it's a port based thing you could use http://www.school.STUPIDURL.co.uk:636 etc and just use your normal SSL Just as we got a wildcard I like different URLS Steve
Achandler Posted July 21, 2016 Posted July 21, 2016 They are slow at gettign back to you as well normally! Have you tested connecting to your LDAP on 636 within the school to make sure that isn't a problem? E.G internal firewalls etc.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now