LDAPS

[Gongalong]

Hi folks,

 

Does anyone know if LDAP runs by default on a 2019 DC?

 

I note it's not installed as a role by default, but when you add it you then get a message about the default LDAP ports conflicting with existing services. I'm wondering if this is beacuse a DC already runs LDAP.

 

Thanks

[mavhc]

LDAP is a protocol, so it's not run, but spoken.

 

What exact Role are you trying to enable?

[Gongalong]

I'm trying to connect Jamf School (previously ZuluDesk) to LDAP on our DC. Jamf School will only connect via LDAPS, for good reason I suspect as a cloud service. I've already put in place port forwards and opened the firewall, restricted to the public IPs that Jamf use.

 

Jamf point you at this guide to set it up, but it looks rather old https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx

 

I've tried using this guide, which includes a section on activating LDAP, so the question is do I need to do that? https://blogs.msdn.microsoft.com/microsoftrservertigerteam/2017/04/10/step-by-step-guide-to-setup-ldaps-on-windows-server/

 

As above, when I try and add the LDAP to the DC it complains that I can't use the default ports beacuse they're used by AD.

[oododkodkdo]

Have you installed ADCS and restarted the DC?

[Gongalong]

Definitely installed, and I've created a CA (I couldn't create an Enterprise CA as it was greyed out, not sure why). I then created a certificate. I didn't reboot though, so will try that tomorrow.

[mavhc]

ah, ok, LDS is an LDAP server, and AD is an LDAP server. LDS is if you want to run a different LDAP server to the one that's storing all your user credentials. Eg you're running a website where people login and want to store their passwords for the website, but not let them log into the computer.

 

I assume you're wanting to use your existing usernames/passwords, so you want to connect to the AD LDAP, don't need to install LDS.

[Gongalong]

I wasn't sure exactly, but I see now that LDAP is already part of a DC - as you say, no need to install the separate LDAP server role. I tested using LDP.EXE and could connect via LDAP on the default unencrypted port 389 to the DC.

 

The problem is getting it to work over LDAPS. I have tried to follow the guide that Jamf link to https://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx but on a 2019 server there is no certificate templates section. I added the Certificate Authority role to the server, and created a certificate (the option to create an Enterprise CA was greyed out, not sure of the signifiance of that), but clearly something's missing as I cannot connect to LDAP using port 636. This is just testing locally with LDP.EXE, so I can understand why the cloud connection from Jamf isn't working, albeit lots more potential for things to go wrong with that.

 

Jamf say that we should not need to import the certificate on their site, as it should be requesting the certificate and then installing automatically.

 

I'm stuck as to where to go from here...

[Brimstone]

I would ask the question here..

 

https://www.jamf.com/jamf-nation/