geoffc's questions

I have a server where I need to use Apaches AuthLDAPNURL value, but I cannot start at any specific O, OU, or DC. For whatever reason this tree has everybody in 19 Organization (O) objects, hanging off the root of the tree. Not my choice in LDAP tree design, but so be it.

The format should be: AuthLDAPDNURL "ldaps://myserver.com:636/o=someO???(objectClass=user)"

Where right after the :636/ is the base DN to start searching from.

Can I leave it blank, and request subtree searching from the root of the tree as follows:

AuthLDAPDNURL "ldaps://myServer.com:636/??sub?(objectClass=user)"

ADFS 2.0 asserts the immutableID value in its SAML assertion during Federation attempts with Office 365.

The ImmutableId is specified at object create time in Office 365. If you use DirSync, the objectGUID is used.

If you have many AD forests that you wish consolidated to one O365 instance, DirSync is not really an option.

So if you can get your users into O365, and set a proper UPN, and ImmutableId, will ADFS be happy? And what format for the objectGUID value (A non-string value, octet/binary, whatever you wish to call it) should be passed when creating your user?
- String based GUID representation - Base64 encoded binary value

It is easy enough to do either in my case, I just need to know what ADFS is using in its assertion in its basic or default configuration for this support?

I have been looking at an Active Directory that has several thousand groups, where pairs of groups are members of each other.

GroupA has GroupB as a Member. GroupB has GroupA as a Member.

Oy. I am trying to think through possible consequences of this circular nesting of groups.

I am spoiled, and have been doing most of my LDAP work with eDirectory, which has a utility called DSTrace which is lovely, and for LDAP specifically, will show you all the bind attempts, the source IP's, the searches passed in, a summary of the matched objects returned.

When debugging an LDAP application, like SAP GRC I was trivially able to figure out what the application was doing wrong, just by watching what it did.

I know the Security Event log will have some of this information (bind attempts at least) but there has to be a better way? Is there any such functionality?

I see a question Debugging AD that is close, but only suggests login events. I need much more on a day to day basis to manage LDAP applications.

While looking at the wWWHomePage attribute in Active Directory, a web search found some questions on lousier Q&A sites, that indicate that SharePoint will populate the wWWHomePage attribute on a user in AD with their SharePoint site.

The specific question I found was how to turn this off? There was no answer there, so I would be curious to know how to turn it off.

But more importantly, what affect would there be to SharePoint if we turned this off?

We actually are planning on syncing in other data from another source into that attribute. How would that affect SharePoint, if at all?

Should the answer be that it matters, I will later ask a question if the attribute has any funny syntax requirements as I was informed that in the past the people I am working with have had problems with some values in the field, even though the schema def seems to say it is just a 2K long single valued Unicode string.

I have a system with a million ID's or so, and we will be managing new accounts in Active Directory. For a variety of reasons, using PowerShell to call Enable-MailUser (just need them in the GAL, not to give them mail boxes).

We know from this MS article that there are a number of attributes to be twiddled. But there are some if left alone that the RUS service (Recipient Update Service) will update.

We are now at a point, where the AD admins want to know what really happens under the covers in the Enable-MailUser commandlet.

I.e. Is it the PS or RUS that sets

• LegacyExchangeDN
• proxyAddresses values for X400
• textEncodedORAddress

Then the same questions in the case of a user rename.

Actually, what do you do in Exchange if the user is renamed in AD? That is the CN component changes or the sAMAccountName changes. Which is a rename event to Exchange's world view? Do you need to recall Enable-MailUser to update the user after the data changes?

I did not yet mention which Exchange version, and that is somewhat on purpose. If the answer differs by Exchange version, then that would be critical to note!

Currently working with Exchange 2007 but they intend to move to 2010 very soon now as well.

They are convinced there is very much magic in the Enable-MailUser function, and are afraid of its voodoo power. I need to peel back the covers so that we can manage what needs to be managed without superstitious fears.

As a follow up to my question Do backlinks clear in AD for deleted users I have another related but different question.

Since I am informed in the answers there that a deleted object's SID (Group or User, so assigning rights to group only minimizes the issue, and does not fix it) will remain within ACEs they have been assigned, leaving them orphaned.

Lotus Domino, which has similar issues with back references, has an adminp process to clean up such orphaned references.

Is there a similar process in AD that would allow you to clean up such orphaned SIDs floating around your domain?

Lets say you have a user in AD. They get all sorts of rights granted over time. They also get access in a remote domain that trusts your domain, to resources.

Then they leave the company and you delete their object. The deleted object becomes a tombstone object, which is meant to preserve the SID in case you wish to 'undelete' them, sort of.

So what happens to the ACE's that had their SID in it? Within the domain, my guess is after the tombstone expires it will get cleaned up. Since after all, what is the point of preserving the SID if all references to it are already gone.

What happens to the ACE's in the remote trusting domain? How does it clear up orphaned SIDs in ACE's and whatnot?

I need to migrate some files on a Netware server to an NTFS share. I want to use the MS FMU (File Migration Utility) tool to do so.

FMU requires a mapping file, to map eDirectory objects to AD objects, that it expects to have come from the MSDSS service (MS Directory Synchronization Services) but I do not wish to neither install, nor run this tool on the production environment since they are already synchronized in another fashion.

I just need a good sample of what the Migration log file should look like, and I can generate it, since the usernames are the same and the contexts in both eDirectory and AD are predictable.

I found a sample on a forum post, but it is unclear if the formatting survived or was lost, through the pre-SO/SF/SU interfacing of that forum. If you have such a file handy that you could share, or even just comment on how the file I have looks in terms of formatting, that would be great.

Session 9: {21AD8B68-2A42-459e-BD29-F082F47E71B2}  

Started: 01-30-2002 17:14  

NDS Tree: NWTRADERS_TREE  

AD Server: noiis.IIS-IS-NOT-INSTALLED.COM  

O=NWTRADERS/OU=CHARLOTTE/OU=BKD/CN=tbenUser  

CN=tben,OU=NetWare2,DC=IIS-IS-NOT-INSTALLED,DC=com  

user  

O=NWTRADERS/OU=CHARLOTTE/OU=BKD/CN=fayedo  

User  

CN=fayedo,OU=NetWare2,DC=IIS-IS-NOT-INSTALLED,DC=com  

user  

O=NWTRADERS/OU=CHARLOTTE/OU=BKD/CN=Lisag  

User  

CN=Lisag,OU=NetWare2,DC=IIS-IS-NOT-INSTALLED,DC=com  

user  

O=NWTRADERS/OU=CHARLOTTE/OU=BKD/CN=curtiss  

User  

CN=curtiss,OU=NetWare2,DC=IIS-IS-NOT-INSTALLED,DC=com  

user  

Links:

MS Services for Netware tool download
MS SFN Documentation

I get a beep that sounds like a BIOS level, at VERY loud volume, when in an MSTSC session to a server.

Which when I am listening to some audio, is almost deafining in volume. I often jump and curse at the volume of it!

Is there anyway to disable this? There is no sound card on the Windows servers, and thus no volume to turn down.

Worst is that within the Active Directory Users and Computers snapins, if I have a Find window open, and click on the background ADUC, I get one of these beeps, and it HURTS!

Any hints on how to shut that beeping down? (Same on deletes of users, and other actions).

Client is WinXP SP3, target is Win2K8 and others.

This is somewhat more of a survey question, than a specific question. (I assume that is still ok).

I work as a consultant doing Identity Management projects. We focus mostly on Novell's Identity Manager product, which we find to be quite good.

I am curious to know what IDM products you have used, and what strengths and weaknesses you have seen in them.

I can start off with Novell's product.

Lots of connectors, that are truly bidirectional, password sync included, not just pushing passwords. (We have deployed the AD, eDir, Notes, AS400, NIS/NIS+, LDAP, JDBC, HTML Screen scraper, TN3270 Screen scraper, SAP HR, SAP UM, Remedy drivers, and there are still many more we have not touched yet like the SAP GRC, Netweaver, RACF/TopSecret/ACF2 drivers)

Event driven, which can be very powerful.

Good workflow engine.

Scalable. (We have a client with 150 eDir and AD drivers in production, 500K users).

Excellent design tools. (Novell Designer for Identity Manager).

Straightforward design language for manipulating events. (DirXML Script).

There are lots of other products out there: IBM's Tivoli Identity Manager (TIM). Sun's Identity Manager Oracle Identity Manager Courion Hitachi's (formerly Mtech out of Calgary) ID-Synch and P-Synch MS ILM

Which have you used, and what has your experience been like? What strengths and weaknesses have you seen?

I am trying to contemplate how stupid an idea this would be...

I was inspired by some foolish fellow, who soon after the release of Mac OS X 10.0 took 5 USB floppy drives, plugged them into his iMac, and set up a RAID5 array on them.

Floppy RAID array.

But then I got thinking. In the office I am sitting next to a stack of 1 GB USB drives that are being given away to customers.

If I snagged say 5 or 10 of them, plugged 4 into a USB hub, duct taped them in place (You knew duct tape would come into this, once I started talking about floppy RAID arrays, right?), and set them up as a RAID5 array, how ridiculous would that be?

Ought to work, and be workable.

Now if I could find a stack of say 4GB keys and do that, a 12GB RAID5 array might be cool.

I am thinking that performance might not be too bad.

But then again, I could do a RAID 10 array for redundancy and performance I suppose.

Edit: As a side note, I think I would still stick with all the USB memory sticks on one hub, because then I can use duct tape to hold it all together.

I feel that the real value of duct tape, outweighs the perceived value of performance.

It's like lipstick on a cat. It seems like a good idea at the time, but eventually you realize that duct tape would have been a better choice.