Home / user-81170

ixe013's questions

Martin Hope
ixe013
Asked: 2016-02-24 14:00:40 +0800 CST
  • 3

I have an Android application that declares an intent using a in-house protocol. You can launch it by opening a webpage that contains a link to :

myapplication://foo-bar

I want to an URL on my website that will anwser a 301 Redirect to that custom, in-house, made-up protocol. The idea is that our Android application will be launched when the user clicks on that link (the app is already installed).

I could simply add an anchro link in an HTML page, but I can't modify the HTML. I have to use Apache. I tried this mod_rewrite rule:

RewriteRule "^/app$" myapplication://foo-bar [R=permanent,L]

But it always prepend the host name in front, so I get this in the Location header:

Location: https://example.com/myapplication://foo-bar

How can I instruct mod_rewrite to use the URL as-is (myapplication://foo-bar)?

apache-2.2
Martin Hope
ixe013
Asked: 2016-01-20 10:39:25 +0800 CST
  • 0

I am trying to debug a 401 error in IIS that happens when serving static files to an anonymous user.

Let's say I'm trying to access https://example.com/sso.css. That file physically resides on D:\website\sso.css.

Running procmon, I noticed that the w3wp.exe tries to read D:\website\sso.css\web.config treating the static resource as a folder instead of a file, getting a "File not found" error from the filesystem.

Why is IIS appending \web.config when trying to open a file on the physical file system?

iis
Martin Hope
ixe013
Asked: 2015-07-17 14:33:00 +0800 CST
  • 0

I have a Apache 2.2 that hosts a proprietary (commercial) authentication module. That modules looks at every requests and might let them through if they are flagged and "anonymous ok" in the back-end authentication software.

One such anonymous resource is a small gif queried by the load balacer fronting our Apaches, named /lb.gif.

When there is a problem with the authentication software, its module does not take any chances and blocks everything, including our load-balancer beacon file. The load-balancer thinks the site is down and stops sending traffic to it.

I want Apache not to send this particular request to other modules. This kind of works:

RewriteEngine On
RewriteRule ^/lb.gif$ - [R=200]

Seeing this, Apache returns some HTML with a 200 result: 

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>200 OK</title>
</head><body>
<h1>OK</h1>
<p>The server encountered an unknown error, possibly due to misconfiguration.
Contact the server administrator: [no address given]<p>
More information about this error may be available
in the server error log.</p>
</body></html>

It satisfies the load-balancer, but confuses another tool we are using for monitoring.

Is there a way to tell Apache to stop processing and return immediately a resource, not sending the request further down the chain of modules?

apache-2.2
Martin Hope
ixe013
Asked: 2014-06-03 10:00:22 +0800 CST
  • 12

I have a Kerberos problem with a Linux host connecting to a Windows KDC. I suspect that Kerberos key with the wrong version is to blame.

One way to be shure would be to delete the SPN and create it anew, but this is in a production environment and I must debug in "read-only", if you will.

How can I retreive the current Kerberos KVNO from a principal in Active Directory ?

linux
Martin Hope
ixe013
Asked: 2012-12-14 18:31:21 +0800 CST
  • 4

I often use openssl s_client to test and debug SSL connections (to LDAPS or HTTPS services). It allows me to isolate the problem down to SSL, without anything getting in the way.

I want to do something similar with Kerberos. I would like to use a small test, which would show :

  1. The initial machine logon (the computer account)
  2. The initial AS request from the user requesting a service
  3. The kerberos exchange of the user getting a ticket
  4. (optional) the request being sent to the service

I can do steps 1, 2 and 3 if I run Wireshark on a KDC, but it is usually not an option. I can manage to capture steps 2, 3 and 4 if I monitor trafic on the client.

Is there tool that would allow me to capture the every Kerberos login steps starting with the computer account, without running Wireshark on the KDC ?

windows-server-2008
Martin Hope
ixe013
Asked: 2012-11-29 14:05:09 +0800 CST
  • 6

I have two LDS servers on the same subnet. They replicate well. If I change an attribute, it gets replicated after 15 seconds.

LDS is configured to honor password policies. When a user makes too many wrong password attemps, his account is locked and that user's lockoutTime attribute is set accordingly.

But lockoutTime is not replicated as urgent. In fact, it is not replicated unless there is another change somewhere in the directory. The lockoutTime attribute will be replicated.

Here is an (edited Wireshark) trace. It shows normal replication trafic

No.   Time     Protocol Length Info
  133 16:23:02 DRSUAPI  562    DsGetNCChanges request
  134 16:23:02 DRSUAPI  3042   DsGetNCChanges response
  152 16:23:17 DRSUAPI  562    DsGetNCChanges request
  157 16:23:17 DRSUAPI  242    DsGetNCChanges response
  230 16:24:57 DRSUAPI  562    DsGetNCChanges request
  231 16:24:57 DRSUAPI  2930   DsGetNCChanges response
  246 16:25:12 DRSUAPI  562    DsGetNCChanges request

Right after that, I lock the user (with a FOR loop and ldifde). Nothing happens, until I give up and change the description attribute on the user, then about 15 seconds later I see the replication go through.

 1984 16:31:05 DRSUAPI  562    DsGetNCChanges request
 1985 16:31:05 DRSUAPI  2930   DsGetNCChanges response

The lockoutTime and description is replicated. As stated here, if I set lockoutTime=0, regular replication occurs after 15 seconds !

I have enabled replication diagnostics. Nothing shows up in the instance's logs because there is no replication. When the replication does trigger, I see a bunch of event 1239 for the up-to-date attributes, two 1240 events. One for the attributes lockoutTime and one for description (which I used to trigger replication).

I have enabled change notification between sites, restarted both services, but it did not make any difference. Maybe because the two servers are on the same subnet.

The Active Directory Technical Specification clearly lists lockoutTime as one of the urgent attributes to replicate.

What could be preventing urgent replication of the lockoutTime attribute ?

windows-server-2008
Martin Hope
ixe013
Asked: 2012-11-16 13:41:33 +0800 CST
  • 1

I have a AD-LDS instance running on a Server 2008 R2. I have this application partition, created at installation :

dc=enterprise,dc=example,dc=com

I have succesfully followed this procedure to create application partitions. They are named :

cn=stuff,dc=enterprise,dc=example,dc=com
cn=things,dc=enterprise,dc=example,dc=com

If I configure my client(s) to follow referals, I can search from dc=enterprise,dc=example,dc=com and find objects under cn=stuff and cn=things.

How can I create (or move after the fact) the stuff and things partitions so they are logically located under a OU under the initial partition, ending up with something like :

cn=stuff,ou=applications,dc=enterprise,dc=example,dc=com
cn=things,ou=applications,dc=enterprise,dc=example,dc=com
windows-server-2008
Martin Hope
ixe013
Asked: 2012-09-29 17:43:01 +0800 CST
  • 1

Doing performance testing on an AD-LDS (Server 2008 R2 64 bits), we created a milion user in a single OU. We also created a single group object and made those milion users member of that group.

When we try to list the milion of users ADSIEdit times out with an error message saying it cannot display that many users. Fine.

But if we open the properties for the group, ADSIEdit freezes, eating up all available memory and CPU trashing (nearly 60M page faults in under an hour).

AD-LDS (running on another computer) is barely hitting the 1% CPU mark, servicing other ldap requests as if nothing were.

We can throw more memory at the problem, but more users will have to be managed one day and we will be back at square one.

Is there a way to set a limit in ADSIEdit so that it will not hang the computer when retreving a very large multi-value object ?

windows
Martin Hope
ixe013
Asked: 2012-09-11 11:45:08 +0800 CST
  • 2

Microsoft published the recommended maximum limits for users in an Active Directory group. It basically says :

Starting with Windows Server 2003, the ability to replicate discrete changes to linked multivalued properties was introduced as a technology called Linked Value Replication (LVR).

and

This allows the number of group memberships to exceed the former recommended limit of 5,000 for Windows 2000 or Windows Server 2003 at a forest functional level of Windows 2000.

Given the replication meta data below, can anybody tell me what is the maximum number of users a AD-LDS group can hold ?

Getting 'CN=Member,CN=Schema,CN=Configuration,CN={67B333FE-ADB4-430D-AAEE-D4CCE4B98A2E}' metadata...
23 entries.
 AttID     Ver   Loc.USN                      Originating DSA            Org.USN         Org.Time/Date
 =====     ===   =======                      ===============        =======         =============
     0       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
     3       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 20001       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 20002       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 2001e       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 20020       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 20021       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 20032       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 200a9       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 200c2       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 200da       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 200e2       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 200e7       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 20119       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 2014e       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 201cc       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 90001       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 90094       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 90095       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 900aa       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 90177       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 9027f       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
 9030e       1        95    8ba30efb-9aa4-4e55-8f7c-268e3dcc536b          95    2012-07-17 14:25:49
users
Martin Hope
ixe013
Asked: 2012-03-20 18:23:44 +0800 CST
  • 1

I have an Active Directory Lightweight Directory Services set up. I have objects that represent users in the Active Directory (Domain_A). I have set their objectSID attribute, and users can authenticate to LDS with their Active Directory password. I love it.

Here is a formatted Wireshark network trace of a successful LDS proxy authentication :

LDAP    bindRequest(1) "cn=ixe013,cn=Users,cn=Fizz,dc=Buzz,dc=tst" simple 
KRB5    AS-REQ
KRB5    KRB Error: KRB5KDC_ERR_PREAUTH_REQUIRED
KRB5    AS-REQ
KRB5    AS-REP
KRB5    TGS-REQ
KRB5    TGS-REP
LDAP    bindResponse(1) success 
LDAP    unbindRequest(2)

I want to bring in new users, from a different Active Directory (Domain_B) that has not trust relationship whatsoever with the Active Directory from Domain_A.

One LDS instance, two Active Directory

Is there a way to tell LDS in which domain to look for users or does it always look in the domain it is in, maybe by using another protocol than Kerberos ?

+I figured out user provisionning, no need to mention it. Thanks !

active-directory ldap kerberos ad-lds
Martin Hope
ixe013
Asked: 2012-02-17 06:47:53 +0800 CST
  • 2

I have to query attributes for about 10 000 users. I have an ldapsearch query that works for a single user. Here is the releveant part, where I search for the objectGUID attribute of user abc123 :

ldapsearch -h somehost.com -D "CN=valid_user,DC=valid_everything" -q -b "OU=valid_ou,DC=valid_dc" -s sub "cn=abc123" -L objectGUID

I would like to put all my queries in a file, and use the -f myqueries.txt option. Since this query will be carried out over SSL, I would like to avoid the 10k SSL negotiations I would get if I was to run 10k separate ldapsearch.

I tried with a file that looks like this :

(cn=abc123)
(cn=lmn456)
(cn=xyz789)

With this modified command line :

ldapsearch -v -h somehost.com -D "CN=valid_user,DC=valid_everything" -q -b "OU=valid_ou,DC=valid_dc" -s sub -f myqueries.txt -L objectGUID

But I always get an Bad search filter error.

I was not able to determine what version of ldapsearch this is. It is running on a custom Linux distribution.

How can I use the -f option to make ldapsearch use queries read from a file ?

ldap