How An Active Directory Works; How To Bind A 'Dn' In An In Ldap Configuration - NETGEAR STM150 Appliance Reference Manual

ProSecure Web/Email Security Threat Management (STM) Appliance Reference Manual

How an Active Directory Works

Understanding how a typical Active Directory (AD) works might be of help when specifying the
settings for the LDAP and Active Directory domains on the STM.
The following applies to a typical AD:
• Organizational unit (ou), common name (cn), and domain controller (dc) can all be used to
build a search base in the AD. The following applies to the 'ou' and 'cn' containers:
– An AD administrator can create an ou but cannot create a cn that was built in the AD
server.
– An AD administrator can apply a global policy objects (gpo) to and ou, but not to a cn.
• An ou is created in the root node (for example, dc=companyname, dc=com) of the hierarchy.
In a company AD, an ou often represents a regional office or department.
• A groups is created under cn=users.
• A users is created under each ou so that the user can logically show in a tree of the AD server.
• A relationship between a group and users is built using their attributes (by default: member
and memberOf). These will show in a lookup result.
The following is an example of how to set the search base:
If in a company AD server "cn=users" and "ou=companyname" and both are specified under
"dc=companyname,dc=com", the search base must be set as "dc=companyname,dc=com" in order
to search both users and groups.
If the size limit is exceeded so that "dc=companyname,dc=com" misses some entries during the
lookup process, a user can still be properly authenticated. However, to prevent the size limit from
being exceeded, an AD administrator must set a larger value in the LDAP server configuration so
that the entire list of users and groups is returned in the lookup result. Another workaround is to
use a specific search name or a name with a wildcard in the lookup process, so that the subset of
the entire list is returned in the lookup result.

How to Bind a 'dn' in an in LDAP Configuration

Understanding how to bind a distinguished name (dn) in an LDAP configuration might be of help
when specifying the settings for the LDAP and Active Directory domains on the STM.
In this example, the LDAP domain name is "ABC.com" and the LDAP server has IP address
192.168.35.115 on port 389. To bind a user with the name Jamie Hanson with the LDAP server:
1. On a computer that has access to the Active Directory (AD), open the Active Directory for
Users and Computers.
5-12 Managing Users, Groups, and Authentication
v1.0, September 2009