How can I limit a ldap query to just a few OUs ? LDAP bind to a domain user accountInvalid user names when creating a LDAP accountHow to automatically create user accounts ( SSH + LDAP )How to limit the users in LDAP to logon to a specific subset of Linux machinesCan an LDAP query on AD provide the netbios domain name for a single account when using the Global Catalog?openLDAP restrict userHow can I get FreeNAS to work with LDAP authentication?How do I create a read only user for LDAP queries in Microsoft Active Directory for a PHP query program?How to filter a LDAP query for users which are authenticated?SSSD for LDAP user authentication only (just bind) on Ubuntu, local databases for uid and groupsLinux: How to optimally configure data partition on multi user system (including LDAP users)?
sed + add word before string only if not exists
Is it expected that a reader will skip parts of what you write?
Single-key teletype?
Are there any important biographies of nobodies?
Which languages would be most useful in Europe at the end of the 19th century?
Moving points closer to polyline using ModelBuilder?
Teaching a class likely meant to inflate the GPA of student athletes
Why am I getting a strange double quote (“) in Open Office instead of the ordinary one (")?
Thread Pool C++ Implementation
Is it possible to have 2 different but equal size real number sets that have the same mean and standard deviation?
Projective subvarieties of a quasiprojective variety
CSV how to trim values to 2 places in multiple columns using UNIX
Why 1,2 printed by a command in $() is not interpolated?
60s or 70s novel about Empire of Man making 1st contact with 1st discovered alien race
Meaning of 'lose their grip on the groins of their followers'
Extreme flexible working hours: how to get to know people and activities?
Check if three arrays contains the same element
How to hide rifle during medieval town entrance inspection?
Fermat's statement about the ancients: How serious was he?
Is it a bad idea to to run 24 tap and shock lands in standard
Writing an augmented sixth chord on the flattened supertonic
Determining fair price for profitable mobile app business
A map of non-pathological topology?
Why was this person allowed to become Grand Maester?
How can I limit a ldap query to just a few OUs ? LDAP bind to a domain user account
Invalid user names when creating a LDAP accountHow to automatically create user accounts ( SSH + LDAP )How to limit the users in LDAP to logon to a specific subset of Linux machinesCan an LDAP query on AD provide the netbios domain name for a single account when using the Global Catalog?openLDAP restrict userHow can I get FreeNAS to work with LDAP authentication?How do I create a read only user for LDAP queries in Microsoft Active Directory for a PHP query program?How to filter a LDAP query for users which are authenticated?SSSD for LDAP user authentication only (just bind) on Ubuntu, local databases for uid and groupsLinux: How to optimally configure data partition on multi user system (including LDAP users)?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
For LDAP queries I created a special account (domain user) located in :
OU=work, CN=do, CN=apropos, CN=tev
How can I restrict the read permission of this account to just:
OU=trouble, OU=now, CN=do, CN=apropos, CN=tev
Many Thanks
ldap
asked Sep 17 '15 at 17:26
apacapac
11
add a comment |
For LDAP queries I created a special account (domain user) located in :
OU=work, CN=do, CN=apropos, CN=tev
How can I restrict the read permission of this account to just:
OU=trouble, OU=now, CN=do, CN=apropos, CN=tev
Many Thanks
ldap
asked Sep 17 '15 at 17:26
apacapac
11
add a comment |
For LDAP queries I created a special account (domain user) located in :
OU=work, CN=do, CN=apropos, CN=tev
How can I restrict the read permission of this account to just:
OU=trouble, OU=now, CN=do, CN=apropos, CN=tev
Many Thanks
ldap
asked Sep 17 '15 at 17:26
apacapac
11
For LDAP queries I created a special account (domain user) located in :
OU=work, CN=do, CN=apropos, CN=tev
How can I restrict the read permission of this account to just:
OU=trouble, OU=now, CN=do, CN=apropos, CN=tev
Many Thanks
ldap
ldap
asked Sep 17 '15 at 17:26
apacapac
11
asked Sep 17 '15 at 17:26
apacapac
11
asked Sep 17 '15 at 17:26
apacapac
11
asked Sep 17 '15 at 17:26
apacapac
11
asked Sep 17 '15 at 17:26
apacapac
11
11
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
This is not easy as it seems, because the default permissions grant read access on all OUs to all authenticated users, regardless of group membership; in order to achieve what you want, you need to either modify the default permissions (with possible heavy impact on various applications), or use explicit deny ACEs for your restricted users.
See here for more info: http://windowsitpro.com/active-directory/hiding-data-active-directory.
answered Sep 17 '15 at 17:33
MassimoMassimo
53.5k44171288
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f723092%2fhow-can-i-limit-a-ldap-query-to-just-a-few-ous-ldap-bind-to-a-domain-user-acco%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
This is not easy as it seems, because the default permissions grant read access on all OUs to all authenticated users, regardless of group membership; in order to achieve what you want, you need to either modify the default permissions (with possible heavy impact on various applications), or use explicit deny ACEs for your restricted users.
See here for more info: http://windowsitpro.com/active-directory/hiding-data-active-directory.
answered Sep 17 '15 at 17:33
MassimoMassimo
53.5k44171288
add a comment |
This is not easy as it seems, because the default permissions grant read access on all OUs to all authenticated users, regardless of group membership; in order to achieve what you want, you need to either modify the default permissions (with possible heavy impact on various applications), or use explicit deny ACEs for your restricted users.
See here for more info: http://windowsitpro.com/active-directory/hiding-data-active-directory.
answered Sep 17 '15 at 17:33
MassimoMassimo
53.5k44171288
add a comment |
This is not easy as it seems, because the default permissions grant read access on all OUs to all authenticated users, regardless of group membership; in order to achieve what you want, you need to either modify the default permissions (with possible heavy impact on various applications), or use explicit deny ACEs for your restricted users.
See here for more info: http://windowsitpro.com/active-directory/hiding-data-active-directory.
answered Sep 17 '15 at 17:33
MassimoMassimo
53.5k44171288
This is not easy as it seems, because the default permissions grant read access on all OUs to all authenticated users, regardless of group membership; in order to achieve what you want, you need to either modify the default permissions (with possible heavy impact on various applications), or use explicit deny ACEs for your restricted users.
See here for more info: http://windowsitpro.com/active-directory/hiding-data-active-directory.
answered Sep 17 '15 at 17:33
MassimoMassimo
53.5k44171288
answered Sep 17 '15 at 17:33
MassimoMassimo
53.5k44171288
answered Sep 17 '15 at 17:33
MassimoMassimo
53.5k44171288
answered Sep 17 '15 at 17:33
MassimoMassimo
53.5k44171288
53.5k44171288
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f723092%2fhow-can-i-limit-a-ldap-query-to-just-a-few-ous-ldap-bind-to-a-domain-user-acco%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
