Qaladka password-ka LDAP laga yaabaa inuusan ahayn password-ka isticmaalaha
Guuldarada bind waxay ka iman kartaa akoonka adeegga ama baaxadda raadinta, ma aha isticmaalaha. Kala sooc bind-yada ka hor intaadan dib u dejinin password-ka qof.
Dib u dejinta password-ka isticmaalaha waa tallaabada koowaad ee khaldan marka log-ku uun sheegayo in bind la diiday. Plugin-ka hagaha waxaa ku jira in ka badan hal bind hal login, diidmaduna waxay ka tirsan kartaa akoonka adeegga ee sameeya raadinta. Dib u dejinta aqoonsiga isticmaalaha kiiskaas waxba ma beddelo. Waxay kaloo xidhaa qof aan waligiis dhibaatada ahayn.
Hal login, bind badan
Habaynta leh akoon hagaha gaar ah waxay caadi ahaan sameysaa afar tallaabo si isku xigta, mid kastaana waxay dhammayn kartaa login-ka.
connect to the directory and establish the configured TLS protection
bind as the configured service account
search for the user entry using the search base and filter
open a second connection and bind as that user, then evaluate groupsPlugin-ku wuxuu isku xirka xaqiijinta isticmaalaha ku dhisaa isla kaaliyaha maamula isku xirka koowaad, sidaas darteed kaaliyahaas wuu guuldaraystaa karaa inta la xiriirayo, inta TLS laga wada hadlayo ama inta bind loo sameynayo akoonka adeegga. Farriinta heerka sare ee password-ka waxaa la abuuraa mar dambe, mana qaadanayso aqoonsiga ku lug lahaa. Taas darteed qoraalka qaladka oo keliya ma sheegi karo isticmaalaha ama akoonka adeegga la diiday.
Akhri sadarrada ka hor farriinta, oo xusuusnow waqtiga uu guuldaradu dhacday. Diidmo bilowga, ka hor inta aan isticmaale iman, waxay tilmaamaysaa akoonka la habbeeyay ama barta ugu dambeysa. Diidmo uun hal qof u muuqata, ka dib raadin guuleysatay, waxay tilmaamaysaa gelitaanka ama xaaladda akoonka qofkaas.
Ku xir qaladka aqoonsi
Xeerka waxqabadku waa in saddex shay la wada diiwaangeliyaa: goorta ay guuldaraysatay, hawsha socotay iyo aqoonsiga la soo bandhigay. La'aanta saddexdan, laba cillad oo aad u kala duwan ayaa isku mid ka muuqda log-ka kaydiya oo kaliya jumladda ugu dambeysa.
| What the log shows | Identity likely refused | First thing to check |
|---|---|---|
| Failure at start-up, no user yet | Service account | DN, password, expiry, lockout |
| Search returns nothing | None, the search scope is wrong | Search base and filter |
| Failure only for one user | That user's entry | Entry state, bind DN, group rules |
Haddii akoonka la habeeyay guuldaraysto, baadh akoonkaas iyo isku xirka ka hor intaadan taaban diiwaan isticmaale. Haddii bind-ka isticmaalaha guuldaraysto ka dib raadin guuleysatay, baadh gelitaanka raadintu soo celisay, ma aha kan aad u malaynayso inuu soo celin doono. Labada waddo waxay wadaagaan hal farriin oo keliya. Qor midka aad ka reebtay, maxaa yeelay qofka xiga wuxuu weydiin doonaa si sax ah taas.
Magaca kala soocida waa xog, ma aha mala-awaal
Beddelka qayb magac sababtoo ah wuu u muuqdaa mid aan la aqoon waa hab caadi ah oo habaynta shaqeysa lagu jebiyo. Goobta caadiga ah ee walxaha isticmaalaha ee Active Directory waa weel lagu magacaabo Users, weelkuna ma aha isla nooca shay ee unug hay'ad oo magac la mid ah.
Weydii maamulaha hagaha magaca kala soocida dhabta ah ee akoonka, ama ka akhri shayga laftiisa. Labada hoose waxay sax noqon karaan hagahooda, sidaas darteed midkoodna waa in aan laga qorin xusuusta.
CN=VPN Bind,CN=Users,DC=corp,DC=example
CN=VPN Bind,OU=Service Accounts,DC=corp,DC=exampleWareejin ama magac beddelid waxay beddeshaa qiimahaas iyadoo akoonka iyo password-ku ansax yihiin, sidaas darteed habayn shaqeysay rubucii hore way guuldaraysan kartaa rubucan iyada oo aan qof taaban aqoonsiga. Isbarbar dhig xarigga la habeeyay iyo sifooyinka hadda ee hagaha ka dib dib u habeyn kasta. Sidoo kale samee ka dib hijrad deggan, ma aha oo kaliya ka dib khalkhal la soo sheegay.
Saldhigga raadinta ma aha akoon adeeg
Aqoonsiga bind iyo saldhigga raadinta waxay ka jawaabaan su'aalo kala duwan: plugin-ku yaa ku xaqiijiyaa iyo xaggee dadka ka raadiyaa. Bind guuleystay oo aan lahayn isticmaale u dhigma waa dhibaato baaxad, shaandhayn ama fasax akhris, beddelka magaca kala soocida akoonka oo lagu beddelo saldhigga isticmaalayaashu waxba kama beddelo taas.
Xaqiiji in adeeggu rartay habaynta aad tafatirtay iyo in barta ugu dambeysa, kalsoonida TLS iyo qaabka xaqiijinta ay la jaanqaadaan imtixaan maamul oo shaqeeya. Raadin gacan ah oo akoon kale, ama ka gees ah maamule domain kale, ma aha tijaabo u dhigma.
Hubi sirta kaydsan, oo hubi in akoonku furay, dhacay ama xiran yahay, iyada oo aan password-ka meelna lagu daabicin. Dhicidda waa sahlan tahay in la seego maxaa yeelay akoonku wuu shaqeeyaa ilaa maalinta uu joojinayo. Xiritaan laga dhaxlay adeeg aan xiriir la lahayn ayaa isna aamusnaan leh. Midkoodna xaaladahaas ma abuuro farriin sheegta akoonka adeegga.
Xeerarka kooxda ayaa ugu dambeeya yimaada
Oggolaanshaha waxa uu socdaa ka dib bind-yadu guuleystaan, sidaas darteed hubinta kooxdu ma noqon karto sababta guuldarada bind, oo meesha looga saaro shuruudda kooxdu ma dayactiri karto. Haddii login-ku hadda gaaro heerka kooxda, dhibaatada hadhay waa xubin-nimo, ma aha aqoonsi.
Siinta akoonka adeegga xuquuqo hagaha ballaaran si qaladku u lunto waxay beddeshaa siyaasadda gelitaanka deployment-ka oo dhan. Ula dhaqan tan sida go'aan amni oo leh dib u eegis u gaar ah, ma aha sida hagaajin farriin aadan wali u nisbayn aqoonsi.