Lelo phutha lephasiwedi ye-LDAP kungenzeka lingelona iphasiwedi yomsebenzisi
Ukwehluleka kwe-bind kungavela ku-akhawunti yesevisi noma kububanzi bokusesha, hhayi kumsebenzisi. Hlukanisa ama-bind ngaphambi kokusetha kabusha iphasiwedi yothile.
Ukusetha kabusha iphasiwedi yomsebenzisi kuyisinyathelo sokuqala esingalungile lapho ilogi ithi kuphela ukuthi i-bind inqatshiwe. Nge-plugin yohlu lwamafayela kunama-bind angaphezu kwelilodwa ekungeneni okukodwa, futhi ukunqatshwa kungaba kwe-akhawunti yesevisi eyenza ukusesha. Ukusetha kabusha ubunikazi bomsebenzisi kuleso simo akushintshi lutho. Kubuye kuvimbe umuntu owayengakaze abe yinkinga.
Ukungena okukodwa, ama-bind amaningi
Isakhiwo esine-akhawunti yohlu lwamafayela ehlukile ngokuvamile senza izinyathelo ezine ngokulandelana, futhi noma isiphi sazo singaqeda ukungena.
connect to the directory and establish the configured TLS protection
bind as the configured service account
search for the user entry using the search base and filter
open a second connection and bind as that user, then evaluate groupsI-plugin yakha uxhumano lwayo lokuqinisekisa umsebenzisi ngosizo olufanayo olusingatha uxhumano lokuqala, ngakho lowo msizi ungahluleka ngesikhathi sokuxhuma, ngesikhathi sezingxoxo ze-TLS noma ngesikhathi se-bind njenge-akhawunti yesevisi. Umlayezo wezinga eliphezulu mayelana nephasiwedi wenzeka kamuva, futhi awuphethe ukuthi yibuphi ubunikazi obuhilekile. Yingakho umbhalo wephutha uwodwa ungeke usho ukuthi umsebenzisi noma i-akhawunti yesevisi inqatshiwe.
Funda imigqa engaphambi komlayezo, futhi uphawule isikhathi lapho ukwehluleka kwenzeka khona. Ukunqatshwa ekuqaleni, ngaphambi kokuba kufike umsebenzisi, kukhombisa i-akhawunti emisiwe noma indawo yokugcina. Ukunqatshwa okubonakala kumuntu oyedwa kuphela, ngemva kokusesha okuphumelele, kukhombisa umbhalo noma isimo se-akhawunti yalowo muntu.
Xhumanisa iphutha nobunikazi
Umthetho osebenzayo ukuthi kuqoshwe izinto ezintathu ndawonye: ukuthi kwehlulekile nini, yimuphi umsebenzi owawusebenza nokuthi yibuphi ubunikazi obethulwe. Ngaphandle kwaleyo ntathu, amaphutha amabili ahluke kakhulu abonakala efana kuyi-logi egcina umusho wokugcina kuphela.
| What the log shows | Identity likely refused | First thing to check |
|---|---|---|
| Failure at start-up, no user yet | Service account | DN, password, expiry, lockout |
| Search returns nothing | None, the search scope is wrong | Search base and filter |
| Failure only for one user | That user's entry | Entry state, bind DN, group rules |
Uma i-akhawunti emisiwe yehluleka, hlola leyo akhawunti nokuxhumana ngaphambi kokuthinta noma yirekhodi yomsebenzisi. Uma i-bind yomsebenzisi yehluleka ngemva kokusesha okuphumelele, hlola umbhalo owabuyiswa ukusesha, hhayi lowo obucabanga ukuthi uzobuyisa. Lezi zindlela ezimbili zabelana ngomlayezo owodwa futhi akukho okunye. Bhala ukuthi yikuphi okukhiphile, ngoba umuntu olandelayo uzobuza khona lokho.
Igama elihlukile liyidatha, akuwona umcabango
Ukushintsha ingxenye yegama ngoba ibonakala ingajwayelekile kuyindlela evamile yokwephula isakhiwo esisebenza. Indawo ezenzakalelayo yezinto zomsebenzisi ku-Active Directory iyisitsha esibizwa ngokuthi i-Users, futhi isitsha akulona uhlobo olufanayo lwento njengeyunithi yenhlangano enegama elifanayo.
Buza umphathi wohlu lwamafayela igama elihlukile langempela le-akhawunti, noma lisebenzise entweni ngokwayo. Kokubili okulandelayo kungase kulunge ohlwini lwazo, ngakho akukho okufanele kuthayiphe kusuka enkumbulweni.
CN=VPN Bind,CN=Users,DC=corp,DC=example
CN=VPN Bind,OU=Service Accounts,DC=corp,DC=exampleUkuhambisa noma ukuqamba kabusha kushintsha lelo nani ngenkathi i-akhawunti nephasiwedi kusalungile, ngakho isakhiwo esasebenza ngekota edlule singehluleka kule ngekota ngaphandle kokuthi othile athinte ubunikazi. Qhathanisa umucu omisiwe nesici samanje sohlu lwamafayela ngemva kwanoma yikuphi ukuhlelwa kabusha. Kwenze futhi ngemva kokufuduka okuthule, hhayi kuphela ngemva kokuphazamiseka okubikiwe.
Isisekelo sokusesha akusona i-akhawunti yesevisi
Ubunikazi be-bind nesisekelo sokusesha ziphendula imibuzo ehlukene: i-plugin iqinisekisa njengobani futhi ifuna abantu kuphi. I-bind ephumelele elandelwa umsebenzisi ofanayo ayikho iyinkinga yobubanzi, isihlungi noma imvume yokufunda, futhi ukushintsha igama elihlukile le-akhawunti ngesisekelo sabasebenzisi akushintshi lutho mayelana nalokho.
Qinisekisa ukuthi isevisi ilayishe isakhiwo osihlelile nokuthi indawo yokugcina, ukwethemba kwe-TLS nomodi wokuqinisekisa kwayo kuhambisana nokuhlolwa kokuphatha okusebenzayo. Ukusesha ngesandla nge-akhawunti ehlukile, noma ngokumelene nesilawuli sesizinda esihlukile, akulona ucwaningo olulinganayo.
Hlola imfihlo egciniwe, futhi uhlole ukuthi i-akhawunti inikwe amandla, iphelelwe yisikhathi noma ikhiyiwe, ngaphandle kokuphrinta iphasiwedi noma kuphi. Ukuphelelwa yisikhathi kulula ukukushiya ngoba i-akhawunti iyaqhubeka isebenza kuze kufike usuku lapho ingasasebenzi khona. Ukukhiyiwa okuzuzwe njengefa kusuka kusevisi engahlobene nakho kuthule ngokufanayo. Azikho kulezi zimo ezimbili ezikhiqiza umlayezo othiya i-akhawunti yesevisi.
Imithetho yeqembu iza ekugcineni
Ukwethembisa kwenzeka ngemva kokuba ama-bind ephumelele, ngakho ukuhlolwa kweqembu akukwazi ukuba yimbangela yokwehluleka kwe-bind, futhi ukususa imfuneko yeqembu akukwazi ukukulungisa. Uma ukungena manje kufinyelela isigaba seqembu, inkinga esele ubungaphakathi, hhayi ubunikazi.
Ukunikeza i-akhawunti yesevisi amalungelo abanzi ohlu lwamafayela ukuze iphutha linyamalale kushintsha inqubomgomo yokufinyelela yonke intshalaziso. Kuthathe njengesinqumo sezokuphepha esinokubuyekezwa kwaso, hhayi njengokulungisa umlayezo ongakawuniki ubunikazi.