Solved

LDAP and ADFS

Posted on 2016-10-29
1
96 Views
Last Modified: 2016-11-13
Hi All,

I have a requirement to connect a SaaS Internet Application to our AD. The Application only supports LDAP and does not support SAML. I don't want to expose our AD to the Internet for obvious reasons.

We have already setup ADFS including Web Proxies for a previous project and am hoping to use that.

if I go to our ADFS DNS Host Name (ldap://adfslogin.domain.com:389) it pops up a search box.

However I can not search for anything in our AD, and our SaaS Application Fails to connect to the address.

Can I use my ADFS Web Proxies to proxy LDAP? or should I look at Microsoft LDS, or even Open LDAP as an other Option

With this not working, and a fair bit of google searching I'm lost as to where to look for some form of config guide. Could anybody tell me the configurations steps needed, or point me in the right direction for either getting LDAP working with ADFS or LDS?

Once I have it working with LDAP I will look at moving it to LDAPS.

Cheers
TME
0
Comment
Question by:TrustGroup-UAE
1 Comment
 
LVL 22

Accepted Solution

by:
yo_bee earned 500 total points
ID: 41865125
I have my AD exposed, but I have it isolated strictly for the IP of the SaaS provider and no one else.
This is one option if you have access to configure your firewall to harden this connection.

You mentioned other options like AD LDS.  I have not tried this, but you can easily setup a test for this.
 AD LDS https://technet.microsoft.com/en-us/library/cc755080(v=ws.10).aspx

When you read through the link your scenario is there.
Management of external client computers' access to network resources

Enterprises that need to authenticate extranet client computers, such as Web client computers or transient client computers, can use AD LDS as the directory store for authentication. This helps enterprises avoid having to maintain external client information in the enterprise's domain directory.

0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question