<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial" size="2"><span style="font-size:10pt;">
<div>I've configured my server to successfully authenticate against AD using my ldap module.</div>
<div> </div>
<div>However, my users are in multiple OUs, and I can only specify one basedn at a time. I know that's probably not good directory structure, but I don't manage our directory. What approach to others use to search multiple basedns?</div>
<div> </div>
<div>In case it would help, here is the relevant portions from my ldap module, which is curently working (I've remved most comments to make it concise:</div>
<div> </div>
<div>ldap {</div>
<div> server = xxx</div>
<div> identity = "cn=ldapuser,ou=service accounts,dc=cphc,dc=local"</div>
<div> password = xxx</div>
<div> basedn = "dc=cphc,dc=local" ***This doesn't work without a specific OU. My users are in multiple OUs****</div>
<div> #basedn = "OU=CHA-Staff (No Folder Redir),DC=cphc,DC=local"</div>
<div> filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})"</div>
<div> </div>
<div> ldap_connections_number = 5</div>
<div> timeout = 4</div>
<div> timelimit = 3</div>
<div> net_timeout = 1</div>
<div> </div>
<div> tls {</div>
<div> start_tls = no</div>
<div> }</div>
<div> </div>
<div> dictionary_mapping = ${confdir}/ldap.attrmap</div>
<div> </div>
<div> edir_account_policy_check = no</div>
<div> </div>
<div> groupname_attribute = cn</div>
<div> groupmembership_filter = "(member=%{check:Ldap-UserDn})"</div>
<div> groupmembership_attribute = member</div>
<div> </div>
<div> #compare_check_items = yes</div>
<div> #do_xlat = yes</div>
<div> access_attr_used_for_allow = yes</div>
<div>}</div>
<div> </div>
<div>*One thing that confuses me is that ldapsearch works fine using basedn="dc=cphc,dc=local".</div>
<div> </div>
<div> </div>
<div>Any my error output:</div>
<div> </div>
<div>[ldap] performing user authorization for jpjohnson</div>
<div>[ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details</div>
<div>[ldap] expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=jpjohnson)</div>
<div>[ldap] expand: dc=cphc,dc=local -> dc=cphc,dc=local</div>
<div>rlm_ldap: ldap_get_conn: Checking Id: 0</div>
<div>rlm_ldap: ldap_get_conn: Got Id: 0</div>
<div>rlm_ldap: attempting LDAP reconnection</div>
<div>rlm_ldap: closing existing LDAP connection</div>
<div>rlm_ldap: (re)connect to tch-nt2.cphc.local:389, authentication 0</div>
<div>rlm_ldap: bind as cn=ldapuser,ou=service accounts,dc=cphc,dc=local/xxx to tch-nt2.cphc.local:389</div>
<div>rlm_ldap: waiting for bind result ...</div>
<div>rlm_ldap: Bind was successful</div>
<div>rlm_ldap: performing search in dc=cphc,dc=local, with filter (sAMAccountName=jpjohnson)</div>
<div>rlm_ldap: ldap_search() failed: Operations error</div>
<div>[ldap] search failed</div>
<div>rlm_ldap: ldap_release_conn: Release Id: 0</div>
<div>++[ldap] returns fail</div>
<div> </div>
<div>-Jeff</div>
<div> </div>
</span></font>
</body>
</html>