checking other users username and password about go-ad-auth HOT 2 CLOSED

Thanks Kory

It looks like it's a restrictive policy preventing users looking up there own attributes.

Doing a bind with the user to check the password is correct and then using a more privileged account to look up attributes seems to work.

Thanks for getting back to me. Much appreciated!

Simon

from go-ad-auth.

I think this is likely one of two issues.

One of the biggest issues I've seen is not making your BaseDN big enough. It has to encompass all of the users that would authentciate, but also all of the groups you're using. A lot of the time, this means you need to use the root DN, DC=example,DC=com. If your group is outside of BaseDN, you would get the no entries returned error.

The other issue is if you have more restrictive search policies in place. AuthenticateExtended will use the authenticating user's bind to search it's own attributes, as well as search for groups it's a part of. If this is the issue, you could try using the v3.0.0 version of this library which doesn't support nested groups. It uses the memberOf attribute instead of searching for groups.

If you need something more bare metal, you can use the Connect, Bind, and Search functions of this library, or use the ldap library directly.

You would basically have to bind with your standard user to make sure they authenticated properly then re-bind with a privileged user and do your searches.

from go-ad-auth.