Troubleshooting Using Apache Directory Studio

Technical Articles

Solution

Application

Content Type

Technical Documentation

Utilities & Services

ft:locale

en-US

Open Apache Directory Studio.
Note:
Apache Directory Studio is available for free at: Apache Directory Studio™
Add a new LDAP connection.
Enter a connection name.
Enter the host name of the AD server.
If you have a custom environment, modify the port and encryption method as needed.
Note:
Using an encryption method allows Jamf Pro to perform authentication with AD using LDAP over SSL (LDAPS). For more information, see Configuring Jamf Pro to Use LDAP Over SSL When Authenticating with Active Directory.
Click Check Network Parameter and verify that the host name resolves correctly. If the connection fails, see the "Additional Information" section.
Once the connection is established successfully, click OK, and then click Next.
Choose an authentication method.
Note:
Jamf Pro supports Simple, CRAM-MD5, and DIGEST-MD5 authentication types only.
Enter credentials for a bind user in AD (an AD user with permissions to browse LDAP). There are three formats you can use for the bind DN or username:
Distinguished name (DN)
The full path to the common name of the object. For example, (CN=Administrator,OU=Users,DC=ad,DC=jamfsw,DC=corp).
Domain and sAMAccountName
For example, AD\administrator.
userPrincipalName
For example, administrator@ad.jamfsw.corp.
For more information on how to find the DN or username for the bind user, see the "Additional Information" section.
Click Check Authentication to verify the credentials. If the authentication fails, see the "Additional Information" section.
Once the correct credentials are entered and verified, click OK, and then click Finish.
In Jamf Pro, click Settings in the sidebar.
In the System section, click LDAP servers .
Click New.
Select Microsoft's Active Directory and then click Next.
Enter the hostname or IP address of the LDAP server, and then click Next.
Enter the domain of the LDAP server. The domain is the value for the dc attribute in Apache Directory Studio.
Enter credentials for a bind user in AD (an AD user with permissions to browse LDAP). The username must be value for the sAMAccountName attribute in Apache Directory Studio. After you enter the username, Jamf Pro automatically adds ad\ to the beginning so that it is in the domain\username format.
Enter two users to verify attribute mappings for, and then click Next. The usernames must be the values for the sAMAccountName attributes in Apache Directory Studio. Jamf Pro will use these usernames to determine the search base for the LDAP server connection. You will be able to use the LDAP server connection to search for users that share the lowest common denominator of these two usernames. For example, if you want to be able to search for users in two different organizational units (OUs), you must enter a username from each OU.
Verify the attribute mappings for the users and click Next. These mappings are based on settings in ADUC. If you want to use custom mappings, you can enter them here or wait until later. Click the ellipsis ... button to edit mappings.
Enter two groups to verify group membership mappings for, and then click Next. The groups must be the values for the sAMAccountName attributes in Apache Directory Studio. You should choose two groups that the users from step 20 are members of.
Verify the group membership mappings and click Next.
Click Save .

After you finish creating the LDAP server connection, you should view the mappings and verify that the search bases are correct. If the users search base is OU=Test,OU=JAMFSW,DC=ad,DC=jamfsw,DC=corp, you can only search users in the Test folder. You can modify the search base to include a wider search range. For example, if you change the search base to DC=ad,DC=jamfsw,DC=corp, you can search all computers in the domain.