Zsoldier's Tech Blog

Summary: Quite simply was trying to get an OpenLDAP identity source added to SSO/PSC.  Would work fine using non-secure LDAP, but seemed to have issues when attempting to utilize secure LDAPS.  Simple error, nondescript basically describing that it failed. Heres what happened in my case: I had two server URL's defined for my target LDAP servers. OpenLDAP Config Screen Since I had the " Protect LDAP communications... " box checked, the next step requires me to either upload the target system's certs and their authoritative chains (think Root Certificate Authority (CA) and Intermediate CA's) If you can, uploading the needed certs would save some time, otherwise you can continue w/ my outlined steps below assuming the spyglass icon works in the same fashion for you. The cert upload screen has a little spyglass icon that'll pull it down for you, but in my case it would only pull the primary server's cert and associated CA certs.  It would not p...

[Update: Cisco has opened a bug for this.  Expected to be fixed in 2.2 release, but you can track the progress here:  CSCui60138 ] Summary: In my previous post, I hypothesized that "Domain Users" simply contained too many members.  I was wrong. Details: After performing a couple of packet captures, I found that "Domain Users" was not an attribute returned in the "memberOf" property.  This seems to be a known response as "Domain Users" is typically classified as a "PrimaryGroup" and is therefore recorded in the "PrimaryGroupID" attribute. Since UCS is only looking @ the "memberOf" attribute, "Domain Users" would not be returned.  I've made Cisco TAC aware of this discovery.  Whether it gets added as a bug or is simply relegated as a low hanging feature request is anybodies guess.  In the very least, I feel better to get this monkey off my back. UCS Version: 2.1(1a) UCS LDAP Workflow (as how...