Disabling anonymous LDAP binding to an ADAM instance

CJA · Guest

We deployed an instance of ADAM on a Windows Server 2003 AD member server.
According to an MS article it is possible to disable anonymous LDAP binding
to an ADAM instance per the procedure below. We have followed the exact
steps, restarted the ADAM instance but it still requires credentials to
connect. Anything we are missing here? Any help will be appreciated.

1. Open ADAM ADSI Edit.

2. Connect and bind to the configuration directory partition of the ADAM
instance on which you want to allow anonymous Lightweight Directory Access
Protocol (LDAP) binding.

3. In the console tree, double-click the configuration directory partition
(CN=Configuration,CN={GUID}), double-click the services container
(CN=Services), double-click the Windows NT container (CN=Windows NT),
right-click the directory service container (CN=Directory Service), and then
click Properties.

4. In Attributes, click dsHeuristics, and then click Edit.

5. In Value, modify the value of the seventh character in the attribute
(counting from the left) to 2, as follows:

0000002001001

6. Click OK twice.

Lee Flight · Guest

Hi

setting dsHeuristics as below will ENABLE anonymous
access. Once set and the instance is restarted you should
be able to connect to the instance and then issue a search with
no bind. What happens if you try that with ldp.exe?

Bear in mind that even with anonymous access enabled you
will still need to set permissions on the naming context
for anonymous access to be able to read data.

Lee Flight

"CJA" <abraxas1969@hotmail.com> wrote in message
news:uOMdPpedGHA.4532@TK2MSFTNGP02.phx.gbl...

Joe Richards [MVP] · Guest

LDAPV3 requires at least some anonymous binding. You can't shut it off
completely and what is on by default in ADAM is minimal, you can't, in fact
generate a query that will run against anything but the rootdse unless you
enable the option you mention below that you think is disabling anonymous.

Any attempt to access any of the data partitions (app, config, or schema) with
an anonymous bind will generate an operations failure (0x01) with an extended
error of something like

Extended Error: 000004DC: LdapErr: DSID-0C09062B, comment: In order to perform
this operation a successful bind must be completed on the connection., data 0, va28

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net

---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm

CJA wrote: