Authenticating against Active Directory without bind authentication support about shinyproxy

[keqiang]

Can you clarify what you are trying to do? As I understand, the manager dn and password are used only for shinyproxy to connect to your LDAP server because LDAP can be configured only allowing certain users to read or write. Since you now successfully logged in, that means your LDAP is working, that is, either your LDAP requires the manager dn to access and the manager dn you offered is correct or your LDAP actually doesn't require a manager dn to access.

[fmichielssen]

Indeed, ShinyProxy uses BindAuthenticator rather than PasswordComparisonAuthenticator for LDAP auth. That being said, I think your use case (users are defined on many locations in the tree) is supported. The relevant settings are user-dn-pattern and user-search-filter.

• user-dn-pattern: is used to bind with a DN directly. No search is involved, so the manager account is not used here. However, since only one pattern is defined, this will not work for users that are in different OUs in the tree.

• user-search-filter: is used to search for DNs, and then bind with them. To perform the search, the manager account is used. This should support your use case.

Note that if you specify both settings, the DN pattern is tried first, and then the search.