mgale / ldapfs

LDAP browsing via FUSE filesystem mount

LDAPfs

LDAPfs allows you to browse an Active Directory tree like a Linux file system.

It uses the FUSE module to present the tree in a file system like interface, all Organization Units are represented as directoriess. All Common Name entries are represented as files.

---

How to use ldapfs

./ldapfs.py --help

Things to be aware of:

• Currently the LDAP connection / file system is Read-Only
• The default cache is set to 300 seconds (5 min), it can be set via command line param
• The contents of the files are all the AD attributes in yaml format
• The AD attributes are also setup as user extended atts available via getfxattr

getfattr -n whenChanged <filename>

Ldap Connection Information

• By default all connections are ldaps unless --no-ssl is provided
• The defeault port is the Global Catalog port 3269
• We do not follow referrals

Mount Example

./ldapfs.py -u "<domain>\<username>" -p <password> --host <ip> -m ~/ldap_test --no-verify-cert

The above example causes the password to be available in the output of the ps command!!!!

./ldapfs.py -u "<domain>\<username>" --passwordfile ~/.<my_passwordfile> --host <ip> -m ~/ldap_test --no-verify-cert

This approach will read the password from a file, the password must be the last line in the file and the only text on that line.

ldapfs's Issues

Unknown Error: {'desc': 'Confidentiality required'}

The above error appears to be related to:
https://www.novell.com/support/kb/doc.php?id=7013372

--snip--
Situation

Bind error (13: Confidentiality required)
ldap_simple_bind failed: 13(Confidentiality required)
Configuring an application to bind to eDirectory over un-secure port 389 fails with "Bind error (13: Confidentiality required)"
Configuring an application to bind to Domain Services for Windows over un-secure port 389 fails with "Bind error (13: Confidentiality required)"
Configuring an application to bind to DSfW fails with "Bind error (13: Confidentiality required)"
Resolution

"Require TLS for Simple Binds with Password" is enabled and or "Require TLS for all operations" is enabled. Disable both to allow un-secure binds.

--snip--