# Integration with MS Active Directory

**URL:** <https://support.openanalytics.eu/t/integration-with-ms-active-directory/41>\
**Category:** ShinyProxy\
**Created:** [June 24, 2016, 3:13pm UTC](https://support.openanalytics.eu/t/integration-with-ms-active-directory/41 "2016-06-24T15:13:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Muks](https://support.openanalytics.eu/letter_avatar_proxy/v4/letter/m/4491bb/32.png) [@Muks](https://support.openanalytics.eu/u/Muks)\
**Post date:** [June 24, 2016, 3:13pm UTC](https://support.openanalytics.eu/t/integration-with-ms-active-directory/41/1 "2016-06-24T15:13:05Z")

</div>

I have a MS Active Directory that hold the following key attributes.

`Distinguished Name: CN=LName\, FName,OU=Division,OU=Deptt,DC=company,DC=com ObjectClass: person ObjectClass: user memberOf: CN=AWS-Admin,CN=Users,DC=company,DC=com memberOf: CN=DC-Admin,CN=Users,DC=company,DC=com sAMAccountName: ab1234567 `  
I want the authentication to be performed on ‘ab1234567’ and ‘password’. What should the configuration look like for achieving this? Here’s what I have and the error I am getting.

`ldap:  
url: ldap://ad.company.com:389/dc=company,dc=com  
user-dn-pattern: cn={0},ou=Division,OU=Deptt  
group-search-base: dc=company,dc=com  
group-search-filter: (uniqueMember={0})  
manager-dn: cn=ad-admin,dc=company,dc=com  
manager-password: password  
apps:

- name: 01\_hello  
docker-cmd: [“R”, “-e shinyproxy::run\_01\_hello()”]  
docker-image: openanalytics/shinyproxy-demo  
ldap-groups: [AWS-Admin, DC-Admin]  
`

> Error  
> Status code: 500

> Message: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1]; nested exception is javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1]

---

<div class="post-metadata">

**Author:** ![fmichielssen](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/fmichielssen/32/1088_2.png) [@fmichielssen](https://support.openanalytics.eu/u/fmichielssen)\
**Post date:** [July 4, 2016, 7:55am UTC](https://support.openanalytics.eu/t/integration-with-ms-active-directory/41/2 "2016-07-04T07:55:39Z")

</div>

Hi Muks,

Since there is no direct mapping from sAMAccountName to DN, you will have to use another approach.  
Try adding this to your ldap config:

`user-search-filter: (sAMAccountName={0})`

Regards,  
Frederick

---

<div class="post-metadata">

**Author:** ![Babacar\_Diouf](https://support.openanalytics.eu/letter_avatar_proxy/v4/letter/b/bbce88/32.png) [@Babacar\_Diouf](https://support.openanalytics.eu/u/Babacar_Diouf)\
**Post date:** [January 19, 2017, 8:47pm UTC](https://support.openanalytics.eu/t/integration-with-ms-active-directory/41/3 "2017-01-19T20:47:17Z")

</div>

@fmichielssen, I have two questions"

**1.How or What tool do you recommend I use to check the LDAP configuration on Windows?I want to understand how to get the information like Muks**

> [@Muks](#):
>
> Distinguished Name: CN=LName, FName,OU=Division,OU=Deptt,DC=company,DC=comObjectClass: personObjectClass: usermemberOf: CN=AWS-Admin,CN=Users,DC=company,DC=commemberOf: CN=DC-Admin,CN=Users,DC=company,DC=comsAMAccountName: ab1234567

**2. Where do I filter which user account has access to particular apps, through my Windows LDAP settings?**  
-I know there is a group filter in the ShinyProxy application.yml file however. Is this group filtering to a particular account done in the .yml file or in the LDAP.

Thanks,  
Babacar Diouf

---

<div class="post-metadata">

**Author:** ![fmichielssen](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/fmichielssen/32/1088_2.png) [@fmichielssen](https://support.openanalytics.eu/u/fmichielssen)\
**Post date:** [January 19, 2017, 9:36pm UTC](https://support.openanalytics.eu/t/integration-with-ms-active-directory/41/4 "2017-01-19T21:36:16Z")

</div>

Hi Babacar,

1. 

Personally, I use the Apache Directory Studio, which can be downloaded either as a standalone application or as an Eclipse plugin.

1. 

You need to define groups in LDAP and put users in these groups.  
This is usually done by adding `uniqueMember=<userName>` attributes to the LDAP group. The `group-search-filter` attribute in Shinyproxy is used to identify these LDAP attributes, and thus to find out who the members of the group are.

Then, in Shinyproxy’s configuration, you can grant groups access to apps, using the `ldap-groups` attribute of the app.  
So that’s important to note: you grant access to groups, not to individual users.

Shinyproxy’s sample configuration uses the forumsys public test LDAP server, which you can read more about here:

> **[Online LDAP Test Server - Forum Systems](https://www.forumsys.com/tutorials/integration-how-to/ldap/online-ldap-test-server/)**
>
> Online LDAP test server available for identity testing. Avoid download, install, config effort for LDAP server and just focus on building your application.

Regards,  
Frederick