Active Directory Configuration¶
Extend Active Directory to Support eduPerson Schema¶
EduPerson Schema ldif file for Active Directory can be found at Internet 2 wiki .
Note: See #57 for constraints imposed by this schema
To add Active Directory property pages to mmc see Eduperson AD property pages
Allow anonymous bind¶
Enable anonymous bind¶
Open ADSIEdit.msc.
In CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,Root domain in forest , set the seventh character to 2 (0000002), anonymous clients can perform any operation that is permitted by the access control list (ACL), as can Windows 2000-based domain controllers.
Note: If the attribute is already set, do not modify any characters in the DsHeuristics string other than the seventh character. If the value is not set, make sure that you provide the leading zeros up to the seventh character. Also, you can use Adsiedit.msc to make the change to the attribute.
Set permissions¶
Open ADSIEdit.msc.In Domain Naming Context (Domain), set permissions as:
| User Object | Permissions | Inheritance | Permission Type |
| ANONYMOUS LOGON | List Contents | Container Objects | Object |
| ANONYMOUS LOGON | List Contents | Organizational Unit Objects | Object |
| ANONYMOUS LOGON | List Contents | User Objects | Object |
| ANONYMOUS LOGON | Read Public Information | User Objects | Property |
| ANONYMOUS LOGON | Read Phone and Mail Options | User Objects | Property |