LDAP module and AD global catalog Does anybody successfully authenticate against AD global catalog? I've got the following configuration:


LDAP server:
ldaps://service.mydomain.com
LDAP port:
3269
Binding Method:
Service Account Bind
Base DNs for LDAP users:
DC=service,DC=mydomain,DC=com
DC=otherdomain,DC=mydomain,DC=com
AuthName attribute:
userPrincipalName


The module successfully authenticates users, which are members of parent domain called "service", but LDAP search can't find any user from "otherdomain", which is connected to parent domain inside AD domain forest. I´m able to test LDAP search using ldp.exe and using this tool I can find any user from any domain.

Also, there is the following error message in the Drupal watchdog:


  ldap_search() function error. LDAP Error: Referral, ldap_search() parameters: ldap_search() call: base_dn: DC=otherdomain,DC=mydomain,DC=com, filter = (userPrincipalName=somebody@otherdomain.mydomain.com), attributes: , attrsonly = 0, sizelimit = 0, timelimit = 0, deref = , scope = 3


Any help will be greatly appreciated.
I know it's been over half a year so you may have already found the answer to this, but I thought I would weigh in as it is a process that I am working on myself.

For the Base DN, consider simply using DC=mydomain,DC=com.  I have not had to do this yet, so it was just a thought from their suggestion of using a higher Base DN.

I had problems authenticating until I made sure of these items:


AuthName attribute and AccountName attribute set to: sAMAccountName,
PUID set to: objectGuid
then check the box with the question "Does PUID hold a binary value?


After that, authentication went perfectly.  Good luck!