This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Active Directory authentication issue.

I'm having an issue with active directory authentication to the User Portal.

Under Users & Groups, and my active directory group, if I keep 'Limit to backend group(s) membership' unchecked I can login just fine. If I check 'Limit to backend group(s) membership' and add the OU's that I want to have access, the authentication to the User Portal stops even if I login with an account with a specified.

Here's what the log tells me:

2017:08:18-14:48:51 firewall-1 aua[32402]: id="3006" severity="info" sys="System" sub="auth" name="Trying 10.1.1.30 (adirectory)"

2017:08:18-14:48:52 firewall-1 aua[32402]: id="3005" severity="warn" sys="System" sub="auth" name="Authentication failed" srcip="10.1.0.58" host="" user="XXXXX" caller="portal" reason="DENIED"

(XXXXX is my username redacted.)

This thread was automatically locked due to age.

Parents

0 Louis-M over 6 years ago

Have you got the users enabled in the allowed users in the portal?
AFAIK, the backend authentication only authenticates to the backend server. You still have to specify the users in the portal
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Julian over 6 years ago in reply to Louis-M

Yes. In the allowed users I have active directory users listed.
Cancel
Vote Up 0 Vote Down

Cancel
0 Louis-M over 6 years ago in reply to Alex Julian

Ummmh. Is the active directory authentication working? Have you tried it using the test buttons?
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Julian over 6 years ago in reply to Louis-M

Yep. I use the administrator for bind and my account for base and they both authenticate.
Cancel
Vote Up 0 Vote Down

Cancel
0 Louis-M over 6 years ago in reply to Alex Julian

I've just tested the on a 9.502-4 and confirm it works.

In user portal I have:

networks = any
users = the allowed users to connect (these authenticate via AD)

If I check under users, the users are "remotely authenticated"

Nothing special going on with the setup I've just done.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Julian over 6 years ago in reply to Louis-M

If I add specific OU's to be allowed, does it take time for the settings to take?
Cancel
Vote Up 0 Vote Down

Cancel
0 Louis-M over 6 years ago in reply to Alex Julian

There is a synchronize with AD button so you can force that. It's under Definitions & users > Authentication servers > advanced.
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Julian over 6 years ago in reply to Louis-M

The synchronize is grayed out for some reason.
Cancel
Vote Up 0 Vote Down

Cancel
0 Louis-M over 6 years ago in reply to Alex Julian

Active Directory Group membership Synchronization is greyed out?

You should be able to tick the box and click synchronize now....
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Julian over 6 years ago in reply to Louis-M

Nope. That's grayed out too.
Cancel
Vote Up 0 Vote Down

Cancel
0 Louis-M over 6 years ago in reply to Alex Julian

Wierd. So you have AD servers running under authentication servers and you are joined to the domain under single sign on?
Cancel
Vote Up 0 Vote Down

Cancel
0 Alex Julian over 6 years ago in reply to Louis-M

I have the AD server running but I do not have the firewall joined to the domain.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Alex Julian over 6 years ago in reply to Louis-M

I have the AD server running but I do not have the firewall joined to the domain.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Louis-M over 6 years ago in reply to Alex Julian

AFAIK, the UTM has to be a member of AD ie it needs to join the domain to which it is doing the web filtering etc.
Cancel
Vote Up 0 Vote Down

Cancel