LDAP/keberos for proxy auth - multiple domains

Question

Is it possible to configure SFOS to authenticate different users on different domains? 
 
 My work has merged with another company. Network wise the two are joined. I've successfully added the 2nd domain server and a test connection is successful. 
 
 If I try to Auth either via the portal or via a Kerberos token I get rejected as an unknown user. 
 
 Is this config even possible or am I wasting my time trying to get it to work? 
 
 Cheers 
 
 Rich

LuCar Toni · Accepted Answer

The problematic scenario here is: If there is no trust relationship between both ADs, it will not work, as SFOS (like UTM) can only be joined to one AD realm. You have to build a trust relationship for AD sso. If you want to use another authentication, like Sophos Heartbeat User ID, or STAS, this works fine with multiple AD server. Just the AD SSO component will not work, as the authentication daemon used in SFOS not be able to join Independent AD realms.

Michael Dunn · Answer

AD SSO is only supported to a single server. That server then needs to have the appropriate trust relationship to be allowed to authenticate against multiple domains. Kerberos has some other complex requirements that may or may not be met (Service Principal Name) however NTLM should work. Captive Portal will work against multiple servers and I believe STAS does as well.

LDAP/keberos for proxy auth - multiple domains

Top Replies