[7.075] Joining AD does not work for .local domains [CONFIRMED]

All,

After updating my ASG120 7.011 to 7.075, I was unable to login to webadmin using my usual Active Directory user credentials (which worked with 7.011)

I was able to gain access using webadmin's locally defined 'admin' user account to gain access.

I've tried redefining my 'Active directory domain admins' group in Users >> Groups. This group is specifed in Management >> WebAdmin Settings, under Allowed Users.
Still unable to access WebAdmin using my active directory credentials.

I had read that 7.075 included native active directory support, so I went to Users >> Authentication >> Active Directory to see if anything had changed (nothing as far as I can see).

I noticed that the domain specified under the Active Directory Single-Sign-On (SSO) was done so using it's NetBIOS name (contrary to the help text shown which suggests a dns domain name). I re-specified my domain using its dns name, but I receive a timeout message, and a message saying 'joining the domain failed'.

Now it appears that my ASG box is not communicating with Active Directory, because any attempt to access the internet via the HTTP proxy (which previously used Active Directory SSO), is resulting in a username/password request. Furthermore, authentication fails even if 'valid' credentials are supplied.

With my 7.011 installation, I had no problems with this. Is there something else I need to do with 7.075? What of the Active Directory 'native support'?

Regards,

Alex

P.S. I've found that general WebAdmin speed/performance has improved significantly with 7.075 [:)]

0 AlexE over 16 years ago in reply to AlexE

I've set up 7.075 on a virtual PC with a connection to my LAN. After doing the host.conf mod, I can successfully perform a ping check on network hosts using their dns hostname e.g. myhost.mydomain.local.
However, I stll can't join the domain e.g. mydomain.local. The message 'joining the domain failed' is returned. After a refresh, the status is updated to 'joined domain mydomain.local'.
This is also the result after attempting to join 'anydomain.anything', using any admin username.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 16 years ago in reply to svens

Good... Just want to make sure we'll have a smooth transition to 7.100, sounds like you guys have it handled.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Scott_Klassen over 16 years ago in reply to BrucekConvergent

Would this issue also affect a .corp domain?

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 svens over 16 years ago in reply to Scott_Klassen

Would this issue also affect a .corp domain?

No,

this affects only .local domains. Do you have any problems joining AD, or is this question just out of curiosity? [;)]

Cheers,

Sven.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 amcycler over 16 years ago in reply to svens

brand new install and updated to version 7.080. Still can not join AD domain. Fallback logs gives this error message - net: ads_connect: Operations error. when i run kinit from the shell the message "Cannot contact any KDC for the requested realm ...". This is a W2k domain in native mode. I can ping the DC from the web interface and from the command line. I can also authenticate against the DC when logging into the Web Portal using a user with remote authentication.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Scott_Klassen over 16 years ago in reply to amcycler

The .corp question was just to be knowledgable in advance of upgrading my production work ASG 220, since that is the domain suffix in use within the environment.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 tom_01 over 16 years ago in reply to amcycler

amcycler, to see if your DNS can resolve correctly, please try running:


host -t srv _ldap._tcp.dc._msdcs.

on the ASG.

For example:


host:/root # host -t srv _ldap._tcp.dc._msdcs.intranet.astaro.de
_ldap._tcp.dc._msdcs.intranet.astaro.de has SRV record 0 100 389 dc9.intranet.astaro.de.
_ldap._tcp.dc._msdcs.intranet.astaro.de has SRV record 0 100 389 dc1.intranet.astaro.de.
_ldap._tcp.dc._msdcs.intranet.astaro.de has SRV record 0 100 389 dc2.intranet.astaro.de.
_ldap._tcp.dc._msdcs.intranet.astaro.de has SRV record 0 100 389 dc8.intranet.astaro.de.

Do you also get SRV records for your domain with this command?

0 AlexE over 16 years ago in reply to tom_01

Hi Tom,
I'm still having no luck joining to my AD domain. Now on version 7.086.
I've tried the host -t ... command shown above, which seems to produce the desired result.
The output of the command is:

output.jpg

It's perhaps worth mentioning that when I try to join the domain, a computer account for the ASG box is automatically created in active directory. However, in webadmin, the 'joining the domain failed' message is returned.

Thanks for the help so far...
- output.jpg
- View
- Hide
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 svens over 16 years ago in reply to AlexE

This seems ok - can you check that a ping server-1.chadfort.local works from the ASG? Can you post an excerpt from /var/log/fallback.log? There should be some line written why domain joining failed.

Cheers,

Sven.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 amcycler over 16 years ago in reply to svens

I finally was able to join the domain. I totally wiped the installation and applied all updates. At first it would not then for no reason other than I capitolized the domain name it worked. Now SSO works for proxy access and I've had no problems with it at all.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel