AD SSO – intermittent authentication failures

Hi Kent,

In such events, you need to verify if a security event log for the event ID 672 (Windows 2003) or 4768 (Windows 2008 and above) is generated in the AD for the user login attempt. If the event is generated, check the access_server.log in the XG firewall to verify the reason for User authentication failure. Refer to, the following KB articles to understand,

1. How STAS works?
2. Where to find the log file information in XG?

Thanks,

Hi Sachingurung,

For this we take an example of an user that have this issue which name "chunyl". In live user we can see that the user using web login instead of STAS.

Upon check on AD for the kerberos event 4768 does register the user and in the sophos log also do show the user successfully login to AD.

Sophos log show the user successful and user still not shown on live user and being force to user web login. 

Can anyone shed some light on what is going on?

Hi Kent,

Can you send me access_server.log via PM? I need to verify if XG receives the authentication request for this user in between 08:55-09:05. Also, is STAS working with multiple DCs?

Also, please confirm if there is a time difference between:

1. User and the DC  

2. DC and XG firewall 

is not more than 5 minutes.

Thanks,

Hi Sachingurung,

Noted. STAS only setup on a single AD no multiple DC setup involve.

I have tried your suggestion to check on the server time and I notice that it was off by couple of minute. I have made the changes and monitoring for the issue to happen.