[100] SSO unable to join AD

Hi I've been following the various threads for this problem and have been unable to join my AD.
I have a MS SBS Server with a .local AD.
below are the setting that are configured.
Under AD authentification: I have Server Host(zmain), port 389, Bind user: CN=administrator,CN=users,DC=ncs,DC=local. Click apply, all OK.
DNS Request Routing from Astaro to SBS (working):zmain.ncs.local has address 172.16.10.1
DNS entry for roxy7 (Astaro) in SBS (working):roxy7.ncs.local has address 172.16.1.1
LAN Manager auth level set to: Send LM & NTLM - use NTLMv2 session security if negotiated
Using a LDAP Browser I can navigate the tree.
Using: host -t srv _ldap._tcp.dc._msdcs.ncs.local I receive:_ldap._tcp.dc._msdcs.ncs.local has SRV record 0 100 389 zmain.ncs.local.

Under SSO.
NCS.LOCAL (Which system put there after .100 upgrade) and have manually changed.
Admin User: I have tried every option that I can think of with administrator ie. administrator, ncs.local\administrator, NCS.LOCAL\administrator, CN=administrator, CN=administrator,CN=users,DC=ncs,DC=local.
Click Apply. and receive a number of "the running request has reached a timeout without finishing, do you want it to be aborted?" click no wait another 30 sec. "Then unable to complete backend request".
Note if I change the Domain to NCS I get an instant (15sec) "Joining the domain failed."

Tests completed so far:
1. DNS working.
2. LDAP working.
3. Looking in fallback log I get
2007:12:04-16:59:49 (none) [user:err] net: [2007/12/04 16:59:49, 0] utils/net_ads.c:ads_startup(289)
2007:12:04-16:59:49 (none) [user:err] net: ads_connect: Operations error
2007:12:04-17:00:29 (none) [user:err] net: [2007/12/04 17:00:29, 0] utils/net_ads.c:ads_startup(289)
2007:12:04-17:00:29 (none) [user:err] net: ads_connect: Operations error

Where have I gone wrong or what am I missing.

Thanks for any responses
Help
Mark

Parents

0 Simon Shaw over 17 years ago

I can only get SSO working using short domain name to join the AD.

ie PERTH and not the long name which is company.com.au
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 TXGARobert@Home over 17 years ago in reply to Simon Shaw

I had to use the full domain name (DOMAIN.ORG) , and it had to be in CAPS. Weird.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 17 years ago in reply to TXGARobert@Home

Hey Mark, I had an issue too... after some time with Astaro support, found that the winbindd process was "flipping out." A trip to /var/locks found that the file winbinddd.pid had an old timestamp on it (from yesterday)... manually deleting that file, then stopping and starting the http proxy (which causes winbindd to reinitialize) fixed my problem. It's the only system I've had the problem on, just got done updating a customer's system an hour or so ago and had no problem.

One Idea: check for a computer account matching the name of your Astaro in AD; delete it, make sure all your DCs are synced up, then try rejoining.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 BrucekConvergent over 17 years ago in reply to TXGARobert@Home

Hey Mark, I had an issue too... after some time with Astaro support, found that the winbindd process was "flipping out." A trip to /var/locks found that the file winbinddd.pid had an old timestamp on it (from yesterday)... manually deleting that file, then stopping and starting the http proxy (which causes winbindd to reinitialize) fixed my problem. It's the only system I've had the problem on, just got done updating a customer's system an hour or so ago and had no problem.

One Idea: check for a computer account matching the name of your Astaro in AD; delete it, make sure all your DCs are synced up, then try rejoining.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 BrucekConvergent over 17 years ago in reply to BrucekConvergent

Mark: Also make sure your timezone setting on the Astaro matches your DC, and that the times are within 5 minutes of each other; Kerberos is quite sensitive about the time.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 TXGARobert@Home over 17 years ago in reply to BrucekConvergent

Bruce -

Any suggestions on where to start looking if my Basic authentication fails, but AD SSO and AD web auth works?

My network is all Windows 2003 DCs running in 2003 native mode.  Mixture of WinXp and Win2k computers.  all exibit the same problem.  Auth box pops up, name and password entered, fails auth.  The log shows "DENIED" as a reson.

Have tried the domain\user method when entering the username, but it fails always.

I have rejoined the domain since 7.100, same results.  Even tried using a different DC to authenticate against.  Same thing.

I submitted a ticket, but they are looking at other things right now.  Just trying to get an idea where to look.

Thanks,
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 17 years ago in reply to TXGARobert@Home

Don't know about Basic Authentication... my problem was with AD.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Mark_D_01 over 17 years ago in reply to BrucekConvergent

Thanks Guy's for your response.
I did forget to mention that I checked the time zones and clocks are currently 12 sec out, I also tried adding and deleting computer name for astaro.
Checking /var/locks I found that the file winbinddd.pid did not exist.
I'm about to download a new iso of 7.100 and install on a new box to see what happens.

Any other suggestions out there?

Thanks again
Mark
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 apave over 17 years ago in reply to Mark_D_01

Hi,

I'm new to Astaro. I'm getting the same problem. Unable to join my AD domain (I was when using v7.011).
When I try to join the domain I get a failed message. A look at the computers account shows astaro's box hostame desactivated.

Fallback logs shows :
unable to determine machine account's DNS name in AD (nslookup for DC is ok) and

another one :
no dNSHostName attribute

maybe it'll help...
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 svens over 17 years ago in reply to apave

Hi,

unable to determine machine account's DNS name in AD (nslookup for DC is ok)

Do you have the FQDN as hostname configured (means asg.domain.com instead of only 'asg'), and is the ASG in the same DNS domain as the Domain Controller?

Cheers,

Sven.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 apave over 17 years ago in reply to svens

Hi,

Do you have the FQDN as hostname configured (means asg.domain.com instead of only 'asg'), and is the ASG in the same DNS domain as the Domain Controller?

Cheers,

Sven.

Thanks Sven, you solved the problem.

The hostname wasn't configured as an fqdn. Setting it up correctly resolved the issue.

Thanks again

Bertrand
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 17 years ago in reply to apave

Yep... major difference (as outlined in the 7.100 release notes) in the new 7.100 version: To use AD SSO, you have to use the FQDN. You also should configure your web browsers to use the the FQDN of the Astaro unit itself instead of just the IP (if you haven't already). They also dropped NT4 (about time) domain support at the same time.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 apave over 17 years ago in reply to svens

Thanks Sven,

You were right, the host name wasn't correctly set up. Joining the domain using an FQDN name solved the problem

Thanks again.

PS : I have another issue and created a new thread for it.

How to : authenticate users from Windows 200X sub domains
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 apave over 17 years ago in reply to BrucekConvergent

Thanks BrucekConvergent for the additional informations, I think it will avoid me some more troubles.

And thanks for the reactivity Bruce & Sven
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[100] SSO unable to join AD

Submitted a Tech Support Case lately from the Support Portal?