This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Active Directory SSO not work

Hello!

After updating to version 7.100 and 7.101 my AD SSO don't work.
I can't joining the domain.

If I try to join the domain, I get following error:
"Joining the domain failed."

In the fallback.log file is following error:
2007:12:29-13:59:36 (none) [user:err] net: [2007/12/29 13:59:36, 0] utils/net_ads.c:ads_startup(289)
2007:12:29-13:59:36 (none) [user:err] net: ads_connect: No such file or directory
2007:12:29-13:59:36 (none) [user:err] net: [2007/12/29 13:59:36, 0] utils/net_ads.c:ads_startup(289)
2007:12:29-13:59:36 (none) [user:err] net: ads_connect: No such file or directory

I check the timezones and fqdn hostnames, but I think there is something missing on my astaro.

Has anybody a solution for this problem?

This thread was automatically locked due to age.

Parents

0 BigO over 17 years ago

Try looking at https://community.sophos.com/products/unified-threat-management/astaroorg/f/91/t/66220
It worked for me. [:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 Cowiz over 17 years ago in reply to BigO

Try looking at http://www.astaro.org/showthread.php?t=19952
It worked for me. [:)]

Goto page 4 on this thread.
Cancel
Vote Up 0 Vote Down

Cancel
0 mdallagi over 17 years ago in reply to Cowiz

Hi all,

I have the same problem:

2008:01:26-11:11:34 (none) [user:err] net: [2008/01/26 11:11:34, 0] utils/net_ads.c:ads_startup(289)
2008:01:26-11:11:34 (none) [user:err] net: ads_connect: No such file or directory

I followed the suggested https://community.sophos.com/products/unified-threat-management/astaroorg/f/91/t/66220. and I created the request routing definition but still doesn't work!

I don't see strange logs in the domain server so I don't know where is the problem...

Any suggestion?
Cancel
Vote Up 0 Vote Down

Cancel
0 harrisonpensa over 17 years ago in reply to mdallagi

Hi all,

I have the same problem:

2008:01:26-11:11:34 (none) [user:err] net: [2008/01/26 11:11:34, 0] utils/net_ads.c:ads_startup(289)
2008:01:26-11:11:34 (none) [user:err] net: ads_connect: No such file or directory

I followed the suggested http://www.astaro.org/showthread.php?t=19952. and I created the request routing definition but still doesn't work!

I don't see strange logs in the domain server so I don't know where is the problem...

Any suggestion?

I have the exact same issue. Everything is set up correctly. I confirm that access to AD is working as that is how I authenticate to the Astaro login screen.
Cancel
Vote Up 0 Vote Down

Cancel
0 MikePSmith over 17 years ago in reply to harrisonpensa

My first post here so go easy if I'm stating the obvious.  [[:)]]

I was having trouble joining the AD domain too and double-checked all of the settings in these posts.  I was missing the Request routing entry and changed my NTLM settings to the recommend level.  I noticed that the computer account for my ASG device was being created in the Active Directory Computer container but immediately being disabled and I was getting the following error in the ASG fallback log:

unable to determine machine account's dns name in AD

I changed the hostname of on my ASG device to the fully qualified name hosthame.domain.net and now it works.    [[:)]]
Cancel
Vote Up 0 Vote Down

Cancel
0 mdallagi over 17 years ago in reply to MikePSmith

Hi MikePSmith,

you said "changed my NTLM settings to the recommend level", what do you mean?
On my active directory domain there is an ASG220 v.6 with http proxy configured with active directory authentication.
Now I want to add also an ASG120 v7 to try the migration...but without success.
Cancel
Vote Up 0 Vote Down

Cancel
0 BigO over 17 years ago in reply to mdallagi

Just make sure that you use a FQDN when you configure the hostname of the ASG box.
A DNS forwarder may also help (I needed to do that to get the firewall to join the domain).

Owen
Cancel
Vote Up 0 Vote Down

Cancel
0 mdallagi over 17 years ago in reply to BigO

Hi BigO,

also configuring the FQDN as Hostname I'm not able to join the ASG to the domain, always the same error
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 mdallagi over 17 years ago in reply to BigO

Hi BigO,

also configuring the FQDN as Hostname I'm not able to join the ASG to the domain, always the same error
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 BigO over 17 years ago in reply to mdallagi

I take it that you have read and tried all of the suggestions in the thread I mentioned above.
There are many suggestions in that thread.

I have read that if an existing object already exists in the AD that ASG will fail when trying to join the domain. The new firewall has a different FQDN than your v6 one I assume.

Owen
Cancel
Vote Up 0 Vote Down

Cancel
0 mdallagi over 17 years ago in reply to BigO

Hi Owen,

another Astaro documentation issue!!!!
I found the solution but KB documentation and on-line documentation give:

To configure Active Directory SSO, proceed as follows:

   1. Complete Active Directory configuration.
      The Active Directory Single-Sign-On (SSO) area becomes editable.
   2. Make the following settings:
      Domain: NetBIOS name of the domain (in Microsoft jargon also known as pre-Windows 2000 name).
      Admin username: User with administrative privileges who is allowed to add computers to that domain (usually "Administrator").
      Password: The password of the admin user (second time for verification).
   3. Click Apply.
      Your settings will be saved.

but on the note near the SSO configuration there is:

To activate Single-Sign-On functionality, the system must join the Active Directory domain. Enter the domain name (e.g. 'intranet.yourcompany.com')  of the domain you wish to join, as well as the credentials of an admin user who is allowed to add computers to that domain.

I was not able to join the domain because I used the NetBIOS definition but when I used the DNS domain name I joined my ASG to the domain! :-)

The Astaro team must pay attention to the documentation they produced...

Thank you for the support.

Bye
Cancel
Vote Up 0 Vote Down

Cancel