This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[ASG220 7.200] Debugging AD SSO Authentication for SSL VPN

Hi All,

I've got SSL VPN working fine with local users. I now want to auth off of AD.

I've setup SSO (joined the firewall to the domain).

I'm now trying to get Portal and SSL VPN authentication working via AD.

So far:

- I've create a user group with Backend membership
- I've added the group to the Users and Groups in the Global VPN settings
- I've set Allow all users in the End-User Portal

I'm seeing DENIED errors in the User Authentication Daemon logs when I try and logon using an account in AD.

Is there anything special I have to do in AD to make this happen? I think my DN is correct for our domain:

CN=adminjb,OU=DRD,OU=Users,CN=Admin,DC=drd,DC=int

Do I need my authenticating users in a special OU?

I've enabled success/failure auditing on the DC for logons and authentication but I'm not seeing anything.

Any pointers gratefully appreciated.

TIA,

j.

This thread was automatically locked due to age.

Parents

0 cko over 17 years ago

i think u cannot do that.. sadly. i tried this aswell but as far i know this isnt supported.. please correct me if im wrong but this is the most missing feature in ssl vpn deployment!
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 17 years ago in reply to cko

Guys, AD authentication is supported with the SSL VPN. Try adding the individual users to the VPN allow list as opposed to the group... there has been problems in the past with AD Groups not working properly.
Cancel
Vote Up 0 Vote Down

Cancel
0 cko over 17 years ago in reply to BrucekConvergent

i didnt say its not supported.. it works when adding all users to the allow list.. but you can only do that after a user logged on to the enduser portal. so whats the idea of a backend group then when i cannot use it for ssl vpn authentication... ?
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 17 years ago in reply to cko

I've used the backend group function, it works (at least I have 2 or 3 customers that are using it, seems to work just fine). It was broken in earlier releases.
Cancel
Vote Up 0 Vote Down

Cancel
0 James Bourne over 17 years ago in reply to BrucekConvergent

Hey Bruce ... you got an example of how you made it work? (Screenshots?).

TIA,

j.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 James Bourne over 17 years ago in reply to BrucekConvergent

Hey Bruce ... you got an example of how you made it work? (Screenshots?).

TIA,

j.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data