Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 2 subscribers
  • Views 7766 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Active Directory "No groups found for user"

cairnz
I've set up a win2003 DC as a server object. 
I've went into signle-sign on under users - authentication and joined the Astaro box into the domain.
My BIND DN seems to work. When i click Test the "Test passed"

When i try to authenticate a user, I get this popup 
User authentication:



LDAP call error





User is a member of the following groups:



No groups have been found for this user


When i go to the advanced tab and add a group for prefecth, i can brows the AD tree. So i add the Domain Users group and it says 0 users in group (which is wrong).
Here's the prefetch log: 
2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: Retrieving server configuration

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: -> using internal configuration from Confd

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: Using contexts from confd object

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ldap server:

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: server: 192.168.1.3

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: port: 389

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ssl: 0

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: bind_dn: CN=Administrator,CN=Users,DC=intelcom,DC=local

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: update: 0

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: contexts:

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: CN=Domain Users,CN=Users,DC=intelcom,DC=local

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: Starting synchronization for adirectory

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: Searching for users

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: Connecting to ldap server

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ldap server: ldap://192.168.1.3:389

2010:03:24-22:19:11 fw-oslo user_prefetch[6513]: No group members found for group 'CN=Domain Users,CN=Users,DC=intelcom,DC=local'

2010:03:24-22:19:11 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:11 fw-oslo user_prefetch[6513]: Performing ldap search:

2010:03:24-22:19:11 fw-oslo user_prefetch[6513]: Ldap search returned 0 users

2010:03:24-22:19:11 fw-oslo user_prefetch[6513]: Search time: 0m 0s

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: Adding/updating users

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: 0 user objects were found:

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: 0 users were created

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: 0 users were updated

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: 0 users are authenticated locally.

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: Overall time: 0m 2s 


This thread was automatically locked due to age.
  • 0
    CN=Domain Users,CN=Users,DC=intelcom,DC=local

    This appears to be a glitch that is well-documented here in the Web Security forum.  In the Astaro Backend Group definition, edit that line, leaving only: Domain Users

    Cheers- Bob
  • 0
    When i do that i get : 
    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: bind_dn: CN=Administrator,CN=Users,DC=intelcom,DC=local

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: update: 0

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: contexts:

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: Domain Users

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: ------------------------------------------------------------

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: Starting synchronization for adirectory

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: ------------------------------------------------------------

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: ------------------------------------------------------------

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: Searching for users

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: ------------------------------------------------------------

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: Connecting to ldap server

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: ldap server: ldap://192.168.1.3:389

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: Search for context 'Domain Users' failed: invalid search base or filter 
  • 0 in reply to cairnz
    CN=Domain Users,CN=Users,DC=intelcom,DC=local

    Oops, I didn't read closely enough!  You are correct to use the complete Distinguished Name in that place.  I was thinking about the Backend Group that you would put in 'Allowed users/groups' in configuring the HTTP/S Proxy.

    I don't know if it's a bug or desired behavior, but I think there's something about the built-in groups that doesn't work.  Try using a group you created and added people to like "Sales" or "Administration" instead.

    Once you get past the start-up issues, you will like this feature a lot.

    Cheers - Bob
  • 0
    I'm not really thinking of using this for http proxy, but to import the domain users for SSL VPN authorization. I just don't want to add them manually (though it's not really a problem). 

    (Which is why this thread wasn't added in web security, but under the "Management" Term for this particular forum.
  • 0 in reply to BAlfson
    I don't know if it's a bug or desired behavior, but I think there's something about the built-in groups that doesn't work.  Try using a group you created and added people to like "Sales" or "Administration" instead.


    This solved the issue, thanks.
  • 0
    Great!  Sorry about the first little wild goose chase!

    The only reason to join the Astaro to a domain is to use SSO with the HTTP Proxy.  Astaro doesn't do anything else with SSO at present.

    Cheers and Welcome to Astaro! - Bob
  • 0
    it WILL auto populate users and de-populate users and you can have them created in openvpn section as well...AD SSO is for much more than only http AD SSO..it's truly integrated if you configure it properly.
  • 0
    That's where i'm at now. I'll probably look at the AD SSO for HTTP stuff in a bit when we've got the essentials up and running. Thanks for your help!
  • 0
    Hey, William.

    If you run some experiments, I think you'll find that all those other things happen without joining the Astaro to your domain.  The whole SSO setup on the Astaro is a bit piecemeal with Mac OS X SSO being configured on the 'Advanced' tab of HTTP/S.  In the description of eDirectory-SSO, the link to HTTP is explained more explicitly.

    Cheers - Bob
  • 0
    not in my experience.  it can't auto populate AD without being joined.