Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 2 subscribers
  • Views 7778 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Active Directory "No groups found for user"

cairnz
I've set up a win2003 DC as a server object. 
I've went into signle-sign on under users - authentication and joined the Astaro box into the domain.
My BIND DN seems to work. When i click Test the "Test passed"

When i try to authenticate a user, I get this popup 
User authentication:



LDAP call error





User is a member of the following groups:



No groups have been found for this user


When i go to the advanced tab and add a group for prefecth, i can brows the AD tree. So i add the Domain Users group and it says 0 users in group (which is wrong).
Here's the prefetch log: 
2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: Retrieving server configuration

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: -> using internal configuration from Confd

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: Using contexts from confd object

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ldap server:

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: server: 192.168.1.3

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: port: 389

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ssl: 0

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: bind_dn: CN=Administrator,CN=Users,DC=intelcom,DC=local

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: update: 0

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: contexts:

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: CN=Domain Users,CN=Users,DC=intelcom,DC=local

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: Starting synchronization for adirectory

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: Searching for users

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: Connecting to ldap server

2010:03:24-22:19:10 fw-oslo user_prefetch[6513]: ldap server: ldap://192.168.1.3:389

2010:03:24-22:19:11 fw-oslo user_prefetch[6513]: No group members found for group 'CN=Domain Users,CN=Users,DC=intelcom,DC=local'

2010:03:24-22:19:11 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:11 fw-oslo user_prefetch[6513]: Performing ldap search:

2010:03:24-22:19:11 fw-oslo user_prefetch[6513]: Ldap search returned 0 users

2010:03:24-22:19:11 fw-oslo user_prefetch[6513]: Search time: 0m 0s

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: Adding/updating users

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: ------------------------------------------------------------

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: 0 user objects were found:

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: 0 users were created

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: 0 users were updated

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: 0 users are authenticated locally.

2010:03:24-22:19:12 fw-oslo user_prefetch[6513]: Overall time: 0m 2s 


This thread was automatically locked due to age.
  • 0
    CN=Domain Users,CN=Users,DC=intelcom,DC=local

    This appears to be a glitch that is well-documented here in the Web Security forum.  In the Astaro Backend Group definition, edit that line, leaving only: Domain Users

    Cheers- Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    When i do that i get : 
    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: bind_dn: CN=Administrator,CN=Users,DC=intelcom,DC=local

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: update: 0

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: contexts:

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: Domain Users

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: ------------------------------------------------------------

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: Starting synchronization for adirectory

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: ------------------------------------------------------------

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: ------------------------------------------------------------

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: Searching for users

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: ------------------------------------------------------------

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: Connecting to ldap server

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: ldap server: ldap://192.168.1.3:389

    2010:03:24-22:42:48 fw-oslo user_prefetch[7003]: Search for context 'Domain Users' failed: invalid search base or filter 
  • 0 in reply to cairnz
    CN=Domain Users,CN=Users,DC=intelcom,DC=local

    Oops, I didn't read closely enough!  You are correct to use the complete Distinguished Name in that place.  I was thinking about the Backend Group that you would put in 'Allowed users/groups' in configuring the HTTP/S Proxy.

    I don't know if it's a bug or desired behavior, but I think there's something about the built-in groups that doesn't work.  Try using a group you created and added people to like "Sales" or "Administration" instead.

    Once you get past the start-up issues, you will like this feature a lot.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    I'm not really thinking of using this for http proxy, but to import the domain users for SSL VPN authorization. I just don't want to add them manually (though it's not really a problem). 

    (Which is why this thread wasn't added in web security, but under the "Management" Term for this particular forum.
  • 0 in reply to BAlfson
    I don't know if it's a bug or desired behavior, but I think there's something about the built-in groups that doesn't work.  Try using a group you created and added people to like "Sales" or "Administration" instead.


    This solved the issue, thanks.
  • 0
    Great!  Sorry about the first little wild goose chase!

    The only reason to join the Astaro to a domain is to use SSO with the HTTP Proxy.  Astaro doesn't do anything else with SSO at present.

    Cheers and Welcome to Astaro! - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    it WILL auto populate users and de-populate users and you can have them created in openvpn section as well...AD SSO is for much more than only http AD SSO..it's truly integrated if you configure it properly.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0
    That's where i'm at now. I'll probably look at the AD SSO for HTTP stuff in a bit when we've got the essentials up and running. Thanks for your help!
  • 0
    Hey, William.

    If you run some experiments, I think you'll find that all those other things happen without joining the Astaro to your domain.  The whole SSO setup on the Astaro is a bit piecemeal with Mac OS X SSO being configured on the 'Advanced' tab of HTTP/S.  In the description of eDirectory-SSO, the link to HTTP is explained more explicitly.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    not in my experience.  it can't auto populate AD without being joined.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

Cookie Information Banner