Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 15 replies
  • Subscribers 1 subscriber
  • Views 2665 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

A possible solution to Astaro's SSO AD shortcomings

William Warren
Likewise Open Source Software that Authenticates Linux, Unix, and Mac systems with Microsoft Active Directory

This would allow astaro to fully integrate with AD and be truly SSO capable. It's gpl 3 to boot so it's truly free..[:)]


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to svens
    I know from earlier threads that AD SSO used to be quirky, so I had avoided it in the past.  Recent reports were that it works fine.  I'm cooling my heels waiting for my wife to get ready, so I just tried it on our setup at work.

    Perfect!

    My only complaint is with the documentation.  The importance of the 'Base DN' assignment is not clarified.  I was frustrated that I had to create new groups in my AD 'Users' group instead of being able to use other groups we already had in place.  Of course, all I had to do was decrease the specificity of the Base DN, but it had been so long ago that I set up AD Authentication, I had forgotten it was there.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    When you join the domain if you create a member on the AD server that information is NOT passed to the astaro.  The Astaro will not automatically create users in concert with the AD server.  If i am wrong let me know but i have one astaro connected to AD and it doesn't auto populate users.  I was told in an earlier thread this is by design and it is not an astaro issue hence my sugestion above.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0 in reply to William Warren
    I created a user 'Testy' and a group 'Test' in AD and added 'Testy' to 'Test'.

    On the Astaro, I configured prefetch with the AD group 'Test', opened the prefetch live log and kicked off a 'Prefetch now'.  I watched as 'Testy' was added.  In the User list, 'Testy' appeared along with the email address I created for him in AD.

    Are you talking about something different?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    yes i am talking about the http proxy active directory integration as i don't use prefetch.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0 in reply to William Warren
    Have you tried checking 'Create users automatically' on the 'Global' tab of 'Users >> Authentication'?  I know that the User Portal and whitelists don't work if that's not checked, even with prefetch active.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Have you tried checking 'Create users automatically' on the 'Global' tab of 'Users >> Authentication'?  I know that the User Portal and whitelists don't work if that's not checked, even with prefetch active.

    Cheers - Bob

    nod..since the latest updates though i'll blow it out and redo it from sctrach as some fields have changed.  Once that's been added is the base DN field in the active directory area...what is that?  The manual doesn't explain that one.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0 in reply to William Warren
    The Base DN is how far into the AD you can go.

    My bind user is:
    “CN=bob2,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=Ourdomain,DC=local”

    Originally, my Base DN was:
    “OU=SBSUsers,OU=Users,OU=MyBusiness,DC=Ourdomain,DC=local”

    That didn't let me get to the groups already defined in our AD.  Now, my Base DN is:
    “OU=MyBusiness,DC=Ourdomain,DC=local”

    You've been doing this a long time, William.  I'd be interested in what issues you find with Astaro SSO after you redo from scratch.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    ok i must be missing something simple.

    My username is William, I'm in the users container and then there's .local.

    here's what i have in the base dn box:
    CN=William,CN=Users,DC=,DC=Local
    I then have my password in the correct fields...what should hte base DN be?  I keep getting:

    Server exists and accepts connections, but bind to ldap://:389 failed with this Bind DN and Password

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

  • 0 in reply to William Warren
    Send me an email, BAlfson at MediaSoftUSA dot com, and I'll send you the document I recently wrote to help clients set up the User Portal with AD.  It describes what you need.  I'm just asking that you critique the document to help me improve it.

    Thanks - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson
    Bind User DN:
     
     Bind User Password:
     
     Repeat:
     
      
      Test Server  
     
     Base DN:
     

    This form configures Active Directory authentication. You need to specify at least Server and Port. 


    so what goes in the base dn section?  I'm pretty sure i ahve the user dn setup right..

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow